CASINOS CIRSA wish to inform customers (hereinafter, “Members”) who wish to join the Club Winner loyalty club of the following additional information regarding data protection (hereinafter, the “Privacy Policy”), in which we transparently and clearly provide all information regarding the processing of personal data, the purposes for which we process them, the legal grounds, the retention periods, and the rights that may be exercised. This Privacy Policy will always be available on the website https://clubwinner.com (hereinafter, the “Website”).

WHO IS RESPONSIBLE FOR DATA PROCESSING?

CASINOS CIRSA inform Members that the responsibility for the processing of their personal data lies solely with the CASINOS CIRSA located in the country in which the Member has registered. This means that (i) if you registered with a CASINO CIRSA, only the casinos in that country will process your personal data; and (ii) your personal data will not be shared with CASINOS CIRSA in other countries and no international transfers of your data will take place.

Each CASINO CIRSA in the country where the Member registers for the Club Winner program is the sole data controller responsible for processing the personal data and complying with the applicable data protection laws in that territory.

Below is a list of the CASINOS CIRSA responsible for the processing of personal data in each country: 

* Joint Controllers in Spain together with the other three indicated Companies.

** Joint Controllers in Morocco.

*** Joint Controllers in Panama.

**** Joint Controllers in the Dominican Republic.

Hereinafter, each Data Controller shall be referred to individually as a “Casino”, and collectively as the “CIRSA CASINOS”. In countries where more than one company operates, the CIRSA CASINOS shall be joint controllers of the processing activities in the corresponding country. These entities have entered into a joint controllership agreement that defines their respective responsibilities in accordance with the applicable personal data protection regulations. Information on the main aspects of this joint controllership agreement is available to data subjects upon request by contacting the following email addresses. You may contact CIRSA CASINOS to exercise your rights in relation to personal data protection, to resolve any questions regarding the processing of your personal data, or to request information on any matter related to privacy and the protection of your personal data, by sending an email to the addresses listed below. In all cases, please clearly identify your request:

WHAT IS PERSONAL DATA AND DATA PROCESSING?

Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The processing of personal data is any operation or set of operations we perform on your personal data, such as the collection, recording, storage, use and communication of your data.

HOW DO WE COLLECT YOUR PERSONAL DATA?

We collect Members’ personal data through the following means:

• Registration and enrollment in the Club Winner loyalty program, through voluntary and free application via the membership form.
• Voluntary completion of the pre-registration form on the Club Winner Website.
• The use of systems that allow Member identification in our gaming bets and tools that allow us to record and monitor gaming activity.
• Through the use and enjoyment of the promotions, benefits, and features offered by Club Winner and the analysis and profiling we perform to properly implement the general terms and conditions of membership in the loyalty program.
• Through the forms and satisfaction surveys that Members can voluntarily complete.

WHAT PROCESSING DO WE CARRY OUT WITH THE PERSONAL DATA OF MEMBERS?

To provide the legally required information on how we process Members’ personal data, we have detailed in the following tables the personal data we process, the processing activities we carry out, the purposes, the legal basis that legitimizes us, and how long we retain the data. All this is presented individually for each processing activity in the tables below.

Management of Membership in the Club Winner Loyalty Program

What are the purposes for which we process your personal data?

• To process the registration and opening of the account for the Club WINNER loyalty program, including the issuance of the physical and/or virtual loyalty card.

• To carry out analysis and profiling activities to properly manage the Club WINNER loyalty program. Please note that this loyalty program is designed to grant benefits and points based on the activity and recurrence of our Members’ gameplay. To this end, it is necessary to analyze gameplay activity, understand your characteristics as a Member, and not only assign you a category or level but also offer you promotions and points tailored to your activity and interests. Therefore, in order to enjoy the benefits of the loyalty program, we must perform this analysis and profiling. Consequently, this enables us to properly execute the general membership terms that you have voluntarily agreed to.

• To analyze your gaming habits and patterns as a Member, including spending and number of visits, to assign and classify you into a certain category or level and grant you points and benefits accordingly.

• To analyze behaviors and preferences based on gameplay habits and characteristics, as well as preferences and interests by machine type.

• To create Member profiles based on the information and data obtained from these analyses.

• To enrich profiles with data obtained from your own activity as a Member, such as your participation in promotions, events, responses to marketing communications, and gameplay activity.

• To apply the exclusive benefits arising from membership in the program (point accumulation, discounts, offers, and promotions).

