Privacy Policy

Grupo Gran Madrid may amend its Privacy Policy in accordance with the legislation in force at any given time. In any event, the User will be duly notified of any amendment that constitutes a material change to the Privacy Policy so that they are informed of the changes made to the processing of their personal data and, where required by the applicable regulations, the User may give their consent.

The Grupo Gran Madrid website may contain hyperlinks to other sites that are not operated or controlled by Grupo Gran Madrid. Consequently, Grupo Gran Madrid does not guarantee, nor is it responsible for, the lawfulness, reliability, usefulness, accuracy or timeliness of the content of such websites or their privacy practices. Please bear in mind, before providing your personal information to these websites outside Grupo Gran Madrid, that their data protection practices may differ from ours.

Grupo Gran Madrid may use ‘cookies’ when you browse its websites. ‘Cookies’ are files sent to a browser by a web server to maintain the browsing session by storing your computer’s IP address and other possible browsing data. ‘Beacons’ are electronic images that enable a website to count the number of visitors and users who have accessed a particular website and to access certain ‘cookies’. Thanks to ‘cookies’, it is possible for the Grupo Gran Madrid server to recognise the browser of the computer used by the User. The aim is to facilitate browsing and improve the user experience, as well as to measure audience figures and traffic parameters (using ‘beacons’), and to monitor progress and visitor numbers, using the information contained in the ‘cookies’ in a manner that is disassociated from any other personal data that may be held about the User.

Users can configure their browser to display a warning on screen when cookies are received and to prevent them from being stored on their hard drive.

For further information, please visit the Cookies Policy section.

The purpose of this document is to provide you with clear and accurate information regarding the processing of your personal data (images) captured by Gran Madrid’s video surveillance systems, in strict compliance with current data protection legislation.

Basic information on data processing

Main purpose	Retention period	Exercising rights
To ensure the safety of people, property and facilities on our premises.	The images are retained for a maximum of 30 days, unless required by law or by a court order.	You may exercise your rights of access, erasure and others by contacting our Data Protection Officer at [email protected]

Detailed information on data processing

1. Data Controller

The Gran Madrid Group entities listed below are joint data controllers for the data collected via the video surveillance systems at their respective premises:

Casino de Juego Gran Madrid, S.A. (for the Torrelodones and Colón centres in Madrid)

Esgaming, S.A.U. (for the offices in Melilla)

In order to facilitate the exercise of your rights, Casino de Juego Gran Madrid, S.A., Autovía A-6 km 29, 28250 Torrelodones, Madrid, has been designated as the single point of contact for any matter relating to this processing.

2.Data Protection Officer (hereinafter “DPO”)

If you have any queries regarding the processing of your personal data or wish to exercise your rights, please contact our DPO by email at: [email protected]

3. For what purposes do we process your images?

The processing of images obtained through our video surveillance systems is carried out solely for the following purposes:

• To ensure the safety of customers, employees, property and premises.

To prevent unlawful acts and fraud within the premises.

To comply with legal obligations relating to gaming and private security.

To serve as evidence in legal or police proceedings, should this be formally requested.

4. What is the legal basis for the processing?

The processing of your data is based on the following legal grounds:

Legitimate interest (Art. 6(1)(f) GDPR): Gran Madrid’s interest in protecting its assets and ensuring a safe environment for the conduct of its business.

Legal obligation (Article 6(1)(c) of the GDPR): compliance with the obligations imposed on gaming establishments under Law 5/2014 on Private Security.

5. How long are the images retained?

The recordings will be retained for a maximum of 30 days from the date they were captured. Once this period has elapsed, they will be securely deleted, except where they must be retained and blocked for a longer period at the request of the courts or the State security forces.

6. To whom will your data be disclosed?

Access to the images is strictly limited. Your data will only be disclosed to:

State law enforcement agencies and the relevant judicial authorities, following an official request.

The security services provider, in its capacity as Data Processor and under a strict contract that guarantees confidentiality and regulatory compliance.

7. What are your rights and how can you exercise them?

The regulations grant you the following rights regarding your images:

Right of Access: to obtain confirmation as to whether your images are being processed.

Right to Erasure: to request the deletion of your images, within the limits of the law.

Right to Restriction: to request that the processing of your images be restricted, within the limits of the law.

8. Procedure for exercising your rights:

Please send a written request to our DPO’s email address: [email protected].

Please specify in your request the right you wish to exercise, as well as the date and approximate time slot of your visit, to help us locate the relevant images.

Please provide proof of your identity by submitting a copy of your national identity card or an equivalent official document.

Please note that if you consider your rights to have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) www.aepd.es.

