PRIVACY POLICY

Collection, processing and protection of personal data

 

INTRODUCTION

GLOBUS EXCLUSIVE doo, Ulica kneza Branimira 29, 10000 Zagreb, OIB: 98067501790, pays particular attention to the protection of personal data and privacy (hereinafter: privacy protection) of its clients, suppliers, employees and other entities with which it enters into relations (hereinafter: clients), in accordance with applicable regulations and best European practices (Regulation (EU) 2016/679 of the European Parliament). Protecting the privacy of our clients is an integral part of our services and way of doing business.

 

With our privacy policy, we want to provide clear information about the processing and protection of personal data processed by GLOBUS EXCLUSIVE doo and enable clients to easily monitor and manage their personal data and consents.

 

This Privacy Policy describes what personal data GLOBUS EXCLUSIVE doo collects, how it processes it and for what purposes it uses it, how long and how it stores it, as well as the rights of clients (data subjects) related to their personal data.

 

Personal data controller:

GLOBUS EXCLUSIVE d.o.o., Ulica kneza Branimira 29, 10000 Zagreb,

OIB: 98067501790,

E mail: info@casino-diamondpalace.hr

 

Personal Data Protection Officer:

e mail: gdpr@globus-exclusive.hr

​

 

1. Scope of application

The Privacy Policy applies to all personal data that GLOBUS EXCLUSIVE doo collects, uses or otherwise processes, directly or through its partners. Personal data is any information relating to a natural person whose identity is determined or can be determined, directly or indirectly.

Data processing is any operation performed on personal data, such as collection, recording, storage, use, transfer of personal data, insight into personal data, etc.

 

GLOBUS EXCLUSIVE doo is the data controller in relation to the personal data of its clients in terms of applicable personal data protection regulations.

 

The privacy rules apply to all natural persons who enter into a relationship with the company GLOBUS EXCLUSIVE doo in any respect.

 

2. Principles of personal data processing

Trustworthiness

GLOBUS EXCLUSIVE doo wants to be completely transparent and clear regarding the processing of clients' personal data, which is the purpose of these Privacy Rules, and to have a relationship with its clients based on trust.

 

Lawfulness of data processing

When processing personal data, GLOBUS EXCLUSIVE doo acts in accordance with the law - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Act on the Implementation of the General Data Protection Regulation ("Official Gazette" No. 42/18) and internal rules and procedures relating to the protection of personal data.

 

Limited purpose of processing

GLOBUS EXCLUSIVE doo collects and processes personal data only for a specific and lawful purpose and further processes them only in a manner that is consistent with the purpose for which they were collected.

 

Data reduction

We always use only customer data that is appropriate and necessary to achieve a specific legitimate purpose, and no more data than that.

 

Integrity and confidentiality

Personal data is processed securely, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage (only authorized persons who need it to perform their jobs have access to personal data, but not other employees).

 

Quality of personal data

We attach great importance to the personal data we process. The personal data we process must be accurate, complete and up-to-date, and it is therefore important that clients notify us of any changes to their data immediately or as soon as possible.

 

Limited storage time

We collect, store and process personal data for as long as prescribed by the law on which the obligation to collect personal data is based, for as long as determined by consent, which clients are informed about when signing the consent itself, or for as long as determined based on the previously established legitimate interest of GLOBUS EXCLUSIVE doo.

 

3. Method of collecting personal data

GLOBUS EXCLUSIVE doo collects personal data directly from clients. There is a legal basis for each processing of personal data. The legal bases on which the processing of personal data is based are: the legal obligation of the controller, the processing is necessary for the performance of the contract, or the processing is carried out at the request of the client for the purpose of carrying out preparatory actions prior to the conclusion of the contractual relationship, the client's consent, the legitimate interest of the controller or the request of a public authority. In accordance with the Regulation, when we base the processing of personal data on a legitimate interest, we conduct a proportionality test in order to determine the existence of a legitimate interest.

 

4. Purpose and processing of personal data:

Data is processed fairly and legally, and is not collected to a greater extent than is necessary.

We also collect and process personal data in cases specified by law for the purpose of fulfilling legal or contractual obligations and/or with the user's consent for the purpose for which they gave consent and/or for the purpose of concluding and executing a contract concluded between the user and GLOBUS EXCLUSIVE doo, or on the basis of our legitimate interest; as well as in other cases specified by law.

