The purpose of processing, in accordance with the AML Act (Section 7) and the Gambling Act (Section 29/H), is to perform customer due diligence measures under the AML Act, ensure player protection and provide the Service offered by the Data Controller.(A) Customer due diligence and customer identification
At registration:
Under the AML Act, for the purpose of issuing an entry card, the Data Controller must identify the player (as a customer), record their personal data, inspect and copy their identity document and, in the case of a foreign national, the document evidencing the right of residence or authorising residence, including the foreign national’s visa. Providing these data is a prerequisite for visiting the Casino.
Purpose of processing: customer identification and due diligence.
Personal data processed: surname and given name, surname and given name at birth, nationality, place and date of birth, mother’s name at birth, address (or, failing that, place of residence); and the following personal data contained in the documents: document number, date of issue, expiry date, issuing authority, photograph and, depending on document type, the Guest’s sex and signature; additionally, the Guest’s risk classification and, where Section 9/A(2) of the AML Act applies, the source of funds and assets. This processing is mandatory; without it, the Guest may not use the Service.
Legal basis for processing: compliance with a legal obligation [Article 6(1)(c) GDPR], Sections 7(2), (3) and (5), Section 3(19)(a), Sections 6/A, 9/A, 16 and 16/A of the AML Act and, in relation to the image, Section 7(9) of the AML Act, as well as Sections 7 and 9–10 of the SZTFH2 Decree.
Duration of processing: the Data Controller is entitled to process the personal data for 8 years from termination of the business relationship pursuant to Section 56(2) of the AML Act.Customer identification upon entry:
Pursuant to Section 39(1) of the SZTFH Decree, the Data Controller must perform the identification prescribed by the AML Act when players enter the Casino, including recording and keeping a record of the time of entry.

(B) Politically exposed person declaration
The player must declare whether they qualify as a politically exposed person, a close family member of a politically exposed person, or a person known to be a close associate of a politically exposed person.
Purpose of processing: customer due diligence and recording politically exposed person status.
Personal data processed: name, politically exposed person status, category under Section 4(2)–(4) of the AML Act, source of funds and assets. This processing is mandatory; without it, the Guest may not use the Service.
Legal basis for processing: compliance with a legal obligation [Article 6(1)(c) GDPR], Section 9/A of the AML Act.
Duration of processing: the Data Controller is entitled to process the personal data for 8 years from termination of the business relationship pursuant to Section 56(2) of the AML Act.

(C) Photograph
For the purpose of preventing and combating money laundering and terrorist financing, ensuring that data obtained during customer due diligence can be linked to player transactions, and enabling effective supervisory activities, the Data Controller is entitled to record the Guest’s image and store it in its electronic image-recording system.
Personal data processed: image (photograph). This processing is mandatory; without it, the Guest may not use the Service.
Legal basis for processing: Sections 7(8) and (9) of the AML Act.
Duration of processing: the Data Controller is entitled to process the personal data for 8 years from termination of the business relationship pursuant to Section 56(2) of the AML Act.

(D) Entry card
The Data Controller must provide Guests with an entry card upon their first entry to the Casino.
Purpose of processing: issuing an entry card and identifying the Guest in connection with entries.
The entry card and its registration system contain the data specified in Section 41(2) of the SZTFH Decree: the serial number of the entry card; the full name of the person entering (Guest); the date of issue of the entry card; the validity period of the entry card; and the Casino’s stamp or other distinguishing mark.
Legal basis for processing: compliance with a legal obligation [Article 6(1)(c) GDPR], Section 41 of the SZTFH Decree. This processing is mandatory; without it, the Guest may not use the Service.
The entry card is valid for no more than 2 years pursuant to Section 41(1) of the SZTFH Decree (and may be extended).

(E) Recording entries
The Data Controller must record and keep records of the time of the Guest’s entry and the time of any attempted entry to the Casino despite being listed in the player-protection register or the self-exclusion register.
Personal data processed: name, time of entry, number of entries. This processing is mandatory; without it, the Guest may not use the Service.
Legal basis for processing: compliance with a legal obligation [Article 6(1)(c) GDPR], Section 39(1) of the SZTFH Decree.
Duration of processing: taking Section 39(1) of the SZTFH Decree into account, 8 years from termination of the business relationship pursuant to Section 56(2) of the AML Act.