Grupo Gran Madrid is committed to fulfilling its obligation to keep personal data confidential and its duty to safeguard it, and will take the necessary measures to prevent its alteration, loss, unauthorised processing or access, in accordance with the provisions of the applicable regulations.

Grupo Gran Madrid has implemented the necessary technical and organisational security measures to guarantee the security of your personal data and to prevent its alteration, loss, unauthorised processing and/or access, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed, whether arising from human action or from the physical or natural environment, in accordance with the provisions of applicable legislation.

At Grupo Gran Madrid, we recognise that security is a fundamental aspect of online gaming. That is why, in our online platform, we aim to honour the trust we have built up over our long history by offering our customers and users the assurance of our brand’s comprehensive security.

To this end, we utilise state-of-the-art technologies and hold the most prestigious security certificates, which attest to the robustness of our system. The Grupo Gran Madrid platform is based on a multi-layered architecture that provides a high level of security by implementing various physical and logical control measures, making it impossible to carry out fraudulent transactions.

All communications between the system’s components are encrypted and authenticated using high-level standards, ensuring that any attempted intrusion is easily intercepted and prevented. This means you need only worry about enjoying our games with complete peace of mind.

Grupo Gran Madrid is the first and only online casino platform authorised by the Community of Madrid (administrative authorisation no. TC-18) to offer online gambling services.

All personal and account details are transmitted via encrypted pages that prevent any possibility of unauthorised access to the information.

All our games are reviewed and approved by the Foundation for the Promotion of Industrial Innovation at the Polytechnic University of Madrid through strict security controls that guarantee the randomness of the results and the robustness of our rigorous checks.

he Gran Madrid Group wishes to inform you that if you are under 18 years of age, legally incapacitated, or listed on the General Register of Gambling Access Restrictions or the Register of Persons Linked to Gambling Operators, you are prohibited from entering or registering at any of the Group’s land-based casinos or participating in any online gambling activities offered by the Gran Madrid Group.

If you find yourself in any of the situations described above and are therefore unable to gamble, please do not provide us with any personal data. We do not wish to, nor are we permitted to, process data relating to any person unauthorised to gamble, nor to promote our games to such individuals. If, in any way, we become aware that you have registered whilst in any of the situations outlined above, or have provided false information during registration, we will immediately take all necessary steps to ensure that your registration is removed.

As mentioned in the previous section, the User has the right to withdraw their consent to receive marketing communications at any time by simply notifying Grupo Gran Madrid that they no longer wish to receive such communications. To do so, the User may either withdraw their consent as described in the previous section or click on the link included in each commercial communication, thereby cancelling the sending of electronic commercial communications.

Grupo Gran Madrid hereby informs the User of their right to exercise the rights of access, rectification, objection, erasure, data portability and restriction of processing, as well as to object to the automated processing of personal data collected by Grupo Gran Madrid.

These rights may be exercised free of charge by the User, or where applicable by their representative, by means of a written and signed request sent to the following address: Autovía A-6 km 29, 28250 Torrelodones, Madrid. The subject line of such a request must state ‘Data Protection’ and must include the following details: the User’s full name, address for notification purposes, a photocopy of their National Identity Card or passport, and a statement specifying the nature of the request. In the case of representation, proof of such representation must be provided by means of a valid supporting document. Furthermore, the User may exercise the aforementioned rights by emailing [email protected].

In addition to the above rights, the User shall be entitled to withdraw their consent at any time by following the procedure described above, without such withdrawal affecting the lawfulness of any processing carried out prior to the withdrawal. Grupo Gran Madrid may continue to process the User’s data to the extent permitted by applicable law.

Furthermore, where the processing of the User’s personal data for purpose (d) is based on legitimate interests, the User may object to such processing.

Grupo Gran Madrid reminds the User that they have the right to lodge a complaint with the relevant supervisory authority.

In order to ensure the optimal provision of the service offered by Grupo Gran Madrid via its website, it may be necessary to transfer data or for other third-party service providers of Grupo Gran Madrid to access the User’s personal data, either as data processors or data controllers. By accepting this Privacy Policy, the User acknowledges that some of the aforementioned service providers are located in countries outside the European Economic Area or which do not offer a level of security equivalent to that in Spain. In such cases, transfers are based on authorisation from the Spanish Data Protection Authority, on standard contractual clauses approved by the Commission or, where applicable, on the Privacy Shield. For further information on the above safeguards or whether they have been provided, you may contact Grupo Gran Madrid via the channels set out in Section I.