The collected personal data is used for:

• provision of our services / execution of the contract

• identification purposes and verification

• statistical analysis and research

• regulatory and legislative compliance

• marketing, profiling and market research

• protection of our rights and property

• protection of minors through the prohibition of participation in games of chance

• protection of persons and property in our casino and branches (betting shops)

 

5. Types of data we collect

Below is a list of what personal data we collect, the legal basis on which we collect it, and how long we store it.

 

5.1. Contractual data

GLOBUS EXCLUSIVE doo may collect the following personal data for the purposes of contract execution, intention to conclude a contract, business negotiations, etc.:

 

• Name and surname of natural persons, representatives of companies or owners of real estate and the like, i.e. name and surname of natural persons with whom we conclude a contract

• OIB

• Residence

• Email address

• Real estate ownership information

• Data on the giro/current account number

• The fact whether a natural person (president of the board, director, members of the board/supervisory/management board, beneficial owner) or the legal entity itself is on a particular sanction list of the United Nations, the European Union, the Government of the Republic of Croatia or other international organizations, or whether restrictive measures are applied to any of these persons in accordance with the Law on Restrictive Measures ("Official Gazette" No. 133/23) - we collect the aforementioned data on the legal basis arising from the Law on Restrictive Measures, and not as data necessary for concluding a contract (they are listed here only because they are collected for the same purpose - the purpose of concluding a contract)

 

This data is kept for the period prescribed by the respective Act depending on the type of contract concluded, the period required for the execution of the contract, and after the expiry of that period it is deleted. In relation to contractual relationships under which GLOBUS EXCLUSIVE doo permanently acquires some property for itself, the aforementioned contracts (and accordingly the above-mentioned data) are kept permanently, while we keep data from other contracts for 11 years from the last payment made under the contract, all in accordance with accounting regulations. In the event that the client refuses to provide some of the requested data, which is necessary for the execution of the contract, GLOBUS EXCLUSIVE doo reserves the right to refuse to enter into a business relationship with the client. Also, if, before entering into a business relationship, we determine that a natural or legal person is on a particular sanctions list of the United Nations, the European Union, the Government of the Republic of Croatia or other international organizations, or that restrictive measures are applied to that person in accordance with the Law on Restrictive Measures, in accordance with the aforementioned Act, we may not enter into a business relationship with that person, or, if we are already in a business relationship with that person, we must exit it immediately upon learning of the aforementioned fact.

 

5.2. Personal data collected in the Casino:

We are obliged to collect data on a legal basis (the Law on Games of Chance in relation to the data that the organizer is obliged to collect when registering players in a casino; the Law on Anti-Money Laundering and Terrorism Financing in relation to the same data with the addition of a copy of the identity card collected according to that Law, and the Law on Games of Chance and the Ordinance on Spatial and Technical Conditions for Organizing Games of Chance in Casinos, on Slot Machines and Betting Deposit Sites in relation to data collected by the video surveillance system) when a client accesses the casino premises, and are the condition for access to the casino premises and games of chance that are organized in the casino premises.

• first and last name

• residence

• date and place of birth,

• identification document number, number and name of the document issuer

• a copy or scan of an identification document (for the purposes of conducting an in-depth analysis in accordance with the Law on Anti-Money Laundering and Terrorism Financing in the case of payment/disbursement in the amount of EUR 2,000.00 or more)

• a copy or scan of an identification document (based on the legitimate interest of the data controller during the first registration of the client upon entering the casino)

• date and time of entering the casino

• photograph of the player's face (based on the legitimate interest of the controller)

• personal identification number (OIB)

• citizenship

• data on participation in games of chance (deposits and withdrawals)

• data on political exposure (when completing the form on political exposure of persons in accordance with the Law on Anti-Money Laundering and Terrorism Financing)

• method of exposure (when filling out the form on political exposure of persons in accordance with the Law on Anti-Money Laundering and Terrorism Financing)

• type of public duty (when filling out the form on political exposure of persons in accordance with the Law on Anti-Money Laundering and Terrorism Financing)

• basis of political exposure - public office, family member, close associate (when filling out the form on political exposure of persons in accordance with the Law on Anti-Money Laundering and Terrorism Financing)

• data on the duty performed (when filling out the form on political exposure of persons in accordance with the Law on Anti-Money Laundering and Terrorism Financing)

• date of appointment or time of performance of prominent public office (when completing the form on political exposure of persons in accordance with the Law on Anti-Money Laundering and Terrorism Financing)

• source of assets (when completing the form on political exposure of persons in accordance with the Law on Anti-Money Laundering and Terrorism Financing),

• The fact whether a natural person is on a particular sanctions list of the United Nations, the European Union, the Government of the Republic of Croatia or other international organizations, or whether restrictive measures are applied to any of these persons in accordance with the Law on Restrictive Measures ("Official Gazette" No. 133/23.)