(F) Computerised (reception) register
To facilitate entry control, the Data Controller maintains a computerised (reception) register of Guests in which, unless this Notice provides otherwise, it may process the following personal data for 8 years from termination of the business relationship:

1. i. Based on points A)–D) above: surname and given name; entry-card number, status, issue and expiry; type, issuer, number, expiry and issue of the identity document; place and date of birth; birth name; nationality; mother’s name; address or place of residence; politically exposed person status; photograph; copy of identity document; Guest’s signature.
2. ii. Number of entries under point E) above.
3. iii. Guest’s sex: on the basis of the Data Controller’s legitimate interest [Article 6(1)(f) GDPR], the Data Controller records the sex of each Guest to enable gender-appropriate communication (forms of address) and to use this information in connection with gender-specific games. The processing lasts until termination of the business relationship or until the data subject objects. (The Data Controller’s legitimate interest is a commercial and economic interest connected with organising different types of games and providing the Service at a high standard. Further information is contained in the balancing test prepared by the Data Controller.)
4. iv. VIP classification: on the basis of its legitimate interest [Article 6(1)(f) GDPR], the Data Controller may classify the Guest into different VIP levels under its own classification system in order to provide various benefits and levels of comfort. Processing lasts until termination of the business relationship or until the data subject objects. (The Data Controller’s legitimate interest is a commercial and economic interest connected with increasing use of the Service. Further information is contained in the balancing test prepared by the Data Controller.)
5. v. Profile-related notes: the Data Controller may record other information in the register containing the Guest’s profile. Such information may be administrative, may be necessary to enforce Casino rules (e.g. a dress-code issue), or may relate to security (e.g. the Guest is subject to self-exclusion). Processing lasts until termination of the business relationship or until the data subject objects. This processing is based on the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. (The Data Controller’s legitimate interest is a commercial and economic interest connected with ensuring the safe use of the Service, maintaining player confidence and long-term efficient operation. Further information is contained in the balancing test prepared by the Data Controller.)
6. vi. E-mail address and telephone number: based on the Guest’s consent, these may be provided voluntarily under Article 6(1)(a) GDPR. The purpose of processing is to maintain contact with and notify the Guest. Processing lasts until termination of the business relationship or withdrawal of the Guest’s consent. (Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)
7. vii. Risk classification: when establishing the business relationship, the Data Controller must determine whether the Guest is low, average or high risk and record this in writing [Article 6(1)(c) GDPR] pursuant to Section 6/A of the AML Act. This processing is mandatory; without it, the Guest may not use the Service. Pursuant to Section 56(2) of the AML Act, this processing lasts for 8 years from termination of the business relationship.

The purpose of processing is to keep a record of amounts repaid. Orphans include, for example, ownerless chips found in the Casino (e.g. left on a gaming table or forgotten during play) that may be used as stakes and whose lawful owner has not been identified by the Organiser by the end of the gaming day, as well as anything else defined as an orphan by Section 44 of the SZTFH Decree. A Guest who proves ownership of the orphan must be repaid the relevant amount – in the case of chips, the amount corresponding to their value – and the amount repaid must be entered in the orphan register.
The orphan register contains the following personal data: the name and address of the Guest entitled to the value of the orphan; the date and amount of repayment; and, in the case of a ticket, its unique identifier. If the organiser conducted an investigation to determine the legitimacy of the claim of the person seeking the value of the orphan, the report containing the result of the investigation must be attached to the orphan register. This processing is mandatory; without it, the Guest may not use the Service.
The legal basis for processing is compliance with a legal obligation under Article 6(1)(c) GDPR.
Duration of processing: 6 years under Section 1(7a) of the Gambling Act, followed by a further 2 years under the accounting legislation in force (i.e. 8 years from the accounting event).

The purpose of processing is, at the request of the Guest entitled to the prize, to issue a certificate confirming the legal title and HUF value of a prize exceeding HUF 2 million or the corresponding amount in foreign currency.
The prize certificate contains the following personal data: the Guest’s identification data and the place and time of winning and receiving the prize (Section 1(8) of the Gambling Act). This processing is mandatory; without it, the certificate cannot be issued.
The legal basis for processing is compliance with a legal obligation under Article 6(1)(c) GDPR.
Duration of processing: 6 years under Section 1(7a) of the Gambling Act, followed by a further 2 years under the accounting legislation in force (i.e. 8 years from the accounting event).

