- Introduction
This Privacy Policy sets out how Carlton Casino Club collects, processes, stores, shares and protects the personal data of individuals who access or use the services of the platform. It applies to all registered account holders and to visitors to the website who have not yet registered.
Carlton Casino Club handles personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and the Irish Data Protection Acts 1988 to 2018. By using the services of the platform, users acknowledge that their personal data will be processed as described in this document.
This policy is available at all times via the footer of the website and should be reviewed before completing registration. Acceptance of this policy is a condition of account creation.
- Who Is Responsible for Data Processing
Carlton Casino Club acts as the data controller in respect of personal data collected through the website and related services. As data controller, Carlton Casino Club determines the purposes and means of processing personal data.
Questions about this policy or requests to exercise data protection rights can be addressed to the Data Protection Officer using the contact details provided in Section 9.
- Personal Data Collected
The platform collects and processes the following categories of personal data:
- Registration data: full name, date of birth, residential address, email address, telephone number, username and password.
- Identity and verification data: copies of government-issued identification documents, proof of address and payment ownership documentation collected for Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance.
- Transaction data: records of deposits, withdrawals, account balances and payment instrument details.
- Gameplay and account activity data: session records, betting history, account preferences and communications with the support team.
- Technical data: IP address, device identifiers, browser type, operating system, geolocation data used for access verification and log files.
- Marketing and communications data: records of marketing preferences and any correspondence sent to or received from the platform.
Special categories of personal data as defined under Article 9 GDPR are not collected unless required by law.
- Purposes and Legal Bases for Processing
Personal data is processed only where a lawful basis exists under Article 6 GDPR. The main processing purposes and corresponding legal bases are:
- Account creation and management - performance of a contract
- Provision of services and processing transactions - performance of a contract
- Identity verification, KYC and AML compliance - legal obligation
- Age verification and responsible gambling monitoring - legal obligation
- Fraud prevention and security - legitimate interests
- Regulatory reporting and tax obligations - legal obligation
- Marketing communications (where opted in) - consent
- Website analytics and performance monitoring - legitimate interests
Where consent is relied on as a legal basis, it may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
- Data Retention
Personal data is retained for as long as necessary to fulfil the purposes for which it was collected, subject to minimum retention periods required by applicable law.
For active accounts, data is retained for the duration of the account relationship. Following account closure or a period of account dormancy, personal data is retained for a minimum of six years in accordance with AML legislation and applicable gambling regulations. Where a longer retention period is required by law or regulatory obligation, that longer period applies.
After the applicable retention period has expired, personal data is securely deleted or anonymised.
- Sharing of Personal Data
Carlton Casino Club does not sell personal data to third parties. Personal data may be shared with the following categories of recipients where a lawful basis applies:
- Payment processors and financial institutions, for processing transactions and verifying payment instruments.
- Identity verification and KYC service providers, engaged to assist with regulatory compliance obligations.
- Game and platform technology providers, where necessary for the delivery of services.
- Regulatory and law enforcement authorities, including the Gambling Regulatory Authority of Ireland (GRAI) and the Revenue Commissioners, where disclosure is required by law or court order.
- Analytics and security service providers, operating under data processing agreements that limit their use of data to the purposes specified by the platform.
Where personal data is transferred outside the European Economic Area, appropriate safeguards are implemented in accordance with Chapter V GDPR, including standard contractual clauses approved by the European Commission.
- Cookies and Tracking Technologies
The website uses cookies and similar tracking technologies. Essential cookies are required for the operation of the website and cannot be disabled. Non-essential cookies, including analytics and preference cookies, are placed only with prior consent.
Cookie preferences may be managed at any time through the cookie settings tool available on the website. Withdrawing consent for non-essential cookies does not affect the functionality of core account services.
For full details of the cookies used and their purposes, refer to the separate Cookie Policy available on the website.
- Your Rights Under GDPR
As a data subject under GDPR, an individual has the following rights in relation to personal data held by Carlton Casino Club:
- Right of access: the right to request a copy of the personal data held, including account details, transaction records, gameplay data, communications and verification documents. A verified subject access request will be responded to within 30 days and data will be provided in a readable format such as PDF or CSV.
- Right to rectification: the right to request correction of inaccurate or incomplete personal data.
- Right to erasure: the right to request deletion of personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
- Right to restriction of processing: the right to request that processing of personal data be limited in certain circumstances.
- Right to data portability: the right to request that personal data be provided in a structured, commonly used and machine-readable format.
- Right to object: the right to object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: where processing is based on consent, the right to withdraw that consent at any time.
To exercise any of these rights, contact the Data Protection Officer using the details in Section 9. Identity verification may be required before a request is processed. No fee is charged for standard requests.
If a data subject is not satisfied with the response received, a complaint may be lodged with the Data Protection Commission (DPC), the supervisory authority for data protection in Ireland. The DPC can be contacted at www.dataprotection.ie.
- Contact Details
For data protection queries, subject access requests or complaints, contact the Data Protection Officer at:
Carlton Casino Club - Data Protection Officer
Email: [email protected]
Privacy-related correspondence is generally acknowledged within five business days and a substantive response is generally provided within 30 days of receipt.
- Changes to This Policy
Carlton Casino Club reserves the right to update this Privacy Policy at any time. Where changes are material, registered account holders will be notified by email or by a prominent notice on the website before the changes take effect. The current version of this policy is always available via the footer of the website. Continued use of the services following notification of changes constitutes acceptance of the revised policy.
This policy was last reviewed in 2025.