• To manage Members’ participation in the exclusive promotions arising from program membership.

• To design advertising strategies and/or promotional campaigns based on the results of analysis and profiling activities, in order to offer products and services, promotions, gaming experiences, and personalized marketing communications in a differentiated manner.

What personal data do we process?

• Identification data: full name, date of birth, signature, and biometric signature data (if provided).

• Social data: full address and nationality.

• Contact data: email address and phone number.

• Other Member data: points accumulated, discounts, offers, and promotions enjoyed and applied.

• Gaming operation data: betting and gameplay history; detailed records of each operation, along with all related information and prizes obtained.

• Gaming habit data: characteristics of the Member’s gaming style, preferences and interests by machine or game type, and achieved game category or level.

What is the legal basis for processing your data?

• Execution of the general terms and conditions of the Club Winner loyalty program. That is, the execution of a contract to which you are a party.

How long do we keep your personal data?

• We will process your personal data as long as your membership in the Club Winner loyalty program remains active, or until you unsubscribe from the program. We may also cease processing if your Member account remains inactive for five (5) years, in which case we will unsubscribe you due to inactivity.
• Afterwards, we will retain your personal data duly blocked for the legally established period and/or for the statute of limitations for any actions arising from your relationship with Club Winner.
• Once the maximum retention period has been reached, we will anonymize or delete your personal data.

2.1 What is profiling?

Profiling is an automated processing of personal data consisting of using personal data to evaluate certain personal aspects of a natural person, in particular to analyze or predict aspects concerning that person’s professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

2.2 How do we carry out analysis and profiling?

Below we explain how we carry out such profiling and the logic involved:

• When you enter the Casino and use the various gaming services, we identify you as a Member player through different methods. This may be through the insertion of physical or virtual cards and other identification tools installed on our gaming machines, or manually by our staff. Once we identify you as a Member on the gaming machines, our system tracks all your gameplay. In the case of table games, your activity is recorded manually. All this allows us to assign points and benefits based on your gameplay.
• Once a certain level of spending and number of visits is reached, our algorithm automatically awards you points, benefits, and assigns you a category or upgrades your level. In any case, the criteria for changing level or category have been pre-established by us, and the algorithm used for profiling has been pre-coded by a person. Therefore, the algorithm does not learn autonomously and cannot set its own operating rules.
• Likewise, we may automatically analyze your habits, preferences, and interests in order to offer you products, services, promotions, experiences, and commercial communications tailored to your category or level, which are previously designed by the Casino.
• In any case, please note that these profiling actions are only carried out if you identify yourself as a Member. If you play without identifying yourself, we will not be able to carry out this processing and, as a result, you will not be able to accumulate points or receive benefits. Therefore, we will not be able to properly manage the Club Winner loyalty program or execute the program’s membership terms.

2.3 What do we use profiling for?

Profiling techniques allow us to extract value from the personal data of our Members by enabling us to use the results of such analysis to offer differentiated products, services, promotions, experiences, and commercial communications tailored to each Member’s category and gaming profile. In this way, we aim to provide a better experience, deliver higher quality service, and foster customer loyalty. We do not use the data obtained through profiling for purposes other than those specified in the previous section.

2.4 How does profiling affect Members’ personal data?

The profiling of personal data does not produce legal effects for Members nor does it significantly affect them in a similar manner. Consequently, Members’ legal rights are not impacted in any case, nor do they experience effects that could be considered equivalent. The algorithm used for profiling does not make recommendations regarding actions to be taken (neither at segment level nor at individual level); rather, it simply analyzes behavioral data and habits in order to understand the Member’s gaming behavior and infer potential future actions. Based on this information, a person from the marketing department makes decisions about the most appropriate strategy for that specific Member.

What are the purposes for which we process your personal data?

• To analyze and segment the characteristics, personal data, and participation of Members in promotional actions, as well as information related to habits, gameplay patterns, and Website usage patterns, in order to identify common profiles.

• To create Member profiles based on the information and data obtained through such analysis.

• To design and offer products, services, promotions, and experiences in a personalized manner based on the characteristics, interests, preferences, and history of the Members.

• To design commercial and advertising communications via electronic means about products, services, promotions, or experiences in a personalized manner based on the characteristics, interests, preferences, and history of the Members.

What personal data do we process?

• Identification data: full name, IP address.

• Contact data: email address and phone number.

• Data related to interaction with Club Winner: games, levels, visit history, responses to marketing communications, etc.