The purpose of processing is to keep records of chips and funds deposited by the Guest in accordance with the Rules of Participation.
The deposit register contains the following personal data: the identification data of the depositing Guest, the denominations and amount of the chips and funds deposited, and the date of deposit.
Legal basis for processing: the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. (The Data Controller’s legitimate interest is a commercial and economic interest connected with evidencing, safely operating and recording use of the deposit service. Further information is contained in the balancing test prepared by the Data Controller.)
Duration of processing: 5 years (approximately the limitation period under the Civil Code).

Legal basis for processing: compliance with a legal obligation under Section 1(5c) of the Gambling Act. For the purpose of effectively enforcing refusal of entry and participation in gambling (hereinafter: exclusion) against a Guest who seriously breaches the Rules of Participation, the Data Controller keeps an exclusion register.
The exclusion register – pursuant to Section 1(5c) of the Gambling Act – contains the following personal data:

1. the Guest’s data under Section 29/H(1) of the Gambling Act: surname and given name, surname and given name at birth, mother’s name; address or, failing that, place of residence; nationality; type and number of identity document; place and date of birth;
2. the fact, reason and date of the exclusion; and
3. whether the exclusion is ad hoc or for a fixed term of no more than 5 years.

The Data Controller may transfer data from the exclusion register to other gaming casinos operated by the Data Controller and may extend the exclusion imposed on the Guest to those casinos as well pursuant to Section 25(2) of the Responsible Gambling Decree.

The Data Controller may process the data in the exclusion register for 6 years from the date the exclusion is ordered and will delete the data after expiry of the 6-year period [Section 1(5c) of the Gambling Act].

The legal basis for processing is compliance with a legal obligation under Article 6(1)(c) GDPR. This processing is mandatory.

From time to time, the Data Controller organises promotions in the Casinos during which gift chips and gift tickets are provided to Guests and recorded in the reception register.
The data processed are: the fact and time of receipt of a gift chip, gift ticket or prize in kind (advertising gift, promotional gift), and the Guest’s name.
Purpose of processing: recording receipt of a promotional prize and evidencing fulfilment of the promotion.

Legal basis for processing: the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. (The Data Controller’s legitimate interest is a commercial and economic interest connected with proving delivery of prizes and maintaining sound accounting. Further information is contained in the balancing test prepared by the Data Controller.)

Duration of processing: 8 years under the Accounting Act.

Purpose of processing: recording self-restrictions/self-exclusions, ensuring player protection and providing data to the gambling supervisory authority.
Personal data processed: name; place and date of birth; mother’s name; address; identity-document number; duration, fact/subject and period of the restriction, and date of release. This processing is mandatory; without it, the Guest cannot make the relevant declaration.
Legal basis for processing: compliance with a legal obligation – Article 6(1)(c) GDPR, Sections 16–17 of the Responsible Gambling Decree and Section 29/I(2) of the Gambling Act.

Duration of processing: 6 years from creation of the data.

Under Section 1(6b) of the Gambling Act, the gambling supervisory authority keeps a register of persons who have made a significant self-restriction declaration and of persons whom a court has placed under guardianship fully restricting legal capacity or partially restricting legal capacity in relation to gambling-related legal declarations.
Under Section 1(6b) of the Gambling Act, the Data Controller, as organiser, may obtain, process and use data from the player-protection register solely for the purpose of restricting the participation of the persons concerned in gambling.
Under Section 1(6d) of the Gambling Act, the player-protection register contains:

1. separately, the personal identification data of persons who have made a significant self-restriction declaration and persons referred to in subsection (6) (surname and given name, surname and given name at birth, mother’s name, place and date of birth, type and number of identity document, address),
2. the nature of the processing (restriction based on voluntary decision or court order),
3. the date of termination (and whether the processing is for a fixed or indefinite period).

The Data Controller may access the player-protection register only to fulfil its verification obligation, using an electronic extract. The extract contains an irreversible alphanumeric code generated from personal data. SZTFH makes available electronically to the Data Controller the procedure required to generate the alphanumeric code. The Data Controller compares the alphanumeric code generated from the player’s personal data with the code contained in the extract. If the two codes match, the Data Controller refuses to register the player or does not provide the registered player with an opportunity to gamble.