The retention period for personal data collected during registration is prescribed by the  Law on Games of Chance and is 10 years in relation to the above data.

We are obliged to keep the data that we are required to collect when conducting customer due diligence (for deposits or withdrawals in an amount equal to or greater than EUR 2,000.00) for 10 years, in accordance with the Law on Anti-Money Laundering and Terrorism Financing. When conducting due diligence, the same set of data is collected as during registration upon entry, with the additional obligation to collect a copy of your identification document, which is our obligation in accordance with the regulations governing the prevention of money laundering and the financing of terrorism. Also, if you declare that you are a politically exposed person or we independently determine this through verification, you are obliged, in accordance with the regulations governing the prevention of money laundering and the financing of terrorism, to share with us an additional set of data (type of exposure, type of public office, basis of political exposure - public office - family member, close associate, information about the office you perform, date of appointment or time of performance of prominent public office, source of assets).

We collect data on whether a natural person is on a particular sanction list of the United Nations, the European Union, the Government of the Republic of Croatia or other international organizations, or whether restrictive measures are applied to any of these persons in accordance with the Law on Restrictive Measures ("Official Gazette" No. 133/23.) by comparing the above-mentioned and collected data with data from current and publicly published consolidated lists of the United Nations, the European Union and decisions made by the Government of the Republic of Croatia. We carry out the aforementioned check during the registration of each user and after registration, on a daily basis, given the fact that, pursuant to the Act, we are obliged to disable registration for a user who is on a sanction list, or to terminate the business relationship with a previously registered user if he is subsequently included on one of the lists after registration.

We collect your photo during your first registration in the casino based on our legitimate interest for the purpose of easier identification each time you come to the casino.

 

5.3. Personal data collected when visiting the website

The following data is collected from each visitor to the website, in order to improve the user experience and system security:

1. time and date of website visit

2. pages that the visitor views

3. type of internet browser

4. Computer IP address

5. cookie ID whose collection you have allowed by consent

6. device type and operating system version

7. other (depending on the cookies you have allowed on your device)

 

5.4. Personal data collected through video surveillance

For the purpose of protecting the persons and property of employees, users, players and visitors, video surveillance is used. It is installed in accordance with the following regulations:

• The Law on Games of Chance and the Ordinance on Spatial and Technical Conditions for Organizing Games of Chance in Casinos, on Slot Machines and Betting Sites (in relation to video surveillance installed in those parts of the casino premises in relation to which the aforementioned Law and Ordinance regulate that video surveillance must be installed)

• Legitimate interest of the data controller – for video surveillance at the company's headquarters and in areas intended for employees in casinos and betting shops.

Video surveillance is installed at the entrance and inside the facilities, including  casino and the company's headquarters, and is based on a project approved by an authorized entity.

Recordings are stored on separate hard drives located in separate locations. Access to this data is strictly limited and enabled only at the request of competent state authorities. Such information is submitted exclusively with the official record.

The retention period for recordings in casinos: 60 days.

 

 

5.5. Personal data collected based on the obligation under the  Law on Anti-Money Laundering and Terrorism Financing

When it comes to transactions (payments/withdrawals related to games of chance) for which, in accordance with the Law on Anti-Money Laundering and Terrorism Financing, it is mandatory to keep prescribed records, we are obliged to collect the following data:

1. first and last name

2. residence,

3. day, month and year of birth,

4. personal identification number if visible from the identification document,

5. name and number of the identification document,

6. name and country of the issuer,

7. citizenship/citizenships

8. scan/photo/copy of identification document

For players who are politically exposed persons, the following data is also collected:

• Basis of political exposure (public office, family member, close associate)

• Information about the duties performed

• Date of appointment or time of holding a prominent public office

• The source and funds that are the subject of the transaction

The data is kept for the period prescribed by individual laws, i.e. for a minimum period of 10 years from the date of termination of the business relationship, and will be deleted upon expiry of that period. When the user refuses to provide personal data prescribed by law, the organizer is obliged to refuse to provide the service to the user, i.e. to suspend the transaction and inform the Anti-Money Laundering Office and to deny access to the premises where it organizes games of chance (casino).