What is the legal basis for processing your data?

• The processing is based on the Member’s free, prior, specific, and informed consent, given voluntarily by joining the club and fully accepting the legal terms and conditions, including profiling as part of the program’s management.

How long do we keep your personal data?

• The data will be kept as long as the Member remains active in Club Winner and does not unsubscribe from the program.
• After that, we will retain your personal data duly blocked for the legally established period and/or the statute of limitations for any actions arising from the processing of your personal data.
• Once the maximum retention period has been reached, we will either anonymize or delete your data.

Sending satisfaction surveys via electronic means (such as SMS and/or email, among others) and analyzing them

For what purposes do we process your personal data?
To properly manage our gaming and customer service services and improve their quality.
To understand our Members’ experience at the Casino and attempt to improve it or resolve any incidents or complaints they may have had regarding the services provided and the attention received.

What personal data do we process?
Identification data: full name, gender, age.
Contact information: email and phone number.
Ratings of our services and attention received by Casino staff and, where applicable, complaints or incidents that occurred during the experience at the Casino.
All additional information you may provide us when responding to satisfaction surveys regarding your experience at the Casino.

On what legitimate basis?
The Casino’s legitimate interest in understanding the compliance and satisfaction of its Members who are members of the WINNER Club loyalty club. In any case, we inform you that you may object to receiving satisfaction surveys by following the instructions in each communication received or by sending an email to the following addresses, stating your request:

Country

Email Address

Spain

protecciondedatos@cirsa.com

Colombia

administracion@winnergroup.com

Costa Rica

protecciondedatos@cr.cirsa.com

Morocco

protectiondesdonnees@ma.cirsa.com

Mexico

protecciondedatos@pringsa.com

Panama

servicioalcliente@pa.cirsa.com

Peru

pe.protecciondedatos@pe.cirsa.com

Dominican Republic

rd.sc.dominicana@do.cirsa.com

How long do we retain your personal data?
We will process your data as long as your loyalty program membership remains in effect or until you unsubscribe from receiving satisfaction surveys.
Afterwards, we will retain your personal data, duly blocked, for the legally stipulated period and/or for the limitation period for any actions that may arise as a result of the processing of your personal data.
Once the maximum retention period has been reached, we will anonymize or delete your data.

Sending Personalized Commercial Communications

What are the purposes for which we process your personal data?

• To send personalized commercial communications via electronic means (email, SMS, phone calls, and social media, among others) for advertising and promotional purposes regarding services, news, promotions, benefits, exclusive events, and other information about Club Winner and SPORTIUM (Apuesta Total in Peru) that may be of interest to the Member.

• To provide a higher-quality service, as you will only receive communications whose content may be relevant to you, avoiding the sending of generic communications that could be excessive or unappealing, thereby increasing your satisfaction.

What personal data do we process?

• Identification data: full name.

• Contact data: email address and phone number.

What is the legal basis for processing your data?

The processing is based on the Member’s free, prior, specific, and informed consent. This consent is explicitly obtained through the Club membership form, where the Member can check a specific box to accept receiving personalized commercial communications. This consent is given separately from other terms and conditions, ensuring that it is informed and specific.

In any case, please note that you may object to receiving personalized commercial communications for advertising and promotional purposes directly and easily via the link or instructions provided in each commercial communication received, or by sending an email indicating your request to the following addresses:

How long do we keep your personal data?

We will process your data until you exercise your right to object (unsubscribe from our personalized commercial communications) or request the deletion of your data.
Afterwards, we will retain your personal data duly blocked for the legally established period and/or the statute of limitations for any actions arising from the processing of your personal data.
Once the maximum retention period has been reached, we will anonymize or delete your data.

5. Maintenance of Suppression and/or Opt-Out Lists

What are the purposes for which we process your personal data?

To maintain an up-to-date list of all Members who have requested the deletion of their data or who have, at any point, objected to any of the data processing activities we carry out.

What personal data do we process?

• Identification data: full name.

• Contact data: phone number and/or address and/or email address.

• Effective date of suppression/objection.

What is the legal basis for processing your data?

Compliance with a legal obligation, specifically:

How long do we keep your personal data?

We will process your data as long as your membership remains active or until you exercise your right to object or request the deletion of your data.
Afterward, we will retain your personal data duly blocked for the legally established period and/or for the statute of limitations for any actions that may arise from the processing of your personal data.
Once the maximum retention period has been reached, we will either anonymize or delete your data.