Purpose of processing: checking the player-protection register.

Legal basis for processing: compliance with a legal obligation – Article 6(1)(c) GDPR, Section 20 of the Responsible Gambling Decree. This processing is mandatory; without it, the Guest may not use the Service.

Duration of processing: the time of the check; additionally, the Data Controller retains the notice provided to the player concerning refusal of entry for 5 years.

Personal data processed: name, name at birth, mother’s name, place and date of birth, nationality, address, and the type, number and expiry date of the identity document. [Under Section 30(2)(a) of the AML Act, the Data Controller must include in the report the data specified in Sections 7–14 of the AML Act (see point 1(A) of this Chapter of the Notice), as well as the circumstances giving rise to the report.]
Purpose of processing: fulfilment of the reporting obligation.
Legal basis for processing: compliance with a legal obligation – Article 6(1)(c) GDPR and Section 30(1)(a)–(b) of the AML Act. This processing is mandatory.

Duration of processing: 8 years from termination of the business relationship [pursuant to Section 56(2) of the AML Act].

Personal data processed: name, name at birth, mother’s name, place and date of birth, nationality, address, and the type, number and expiry date of the identity document. [Under Section 30(2)(a) of the AML Act, the Data Controller must include in the report the data specified in Sections 7–14 of the AML Act (see point 1(A) of this Chapter of the Notice), as well as the circumstances giving rise to the report.]
Legal basis for processing: compliance with a legal obligation – Article 6(1)(c) GDPR and Section 30(1)(c) of the AML Act. This processing is mandatory.
Duration of processing: 8 years from termination of the business relationship (pursuant to Section 56(2) of the AML Act).

Under Act LII of 2017, the service provider must operate a screening system capable of ensuring implementation of EU legal acts and UN Security Council resolutions imposing financial and asset-restrictive measures. The IT system must be capable of regularly comparing the personal data of the service provider’s entire registered customer base with the data of persons subject to restrictive measures.
Purpose of processing: identifying persons subject to financial and asset-restrictive measures.
Legal basis for processing: compliance with a legal obligation [Article 6(1)(c) GDPR] – Act LII of 2017 and Section 19 of SZTFH Decree No. 4/2021 (X. 21.) on the detailed minimum requirements for developing and operating the screening system under Act LII of 2017 and implementing Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing for operators of gaming casinos and card rooms, organisers of betting not qualifying as remote gambling, remote gambling and online casino games.

Duration of processing: data generated during screening must be retained by the service provider for 8 years from performance of the screening. This processing is mandatory.

For the purposes of protecting and identifying Guests, ensuring the integrity and secure operation of games, maintaining order and protecting property, and performing tasks prescribed by the AML Act, the Data Controller operates a closed-circuit television system (CCTV) in the Casino capable of transmitting both image and sound.
Under Section 37(2) of the SZTFH Decree, the gaming casino must have a video system meeting the prescribed conditions for the purpose of ensuring the integrity of games, their secure operation, order and property protection, and performing the tasks prescribed by Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing.
Under Section 7(9) of the AML Act, for the purposes of preventing and combating money laundering and terrorist financing, ensuring that data obtained during customer due diligence can be linked to player transactions, and enabling effective supervisory activities, the Data Controller is entitled to record the natural-person customer’s image and video footage of their activity within the premises, and to store the image in its electronic image-recording system.

The legal basis for processing is compliance with a legal obligation under Article 6(1)(c) GDPR, as the obligation to make video recordings is prescribed by Sections 37(7) and 51(4) of the SZTFH Decree and Section 7(9) of the AML Act. This processing is mandatory.
The gambling supervisory authority may inspect data recorded by the video system for the purpose of performing its statutory supervisory duties.

