This Privacy Policy sets out how personal data relating to customers, website visitors and other individuals interacting with Napoleons Casino Huddersfield is collected, used, stored, shared and protected. It also explains the rights available under UK data protection law and the procedures for exercising those rights.
Personal data is handled in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a gambling operator licensed in Great Britain, the company is also subject to requirements of the Gambling Commission, including obligations relating to transparency, responsible gambling and anti-money laundering. Processing personal data is a necessary part of meeting those obligations.
Questions about this Privacy Policy or about the handling of personal data can be directed to the contact details set out in Section 8.
1. Data Controller
Napoleons Casino Huddersfield is the data controller in respect of personal data processed under this Privacy Policy. As data controller, the company determines the purposes and means of processing personal data. Where a Data Protection Officer (DPO) is appointed, relevant contact details are provided in Section 8.
2. Personal Data Collected
The following categories of personal data may be collected:
- Identity data - full name, date of birth, gender, government-issued identification documents.
- Contact data - postal address, email address, telephone number.
- Account data - username, account history, login records, correspondence with the company.
- Transaction data - records of deposits, withdrawals and account activity.
- Verification data - documents and information collected to verify identity, age and source of funds in line with legal and regulatory obligations.
- Responsible gambling data - information relating to self-exclusion requests, deposit limits, time-out periods, reality checks and any affordability assessments.
- Technical data - IP address, browser type, device identifiers, session data collected when accessing digital services.
- Communications data - records of enquiries, complaints and other communications sent to the company.
Personal data is not knowingly collected from individuals under the age of 18. If it becomes apparent that an account has been opened by a minor, the account will be closed and associated data will be handled in accordance with applicable legal obligations.
3. Purposes and Legal Bases for Processing
Personal data is processed only where a lawful basis applies. The main purposes and corresponding legal bases are:
- Operating and managing user accounts - performance of a contract.
- Verifying identity and age - legal obligation.
- Preventing money laundering and fraud - legal obligation.
- Complying with Gambling Commission requirements - legal obligation.
- Monitoring responsible gambling and identifying risk - legal obligation / legitimate interests.
- Responding to enquiries and complaints - legitimate interests / legal obligation.
- Sending marketing communications where consent has been given - consent.
- Improving and securing services and systems - legitimate interests.
Where processing is based on legitimate interests, an assessment is carried out to ensure those interests are not overridden by the rights and freedoms of data subjects. Where processing is based on consent, that consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
4. Sharing Personal Data
Personal data is shared only where necessary and with the following categories of recipients:
- Regulatory and law enforcement authorities - including the Gambling Commission, the Information Commissioner’s Office (ICO), HM Revenue and Customs, and the police, where required or permitted by law.
- Identity and age verification providers - third-party services used to confirm identity, age and source of funds.
- Payment processors - to facilitate deposits, withdrawals and related account transactions.
- Responsible gambling schemes - including self-exclusion services such as GAMSTOP, where required under licence conditions.
- Group companies - other entities within the same corporate group, where relevant to account management or compliance.
- Professional advisers - such as solicitors, auditors and insurers, subject to appropriate confidentiality obligations.
Personal data is not sold to third parties. Any third party with whom personal data is shared is required to handle it in compliance with applicable data protection law.
5. Data Retention
Personal data is retained for as long as necessary to fulfil the purposes outlined in this Privacy Policy and to comply with legal and regulatory obligations. In particular:
- Account records and transaction data are generally retained for a minimum of five years from the date of account closure or from the end of the relationship with the relevant individual, in line with anti-money laundering legislation.
- Where a legal dispute, investigation or regulatory matter arises, relevant data may be retained for a longer period until the matter is concluded.
- Marketing preferences and consent records are retained for as long as necessary to demonstrate compliance with applicable requirements.
When personal data is no longer required for the purposes for which it was collected, it is deleted or anonymised in a secure manner.
6. Data Security
Appropriate technical and organisational measures are applied to protect personal data against unauthorised access, loss, alteration or disclosure. These measures are reviewed and updated where necessary in light of legal, technical and operational developments.
Where a personal data breach occurs that is likely to result in a risk to the rights and freedoms of individuals, the ICO will be notified and, where required, affected individuals will also be notified, in accordance with applicable legal obligations.
7. Your Rights
Under UK GDPR, individuals have the following rights in relation to their personal data, subject to applicable conditions and exemptions:
- Right of access - to request a copy of the personal data held about them.
- Right to rectification - to request correction of inaccurate or incomplete personal data.
- Right to erasure - to request deletion of personal data in certain circumstances.
- Right to restriction of processing - to request that processing of personal data is limited in certain circumstances.
- Right to data portability - to receive personal data in a structured, commonly used and machine-readable format, and to request transmission to another controller, in certain circumstances.
- Right to object - to object to processing based on legitimate interests, and to object to direct marketing at any time.
- Rights related to automated decision-making, including profiling - to request human review of any solely automated decision that produces legal effects or similarly significantly affects the individual.
To exercise any of these rights, a request can be submitted using the contact details in Section 8. A response will normally be provided within one calendar month of receipt of a valid request. Identification may be requested where necessary to verify the identity of the requester.
If an individual is dissatisfied with the handling of personal data or a response to a rights request, a complaint can be lodged with the Information Commissioner’s Office (ICO) via ico.org.uk or through the contact channels published by the ICO.
8. Contact and Data Protection Officer
For questions, requests or concerns relating to this Privacy Policy or the handling of personal data, contact:
Napoleons Casino Huddersfield
Privacy and Data Protection Enquiries
Where a Data Protection Officer has been appointed, correspondence addressed to the DPO at the above address will be directed accordingly.
For general regulatory enquiries relating to gambling regulation, the Gambling Commission can be contacted at:
Victoria Square House, Victoria Square, Birmingham B2 4BP.
9. Changes to This Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes in law, regulatory requirements, internal practices or services. The current version of the Privacy Policy is made available on the relevant website or on request.
Where changes are material, reasonable steps will be taken to draw attention to the updated version, which may include notices on the website or other appropriate communication channels.