This document sets out the processing of your personal data and your rights under current data protection legislation – Regulation (EU) 2016/679 of the European Parliament and of the Council of the 27th of April 2016 on the protection of individuals with regard to the processing of personal data and the regulations implementing it, hereinafter “GDPR”. Data processed and its use may vary depending on the relationship we have with you, and the services requested and/or provided.

1. Data processor and contact details

The entity responsible for the processing of your data is Origen Murcia, S.A.U., with registered office at Avda. de Alicante, 170 30007 Murcia, Spain.

If you wish, you can contact the Data Protection Representative through the following e-mail address dpo@orenesgrupo.com or through the postal address described above.

2. What is the purpose for which we process your data (object of processing) and on what legal basis?

Personal data is processed in accordance with the provisions of the GDPR, on the following legal basis:

a. In the context of the performance or fulfilment of contractual obligations -Art. 6.1 b) GDPR-

To fulfil our contractual obligations to you, including to register an account to use our services.

Management of contracted services.
Fulfilling accounting, legal, tax and administrative obligations.

b. Justified by a legitimate interest -Art. 6.1. f) RGPD-.

When necessary, Origen Murcia, S.A.U. will process your personal data to satisfy its own or third parties’ legitimate interests in the following cases:

Recording of images on the premises of Origen Murcia, S.A.U. for security reasons, as well as to collect evidence in cases of theft and/or fraud.
Management of customer complaints.
Management of customer service for the resolution of requests generated by customers or potential customers.
Carrying out controls for the detection of fraudulent activities.

c. Consent -Art. 6.1a) RGPD-.

Provided that you have given us your consent, we may carry out the additional processing operations of which you have been informed and to which you consent. You may revoke your consent at any time. This also applies if your consent was given before the entry into force of the EU General Data Protection Regulation, i.e. before 25 May 2018. It should be noted that objections to a particular processing operation and revocation of consent are not retroactive. You may at any time obtain information on the authorisations you have granted us for the various processing operations by exercising your rights in accordance with section 8.

Origen Murcia, S.A.U. will request your authorisation to process your data for the following purposes:

Management of the contact data collected through the forms present in the corporate web pages.
Management of the payment of cash prizes.
Management of the registration of jackpot winners.
Management and publication of photographs of participants in events.
Sending commercial, promotional and/or advertising communications, which may be based on the products contracted or services provided.
The automatic categorisation of my user according to my gaming profile in order to receive communications tailored to my preferences and needs. Personal data may be processed for profiling based on internal sources (e.g. cookies, historical and statistical navigation data) whose results allow the creation and analysis of personalised products, through segmentation into different groups in relation to common patterns. Such profiling will only be used to send you personalised communications about products and/or services.

Likewise, our Casinos division will also require your consent to:

Making informative communications about the organisation of themed dinners to interested customers.
To send you information about invitations to special events.
Making informative communications about the organisation of poker tournaments to players subscribed to the Poker Club.
Management and publication of photographs of participants in poker tournaments.

d. By law or in the public interest -Art. 6.1 c) and e) RGPD-.

As a company in the gaming and betting sector, Origen Murcia, S.A.U. is subject to various legal obligations (e.g. Gambling Regulation Act, Prevention of Money Laundering and Terrorist Financing Act, Tax Act), and various supervisory regulations.

Thus, we process data on this legal basis in the following cases:

Management of the portfolio of players who make use of the services offered by Bingos and Casinos, including the payment of prizes and the management of the registration of entry to the facilities.
Management of the portfolio of players registered on the Online Sports Betting and Online Casino platform, including the management of the registration of entry to the on-site betting facilities.
Management of administrative or judicial proceedings involving customers and Origen Murcia, S.A.U. This treatment may also be based on the legitimate right of Origen Murcia, S.A.U. to effective judicial protection, both in its right of defence and in the filing of legal claims it deems appropriate, based on the rules of civil or criminal prosecution.
Issuance of winnings certificates to players who request them.
Registration of winners and management of prizes in excess of €2,000.
Management of the register of banned players in order to prevent their access to Origen Murcia, S.A.U. facilities.
Management of embargoes imposed on customers in order to comply with the legal obligations applicable to Origen Murcia, S.A.U.
Compliance with the legal obligations applicable to Origen Murcia, S.A.U. regarding the Prevention of Money Laundering.
External audits or reviews to which Origen Murcia, S.A.U. is subject, either by applicable regulation, or carried out voluntarily to verify our internal control framework.

3. To which recipients will your data be communicated?

To carry out all the purposes described above, Origen Murcia, S.A.U. has the collaboration of third party service providers who may have access to personal data as a result of the execution of contracted services. In any case, Origen Murcia, S.A.U. follows strict criteria for the selection of these third parties in order to comply with its data protection obligations and signs with them the corresponding data protection agreement, where these third parties are obliged to comply with their data protection obligations, and specifically, to comply with the legal, technical and organisational measures, to process personal data for the agreed purposes, and the prohibition of processing such personal data for other purposes or transfer to third parties.

Your data may also be communicated to Public Bodies, Tax Agency, Judges and Courts and in general to the Competent Authorities when Origen Murcia, S.A.U. is legally obliged to provide them.

Likewise, Origen Murcia, S.A.U. must communicate to the Commission for the Prevention of Money Laundering (SEPBLAC) any indication or suspicion of operation in the field of the fight and prevention of money laundering and the financing of terrorism and also to inform the Commission, communicating the necessary identification data of the users involved, in order that the information collected is available to judicial bodies for investigations related to money laundering.