Under Section 37(7) of the SZTFH Decree, the video system must meet the following conditions:

1. All games available in the Casino must be observable. Cameras must be suitable for showing and following on screen the stakes (including chip colours and legibility), gaming equipment and accessories (dice, cards, ball, etc.) and the course of the game.
2. It must be possible to observe and verify the filling and emptying of slot machines, jackpot payouts, any separate room used for accounting for gaming equipment, and the route to the place of accounting. If gaming equipment is accounted for in a separate room, that room must also be equipped with a camera and the route leading to the accounting location must also be observable.
3. Possible disturbances and the security measures applied in the Casino must be observable and recordable throughout the entire gaming area and at every gaming location (gaming table, slot machine, etc.).
4. The Guest’s entry and identification process must be verifiable.
5. Cameras must be capable of displaying the date and time to the precision of one second and, depending on their location, the bets placed and the receipt of cash and tips, while keeping events involving gaming equipment continuously visible. Sound must be transmitted together with the image. Events requiring mandatory documentation, as well as events at the cashier, must be recorded in close-up (zoom camera).
6. The Data Controller keeps camera images under continuous observation in accordance with the monitoring system set out in the Casino’s gaming plan. Images provided by the cameras must be recorded simultaneously and retained for the period specified in Section 51(4) of the SZTFH Decree.

Duration of processing:

• Under the SZTFH Decree, the Data Controller determines the retention period for video recordings and the submission time for accounting documents so that, after the accounting documents are submitted, the gambling supervisory authority has at least five working days to view video footage supporting the content of any submitted document. Video recordings and other documents concerning extraordinary events occurring in the gaming casino or measures taken against players must be retained by the Data Controller for at least thirty days.
• Under Section 7(9) of the AML Act, the Data Controller must retain video recordings for 45 days from recording. On notification by the supervisory authority, this period must be extended until completion of the supervisory authority’s proceedings.

Persons affected by camera surveillance may include Casino guests and players, as well as employees working on the Casino premises.
Detailed data-processing rules relating to use of the video system are laid down by the Data Controller in a separate notice for its employees, security service and video-surveillance personnel and are enforced accordingly.
The video system is operated by the Data Controller, and the Data Controller’s employees (casino director, manager, department head, surveillance operator, surveillance assistant, and any person designated by management) are entitled to access the recordings.
The Data Controller uses live monitor surveillance and records the footage.
Storage location: the video servers are located in a dedicated, separate, air-conditioned room, namely the server room.
The cameras operate continuously, 24 hours a day, every day.

If the Guest purchases gaming entitlement (ticket or chips) at the Casino cashier using a bank card, the Data Controller verifies the identity of the cardholder. The purpose of processing is to comply with the requirements of the bank-card acquiring partner, verify the cardholder and thereby help prevent or detect bank-card fraud. The Data Controller records the number and type of the identity document used for verification (identity card or passport), the cardholder’s name and the first 4 digits of the card number.
The Data Controller retains the transaction receipt for 60 months.
Legal basis for processing: the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. (The Data Controller’s legitimate interest is performance of its agreement with the bank and reducing the number of criminal offences. Further information is contained in the balancing test prepared by the Data Controller.)
The bank-card acquiring partner involved in the transactions is entitled to inspect the transaction receipts.

The purpose of processing is, in accordance with Section 6 of the Advertising Act, to contact those data subjects who have given prior and explicit consent with newsletters containing marketing information about new developments, bonuses, promotions and current events related to the Data Controller’s land-based casino gaming services.
Personal data processed: surname and given name, date of birth, e-mail address and telephone number (if the data subject also requests SMS notifications).
Because the newsletters may advertise services in which persons under 18 may not participate under Section 1(5b) of the Gambling Act and which may be subject to the restriction in Section 8(1) of the Advertising Act, recording the date of birth is also necessary having regard to Section 6(2) of the Advertising Act. In addition, for player-protection purposes, the data subject must declare that they are not subject to a restriction based on the player-protection register.

Newsletters are primarily sent by e-mail, but the data subject may also provide a telephone number in order to receive shorter supplementary information by SMS, particularly information about the Data Controller’s current events, taking account of the characteristics of that communication channel.

The legal basis for processing is the data subject’s voluntary, specific and informed consent under Article 6(1)(a) GDPR. (Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)

Processing lasts until consent is withdrawn or, failing withdrawal, until the Data Controller ceases to provide the marketing newsletter service. Consent may be withdrawn at any time, free of charge, without restriction or justification, by sending an e-mail to lvc_diamond@lvcd.hu, by sending a postal letter to the Data Controller’s registered office, or by clicking the “unsubscribe” link in the newsletter. The data subject may also terminate the SMS communication channel at any time using the link at the end of the SMS message. To ensure the accuracy of personal data provided during subscription and to prevent incorrect subscriptions, the Data Controller sends a message containing a “confirmation link” to the e-mail address provided by the data subject. Subscription is completed by clicking the confirmation link. If the subscription is not confirmed, the Data Controller sends a confirmation reminder within 24 hours. If the subscription is still not confirmed within 5 calendar days, the personal data provided during subscription are deleted.