 

5.6. Personal data collected when establishing an employment relationship

Data processing based on legal basis

We use this legal basis for data processing in relation to all personal data that we collect from you at the time of establishing an employment relationship based on labor law regulations. Namely the Labour Act ("Official Gazette" no. 93/14, 127/17, 98/19, 151/22, 64/23), the Regulation on the Content and Method of Keeping Records of Employees ("Official Gazette" no. 55/24). and accounting regulations, regulations in the field of tax law and health insurance, which refer to the registration/deregistration of workers, prescribe obligations that we as an employer must fulfill.

• first and last name

• OIB

• sex

• day, month and year of birth

• citizenship

• residence or domicile

• residence and work permit or work registration certificate, if the third-country national worker is required to have one

• professional education and special exams and courses that are a requirement for performing the job, credentials, licenses, certificates, etc.

• start date

• job title, or the nature or type of work for which the worker is employed

• type of employment contract concluded

• date and reason for termination of employment, or termination of work for seconded workers

• date of application submission (start, change, termination) for mandatory insurance of workers as insured persons based on employment, including voluntary pension insurance, if the employer participates in paying for it, and mandatory health insurance while working abroad

• all employment contracts in writing or a confirmation of the employment contract concluded with the employee, all amendments and supplements to the employment contract

• agreements between employer and employee, consents and written statements of employees, decisions on dismissal

• forms for registration (start, change, termination) of mandatory pension and health insurance

• public and private documents that provide evidence of the accuracy of data on professional education, training, advanced training and other data on which the exercise of rights and obligations arising from or in connection with the employment relationship depends

• public and private documents, decisions, certificates, calculations, etc. related to the obligations of calculation and payment of salary, and payment of taxes and contributions

• decisions, private documents, certificates, records, etc. related to safety and protection at work, injuries at work and occupational diseases

• decisions, private documents, certificates, etc. related to the exercise of pension insurance rights, including rights based on insurance years calculated with an increased duration

• decisions, private documents, certificates, records, etc. related to exercising rights under mandatory health insurance

• public and private documents, decisions, certificates, etc. related to the exercise of the right to personal care or any other right from general labor regulations, as well as the exercise of maternity and parental rights

• requests from workers for protection of employment rights, with decisions, acts and letters of the employer issued in the proceedings regarding such requests

• other documents and acts related to the exercise of rights from the employment relationship, i.e. in connection with the employment relationship

• CV and job application

• copy of certificate, diploma and other proof of professional training

• tax card

• ID card information or passport copy, bank account information

• Certificate of service with the HZMO

• work and residence permit in the case of a worker who is a foreign citizen

• signed confidentiality statement

• signed statement of employee consent to receive salary, salary compensation and severance pay documents electronically

• signed consent of the employee for the processing of certain types of personal data for certain purposes

• a copy of the lease agreement for an employee for whom the Employer bears the housing costs, an agreement regulating rights and obligations under the apartment lease agreement

• certificate of training for safe work

• for workers who were temporarily assigned to the employer by companies affiliated with it and for workers who were assigned to the employer as a beneficiary by temporary employment agencies, the following additional documentation must be submitted:

  • the assignment agreement between the employer and the related employer and the written consent of the employee

  • the assignment agreement between the agency and the beneficiary and the referral by which the temporary employment agency refers the worker to the  beneficiary

  • certificates of professional competence in accordance with obligations under occupational safety regulations

  • other documents and acts related to the realization of rights from the employment relationship, i.e. in connection with the employment relationship and rights based on the assignment of workers.

• written review of employee data

 

We store data collected in this way in accordance with legal retention periods, while we store employee payrolls permanently, and we store all payments made to employees (including the personal data of employees related to such payments) in accordance with accounting regulations for 11 years from each payment made.

The legal retention periods for the aforementioned data are as follows:

​