The transfer of data to countries outside the European Union (so-called third countries) will only take place if the European Commission has decided that the third country ensures an adequate level of protection, if it is required by law (e.g. tax reporting obligations), if you have given us your consent or within the framework of data processing as a service provider.

Origen Murcia, S.A.U. informs that, in order to fulfil its purposes of sending advertising by electronic means, it uses a provider located in the United States, called MailChimp, producing an international transfer of data relating to its customers. This provider is a member of the Privacy Shield agreement, which regulates international transfers between those responsible located in the European Union and those located in the United States, guaranteeing that the transfer will be carried out under the terms of the content of the agreement and that the provider will treat your data in accordance with the stipulations of this agreement.

4. How long will your data be kept for?

Origen Murcia, S.A.U. will comply with the provisions of current legislation regarding the duty to delete personal information that is no longer necessary for the purpose or purposes for which it was collected, remaining at the exclusive disposal of Judges and Courts, the Public Prosecutor or the competent Public Administrations for the attention of possible liabilities arising from the treatment, and only during the periods of description of these responsibilities. Once these periods have elapsed, such information shall be definitively deleted by means of secure methods.

In the event that the data is covered by Royal Decree 304/2014 approving the regulations of Law 10/2010 on the Prevention of Money Laundering, the retention period shall be extended in accordance with Article 29.1, which provides that “Obliged entities shall keep documents and maintain adequate records of all business relationships and transactions, national and international, for a period of ten years from the termination of the business relationship or the execution of the occasional transaction. The records shall allow for the reconstruction of individual transactions so that they can, if necessary, have evidentiary effect”.

Based on Instruction 1/2006 of the Spanish Data Protection Agency, the information on video surveillance shall be cancelled within 1 month of the capture of the images.

5. Personal data registration

As the party responsible for the processing of your personal data, Origen Murcia, S.A.U. keeps a record of all data processing activities. This inventory contains all the information about the type of data processed, such as the data subjects, the possible recipients of the data, the purposes of the processing or the length of time the data will be kept, among other details.

The personal data provided by the user is kept in a register controlled by Origen Murcia, S.A.U. and therefore remains responsible for its security at all times. In addition to the above information, this register includes:

The department responsible for the processing
The legitimacy of the processing
The category of the data being processed
The origin of the processing data
The channel through which the processing data is obtained
The medium on which the processing data is stored
A description of the processing carried out
A list of the systems involved in the processing
The data processor

6. Changes to the Privacy Policy

Origen Murcia, S.A.U. reserves the right to modify the Privacy Policy. Any update is applicable to users once published. Origen Murcia, S.A.U. undertakes to notify such changes by the means available and to expressly indicate the date on which each version of the Privacy Policy becomes effective.

7. Probative Value

The user accepts that in the event that the channel for obtaining the documents or data processed is an electronic medium, these have the same probative value as if said documents and data had been sent or communicated on paper. You therefore undertake not to contest their validity or probative value on the grounds that they are in electronic form.

8. What are your rights when you provide us with your data?

In accordance with the provisions of the General Data Protection Regulation, as well as national data protection regulations, you have the right to exercise, if you so wish, the rights of access, rectification and deletion of data, as well as to request the restriction of the processing of your personal data, to object to the processing, to request the portability of your data, as well as not to be subject to automated individual decisions.

In addition, if the processing of personal data described above is based on your consent, you may revoke this consent at any time. In this regard, it should be noted that the revocation of the consent given will not affect the lawfulness of the processing carried out prior to the withdrawal of such consent.

You may exercise the rights described above through the following channels, providing the necessary documentation that allows us to verify your identity (copy of ID card, passport, NIE, etc.):

In writing, by means of a request addressed to Origen Murcia, S.A.U., Avda. de Alicante, 170 30007 Murcia.
By e-mail to the following address dpo@orenesgrupo.com – When your request is received at dpo@orenesgrupo.com, a confirmation e-mail will be sent to your e-mail address at the same address.

Origen Murcia, S.A.U. undertakes to provide a copy of the personal data being processed and BOOK NOW reserves the right to charge a reasonable fee based on administrative costs for any other copy requested by the interested party.

Users are entitled to access or receive the information, or a copy thereof, in a commonly used structured electronic format, unless the data subject requests it in another format.

9. Am I obliged to provide information?

Within the framework of our business relationship, you must provide us with personal data that requires your consent for the provision of a service, or that is necessary for the fulfilment of contractual obligations arising therefrom, or the collection of which we are obliged to collect by law.

If you do not provide us with such data, we will generally be obliged to refuse to provide the service, or we will no longer be able to provide the existing service and will be obliged to terminate our business relationship.

In particular, in accordance with the legal provisions on the prevention of money laundering, we are obliged to identify you, e.g. by means of your national identity card, and to collect and store your first and last name, place and date of birth, nationality and address prior to the commencement of the business relationship. You must also inform us of any changes that occur during the course of the business relationship. If you do not provide us with the necessary information and documentation, we will not be able to establish or continue the business relationship you wish to enter into.

10. To whom can you address your complaints?

If you believe that your data protection rights have been violated or if you have any complaints regarding your personal information, you can contact us through the channels provided in section 8.

In any case, interested parties can always go to the Spanish Data Protection Agency, the supervisory authority for data protection, http://www.agpd.es., C/ Jorge Juan number 6, 28001, Madrid.