From time to time, the Data Controller organises raffle draws in the Casinos. The raffle ticket contains the raffle serial number and the name and card number of the ticket holder. Providing the name and card number, and reading out the name, are conditions of participation in the draw.
Personal data processed: name, card number.
Purpose of processing: announcing the winner’s name at the raffle draw, i.e. identifying the winner.

Legal basis for processing: the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. (The Data Controller’s legitimate interest is a commercial and economic interest connected with maintaining the raffle game. Further information is contained in the balancing test prepared by the Data Controller.)

Duration of processing: the winner’s name is disclosed orally at the time of the draw.

The Data Controller organises events, competitions and tournaments from time to time.

Photographs and video recordings may be made of participants in the event or competition and of persons present at the venue. The Data Controller provides notice of this at the event venue.

The purpose of processing is to document events organised by the Data Controller in images, and to promote and present the Data Controller’s activities to others.

The primary legal basis for processing is the consent of the data subjects [Article 6(1)(a) GDPR] in the case of persons participating in the event as competitors or players. (Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)

Where obtaining consent is not possible (excluding cases where the data subject does not wish to give consent) and the statutory conditions are met, and in relation to other persons who are present at the event venue but do not participate in the particular competition or tournament, the secondary legal basis for processing is the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. (The Data Controller’s legitimate interest is a commercial interest connected with presenting and promoting competitions. Further information is contained in the balancing test prepared by the Data Controller.)

Personal data processed: name, image/moving image and audio recording.

Duration of processing: until withdrawal of the data subject’s consent or until the purpose has been achieved.

Data subjects are entitled to object to the making of a recording at any time.

Purpose of processing: the Data Controller may publish recordings on its own Meta platforms (Facebook, Instagram), YouTube and TikTok channels or website, or may provide them to television or the press for publication. The Data Controller informs data subjects in advance at the venue about the exact methods and places of publication on a case-by-case basis. The purpose of publication is to promote the Data Controller, its services and events, and to present and introduce them to others.
The primary legal basis for processing is the consent of data subjects [Article 6(1)(a) GDPR] in the case of persons participating in the event as competitors or players. (Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)
Where obtaining consent is not possible (excluding cases where the data subject does not wish to give consent) and the statutory conditions are met, and in relation to other persons present at the event venue who are not participating in the particular competition or tournament, the secondary legal basis is the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. (The Data Controller’s legitimate interest is a commercial interest connected with presenting and promoting competitions. Further information is contained in the balancing test prepared by the Data Controller.)

Personal data processed: name, image/moving image and audio recording.

Duration of processing: until withdrawal of the data subject’s consent, achievement of the purpose or, where published on a social-media page, until that page ceases to operate.

Data subjects are entitled to object at any time to any form of use of the recording.

Cookies and web beacons:
When operating the Website (www.lasvegascasino.hu), the Data Controller uses cookies and web beacons. Detailed information is available in the cookie notice under the Data Processing section of the Website.
Marketing:
Facebook advertising: our company uses the services of Facebook [Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland] to display targeted advertisements on Facebook. In connection with those advertisements, Meta acts as data controller and is responsible for obtaining consent to processing. Our company does not process personal data in connection with the advertisements. Further information is available at the following links:

https://hu-hu.facebook.com/business/gdpr#faqs

https://www.facebook.com/business/help/170456843145568?id=2469097953376494

 

Facebook Pixel: our company has integrated the Facebook Pixel code, a Meta service, into its website. This enables Facebook to track the activities on our website of users registered with Facebook. We can create target audiences and receive analytical data about how visitors use our website. Facebook Pixel enables us to optimise our advertisements and provide personalised offers to website visitors. The data are stored and processed by Facebook; our company does not process personal data, and Facebook does not transfer personal data to our company.