WHAT RIGHTS CAN YOU EXERCISE?

Below we provide information on the rights you may exercise:

Right of Access

You have the right to know whether we are processing your personal data and, if so, to access the personal data we process.

Right to Rectification

You have the right to rectify any inaccurate or incomplete personal data. To do so, you must specify which data you wish to update and provide proper documentation to support the changes.

Right to Object

In the cases legally provided, you may object at any time, for reasons related to your particular situation, to the processing of your data. Please note that objecting to processing based on your consent or the execution of a contract will make it impossible for us to carry out such processing.
For all processing based on your consent, you may object and/or revoke your consent at any time. Specifically, you may object to the sending of personalized commercial communications for advertising and promotional purposes, and to the sending of satisfaction surveys via electronic means. You may do so by contacting the relevant email address listed below, indicating your request, or by following the instructions provided in each commercial communication.
Please remember that objecting to analysis and profiling actions will result in your removal from Club Winner, as we will no longer be able to fulfill the primary purposes of the loyalty program.

Right to Erasure or Cancellation

This right allows you to request the deletion of your personal data. This does not mean that the data will be completely erased, but rather that it will be blocked to prevent any processing, while remaining available to public administrations, courts, and tribunals for the purpose of responding to potential liabilities during the statute of limitations.

Right to Data Portability

You have the right to receive and/or transfer to another data controller the personal data you have provided to us, in a structured, commonly used, and machine-readable format.

Right to Restriction of Processing

You have the right to request that we temporarily suspend the processing of your data when:
(i) you have challenged the accuracy of your data, while we verify it; or
(ii) you have objected to the processing of your data, while we assess whether our legitimate grounds override yours.
You may also request that we retain your data when:
(i) the processing is unlawful and you oppose the deletion of your data and instead request restriction of use; or
(ii) we no longer need your data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims.

You may exercise your rights free of charge at any time by contacting our Data Protection Officer, or the relevant authority depending on your country, via email and specifying the right you wish to exercise. If we have difficulty verifying your identity, we may request a valid identification document to confirm your identity and properly process your request.

If you believe that we have not adequately fulfilled the exercise of your rights, you may file a complaint with the relevant supervisory authority in your country of membership:

WHO DO WE SHARE YOUR PERSONAL DATA WITH?

We inform you that your personal data will be shared only with the companies that form part of Club Winner in the country where you registered, all of which have been identified as joint controllers of the processing. This communication is necessary and essential to manage your participation in the loyalty program and to allow you to enjoy the benefits of Club Winner across the affiliated establishments, enabling you to accumulate and use points in the various casinos indicated in section 1. No other communication of data to third parties will be made outside this framework.

Other third parties to whom we may communicate your data—based on a legal requirement or when the legal basis is compliance with a legal obligation or the pursuit of a legitimate interest (such as taking legal action or defending against it)—include:

• Legal advisors

• Courts and Tribunals

• Relevant Tax Authorities

• Consumer protection and competition regulatory agencies

• Relevant data protection authorities

• Government bodies and public administration

• Law enforcement and security forces

Additionally, we may disclose your personal data to third parties if we, or substantially all our assets, are acquired by a third party, in which case your personal data will be one of the transferred assets.

WHO HAS ACCESS TO YOUR DATA?

We work with service providers or third parties necessary for the correct provision of our services who, in the course of their work, may access your personal data. We have formalized data processing agreements with these providers, outlining their responsibilities as Data Processors. These agreements include the necessary guarantees for personal data processing, confidentiality, and the deletion, destruction, or return of the information.

ARE YOUR DATA SECURE?

We implement appropriate procedures and information systems, as well as the technical and organizational security measures necessary to ensure a level of protection appropriate to the risks associated with the processing activities described in this Privacy Policy.
All information you provide is stored on secure servers. Once we receive your data, we use strict security procedures to prevent unauthorized access.
We also ensure that our service providers meet high security standards in accordance with applicable data protection legislation in each country.
The data will be processed by the companies identified in this document. Specifically, for Members affiliated with Club Winner in Spain, their personal data will not be transferred outside the European Economic Area. For Members affiliated in other countries, their data will be processed by the operating company in their respective country.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may change over time due to evolving criteria of the competent supervisory authorities in each country, legislative amendments, or judicial decisions that may apply to this Policy.
We therefore reserve the right to modify this Privacy Policy to adapt it to such changes in legal interpretation, jurisprudence, or regulatory requirements.

Last updated: April 4, 2025