In addition to the above, Grupo Gran Madrid may transfer or disclose personal data in order to fulfil its obligations to public authorities where required under the legislation in force at any given time and, where applicable, to other bodies such as the State Security Forces and Judicial Authorities.

Grupo Gran Madrid will retain its customers’ data for the duration of their contractual relationship and, thereafter, the data will be retained for promotional purposes for a period of two years. For other types of users, the data will also be retained for a period of two years from the last interaction, or for a longer period if you have given us specific consent to do so or if there is another legitimate basis for the processing of your data, of which we will inform you appropriately. All of the above is without prejudice to any retention that may be necessary to comply with legal obligations, or to establish, exercise or defend potential claims, and/or wherever permitted by applicable legislation.

The legal basis for processing data for purposes (a), (b) and (c) is the performance of the contract for the provision of services and/or the purchase of the relevant products.

The legal basis for processing data for purposes (d) and (h) is both the User’s consent, where this has been requested and given, and Grupo Gran Madrid’s legitimate interest in informing the User of products or services similar to those previously purchased.

The legal basis for processing data for purpose (e) is any consent that may have been requested from the User, without the withdrawal of such consent in any way affecting the performance of the service provision contract. The legal basis for processing data for purpose (e) is the consent that may have been requested from the User, and under no circumstances shall the withdrawal of such consent affect the performance of the service provision contract.

The legal basis for processing data for purpose (f) shall be the legitimate interest of Grupo CGM in optimising the provision of its services and analysing the performance of its business.

The legal basis for processing data for purpose (g) will be compliance with a legal obligation applicable to the data controller.

The User acknowledges and accepts that failure to provide certain personal data will prevent Grupo Gran Madrid from providing all services linked to such data. Under no circumstances will Grupo Gran Madrid transfer or exploit this data, nor will it use it for any purpose other than that expressly stated herein. During the registration process, the User will be informed that the provision of certain data is not mandatory for the provision of Grupo Gran Madrid’s services.

The User is hereby informed that Grupo Gran Madrid may process the personal data provided by the User via online forms or during the registration process in order to benefit from any of Grupo Gran Madrid’s products or services, for the purposes set out below, provided there is a legal basis for each instance of processing as explained further below:

The provision of gambling and casino services, both online and in person, including, but not limited to, making deposits into your user account, participating in casino games and placing bets on such games, as well as the provision of hospitality, promotional and customer service activities.

The handling of all your requests for information and complaints.
To manage access to Grupo Gran Madrid’s casinos in accordance with current legislation requiring accreditation and to confirm compliance with security standards and gambling regulations, including age verification, as well as the legal requirements and processes relating to fair play.

To inform you, by any means, including by sending marketing communications to the email address you provide, about Grupo Gran Madrid products and services similar to those you have purchased.

The creation of a “commercial profile”, based on the information provided, with the aim of offering you products and services tailored to your interests, thereby enhancing your customer experience. In relation to this last point, we always seek your consent, which you may withdraw at any time by contacting [email protected].

The processing of your personal data for statistical and analytical purposes, including profiling and automated decision-making.

The cross-referencing and processing of your data with other data held about you by the Joint Data Controllers, or by public bodies or authorities, in order to comply with the restrictions on visitor admission set out in the applicable legislation on gambling and betting, to fulfil anti-money laundering obligations, and for possible disclosure to the State Security Forces, Tax Authorities and other competent bodies responsible for regulating gambling.
To manage your participation in prize draws and promotions in which you take part and to inform you of future promotions.

This privacy policy (hereinafter, the “Privacy Policy”) applies to all personal data provided by the user to Casino de Juego Gran Madrid, S.A. and/or EsGaming, S.A.U. and/or Gran Madrid Sistemas S.L. all of which are registered at Autovía A-6 km 29, 28250 Torrelodones, Madrid, and/or to Casino de Torrequebrada S.A., registered at Avenida del Sol, s/n, 29630 Benalmádena-Costa, Málaga (collectively, the “Joint Data Controllers” or “Gran Madrid Group”).

For the purposes of this Privacy Policy, the term “User” refers to any individual interested in the products and services that the Gran Madrid Group offers via its websites, apps, social media, other third-party online platforms and in person. Grupo Gran Madrid, as a joint data controller, will request, prior to the provision of your personal data, the User’s express consent to this Privacy Policy, where necessary, and to any other matter requiring the User’s prior authorisation. The aim of Grupo Gran Madrid’s Privacy Policy is to provide transparency regarding how we process your data and to protect information online and any data that the User may enter on the website.

The User may contact Grupo Gran Madrid’s Legal and Regulatory Compliance Office via [email protected] should they have any queries or require any assistance.