 

Google Tag Manager: the website uses the Google Tag Manager function. Google Tag Manager is a solution that allows marketing professionals to administer tags placed on the website centrally through a single interface. The tool uses a cookie-free domain and does not itself collect personal data; it only triggers other tags that may, in certain circumstances, collect data. Google Tag Manager does not access such data. If a function has been disabled at domain or cookie level, that setting remains in effect for all tracking tags implemented through Google Tag Manager. Further information about Google Tag Manager is available at:

https://support.google.com/tagmanager/#topic=3441530

 

Website traffic measurement:

Personal data processed: the IP address of visitors to the Website (www.lasvegascasino.hu), the time of the visit, data about pages viewed and the name of the browser used.

Purpose of processing: software analysing website traffic data runs on the Data Controller’s Website.

Legal basis for processing: the data subject’s consent [Article 6(1)(a) GDPR]. (Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)

Duration of processing: until achievement of the purpose, but no later than deletion at the data subject’s request.

The Data Subject may contact the Data Controller through the lvc_diamond@lvcd.hu e-mail address shown on the Data Controller’s Website or may send a message using the interface available under the Website’s “Contact” menu.
If an e-mail contains another person’s personal data, the person communicating the data is responsible for obtaining the Data Subject’s prior consent, which the Data Controller presumes has been obtained.
Personal data processed: name, e-mail address.

Purpose of processing: maintaining contact with the Data Controller.

Legal basis for processing: the data subject’s consent [Article 6(1)(a) GDPR]. (Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)

Duration of processing: until achievement of the purpose or deletion at the data subject’s request.

Personal data processed: name, comment, follow, message, rating/review.

Purpose of processing: informing data subjects through the Data Controller’s Facebook and Instagram pages about the Data Controller’s operations, events and programmes, and promoting the Data Controller.

Legal basis for processing: the data subject’s consent [Article 6(1)(a) GDPR]. (Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)

Data Subject: any person carrying out activity in connection with the page.

Duration of processing: until deletion at the data subject’s request, but no later than until the page ceases to operate.

The Data Controller’s Facebook pages:
https://www.facebook.com/LVCEuroCenter
https://www.facebook.com/lasvegastropicana
https://www.facebook.com/lasvegascorvin
https://www.facebook.com/lasvegasatlantis
https://www.facebook.com/eurocenterpoker

The Data Controller’s Instagram page:
https://www.instagram.com/lasvegascasinos_official/

To use Facebook and Instagram, the Data Subject must have their own account on the relevant social-media platform. The operators of the social-media platforms carry out processing as independent data controllers in accordance with their own privacy notices. The data controller for Facebook and Instagram is Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland).

By using Facebook and Instagram, the data subject declares that they have previously read and accepted Facebook’s and Instagram’s own terms of use and privacy rules:
https://www.facebook.com/policy.php
https://www.instagram.com/terms/accept/?hl=hu

Facebook and Instagram receive the information that the data subject intends to post on the gaming casino’s social-media page under the data subject’s IP address.

In relation to data the Data Subject intends to post (name, photograph, comment, rating/review), the Data Subject may exercise their rights directly towards Facebook or Instagram, or may contact the Data Controller.

The Data Controller is entitled to initiate deletion of data that infringe the reputation or rights of the Data Controller or another person.

Processing for statistical purposes carried out in connection with the use of Meta products constitutes joint controllership by the Data Controller and Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland). Detailed information about Page Insights is available at: https://www.facebook.com/legal/terms/page_controller_addendum

The Data Controller’s YouTube channel: https://www.youtube.com/@lasvegascasinobudapest

In relation to the YouTube channel, YouTube LLC acts as an independent data controller; its parent company is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States). Its Privacy Policy and Terms of Service are available at: https://policies.google.com/privacy?hl=hu. For privacy-related questions, the Data Protection Officer can be contacted through the following form: https://support.google.com/policies/contact/general_privacy_form.

The Data Controller’s TikTok channel:
https://www.tiktok.com/@lvc_budapest?_t=ZN-8ub9syUDQiE&_r=1

To use TikTok, the Data Subject must have their own account. TikTok Technology Limited (The Sorting Office, Ropemaker Place, Dublin 2, Dublin, D02 HD23, Ireland; hereinafter: TikTok Ireland) acts as an independent data controller and collects data about persons visiting individual TikTok accounts in accordance with its own privacy policy. In relation to personal-data processing required for the technical operation of the TikTok platform, TikTok Ireland acts as a joint controller with TikTok Information Technologies UK Limited (4 Lindsey Street, London, EC1A 9HP, United Kingdom). TikTok Ireland’s relevant general privacy policy is available at https://www.tiktok.com/legal/privacy-policy?lang=en#privacy-eea.

For privacy-related questions, the Data Protection Officer can be contacted through: https://www.tiktok.com/legal/report/privacy?lang=en

The Data Controller provides free and open internet access in the Casinos and accepts no liability for risks arising from the use of wireless internet.
By connecting to the Wi-Fi network, the Data Subject expressly consents to the Data Controller recording, for the duration of use, the MAC address uniquely identifying the device used by the Data Subject.
Personal data processed: MAC address, device name.

Purpose of processing: use of the service provided by the Data Controller.

Legal basis for processing: the data subject’s consent [Article 6(1)(a) GDPR]. (Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)

Duration of processing: until achievement of the purpose, but no later than deletion at the Data Subject’s request.

Purpose of processing: preventing unlawful acts and ensuring lawful operation.

Personal data processed: time of the call (day, hour, minute); caller’s number; called extension; voices of the participants in the conversation; and all data/information qualifying as personal data disclosed during the conversation.

Legal basis: the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. The Data Controller has carried out a balancing test in a separate document.

Duration of processing: 7 calendar days after the recording is made. If the data subject objects to processing of their personal data concerned and there is no overriding legitimate reason, the Data Controller deletes the personal data.

If an authority – including the Hungarian Police – sends a request to the Data Controller, the Data Controller complies with the request on the basis of its statutory obligation. In certain cases, the Data Controller may itself initiate proceedings before authorities.

Purpose of processing: Guests may pre-register on the Website for certain events organised by the Data Controller and thereby indicate their intention to participate. The purpose of collecting the data is to enable the Data Controller to identify the pre-registered person so that the necessary capacity can be ensured.
Personal data processed: the pre-registering Guest’s name and e-mail address, the selected event and its date/time, and the number of persons accompanying the Guest.
Legal basis: the data subject’s consent [Article 6(1)(a) GDPR]. (Consent may be withdrawn at any time; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.)

Duration of processing: until withdrawal of consent or, failing withdrawal, until the end of the selected event.

Purpose of processing: investigating and responding to a complaint submitted by a Guest.

Personal data processed: in accordance with Section 17/A(5) of the Consumer Protection Act, the Guest’s full name, residential address or electronic correspondence address; place, time and method of submitting the complaint; detailed description of the consumer’s complaint; list of documents and other evidence presented by the consumer; the undertaking’s statement concerning its position on the complaint, where immediate investigation is possible; the name of the person taking the minutes and, except in the case of an oral complaint communicated by telephone or other electronic communications service, the consumer’s signature; the place and date of taking the minutes; and, in the case of an oral complaint communicated by telephone or other electronic communications service, the complaint’s unique identification number.

Legal basis: compliance with a legal obligation [Article 6(1)(c) GDPR] – the legal obligations under Section 17/A of the Consumer Protection Act and Section 35 of the Services Act.

Duration of processing: pursuant to Section 17/A(7) of the Consumer Protection Act, the Data Controller retains the minutes taken of the complaint or, in the case of a written complaint, the submitted document and the response to the complaint for five years.

Purpose of processing: investigating reports submitted to the internal whistleblowing system under Act XXV of 2023 on Complaints, Public Interest Disclosures and Rules Relating to the Reporting of Abuses (hereinafter: the Whistleblowing Act), answering questions and remedying conduct forming the subject matter of a report.
Personal data processed: where the reporting person discloses their identity, the data they provide; data specified in the report concerning the person whose conduct or omission gave rise to the report; data necessary for the investigation concerning any person who may have substantive information about the matters described in the report (e.g. a person identified as a witness); other personal data provided in the report and personal data collected during the investigation and clarification of the facts. Only personal data strictly necessary for investigating the report may be processed.
Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR. If the report also contains special categories of personal data, the additional legal basis is Article 9(2)(b) GDPR. The legal obligation is prescribed by Section 18 of the Whistleblowing Act.

Duration of processing: 5 years after completion of the investigation conducted on the basis of the report. If court or administrative proceedings are initiated as a result of or in connection with the investigation, processing continues until those proceedings are finally concluded.