Legal notice

MERKUR Casino Limited

Psaila Street 172, Level 1

BKR 9077 Birkirkara

Malta

Telefon: + 356 21240142

E-Mail: info@casinomerkurmare.com

Internet: www.merkur-mare.com

Authorized representative managing director:

David Schnabel, Kurt Duers

Registration Number: C 76548

Tax Number: 998040721

Responsible according to Section 10 para. 3 German Public Media Services Act:

Mario Hoffmeister

Hosting:

BEIT Systemhaus GmbH

Merkur-Allee 1–15

32339 Espelkamp

E-mail: info@beit.de

Liability note: In spite of careful control of content, we do not take over any liability for the content of external links. The operators bear sole responsibility for the content of linked pages.

Privacy Policy

This Privacy Policy informs you about the nature, the scope and the purpose of processing of personal data (hereafter “data” for short) within our online presence and related websites, functions and content as well as external elements of our online presence, such as our social media profile (hereafter collectively referred to as “online presence”). With regard to the terms used, such as “processing” and “controller”, we refer you to the definitions in Art. 4 of the European General Data Protection Regulation (GDPR).

Controller

MERKUR Casino Limited
No. 12, Tigne Place
Office 2/1 Tigne Street
Sliema SLM 3173
Malta

Tel.: + 356 21240142
Email: info@casinomerkurmare.com
Internet: www. merkur-mare.com

Authorized representative managing director:

David Schnabel, Kurt Duers

Contact details for the Data Protection Officer:

datenschutzbeauftragter@gauselmann.de

Types of processed data:

- Master data (e.g. names, addresses).
- Contact data (e.g. email addresses, telephone numbers).
- Content data (e.g. text, photographs, videos).
- Usage data (e.g. websites visited, interest in content, times of access).
- Metadata/Communication data (e.g. device information, IP addresses).

Categories of data subjects

Visitors to and users of the online presence (data subjects are also collectively referred to as “users” hereafter).

Purpose of processing

- Provision of the online presence, the functions and content thereof.
- Replying to requests for contact and communication with users.
- Security measures.
- Audience reach measurement/marketing

Terms used

“Personal data” means any information relating to an identified or identifiable natural person (hereafter “data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and encompasses practically all handling of data.

“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal bases

Pursuant to Art. 13 of the GDPR, we inform you of the legal bases for data processing. Unless the legal basis is stated in the Privacy Policy, the following applies: The legal basis for obtaining consent is Art. 6 (1) (a) and Art. 7 of the GDPR, the legal basis for processing for the provision of our services and contract performance as well as to reply to requests is Art. 6 (1) (b) of the GDPR, the legal basis for processing for compliance with a legal obligation is Art. 6 (1) (c) of the GDPR, and the legal basis for processing for the purposes of our legitimate interests is Art. 6 (1) (f) of the GDPR. If processing of personal data is necessary in order to protect the vital interests of the data subject or of another natural person, the legal basis is Art. 6 (1) (d) of the GDPR.

Security measures

Pursuant to Art. 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes or processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organisation measures to ensure a level of security appropriate to the risk.

Such measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data as well as access relating to the data, input, dissemination, ensuring availability and their segregation. Furthermore, we have put in place processes to ensure the exercise of data subjects’ rights, erasure of data and response to a data compromise. Moreover, we take personal data protection into account as early as the development/selection stage of hardware, software as well as processes, in accordance with the principle of data protection by design and by default (Art. 25 of the GDPR).

Working with processors and third parties

If we disclose, pass on or otherwise give access to the data to other persons and companies (processors or third parties) in the context of our processing activities, this will only take place on the basis of legal permission (e.g. if it is necessary to pass on the data to third parties, such as to payment providers, for the performance of a contract in accordance with Art. 6 (1) (b) of the GDPR), you have given consent, we have a legal obligation to do so or on the basis of our legitimate interests (e.g. when engaging contractors, web hosts, etc.).

If we engage third parties to process data on the basis of a “processing contract”, we do so on the basis of Art. 28 of the GDPR.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or we do so by availing of third-party services or by disclosing or passing on data to third parties, this only takes place for the performance of a contract or in order to take steps prior to entering into a contract, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process data or have them processed in a third country only if the special conditions of Art. 44 et seq. of the GDPR are met. That is, processing takes place, for instance, on the basis of special guarantees, such as an officially recognised statement of compliance with a level of data protection equivalent to the EU (e.g. with the “Privacy Shield” in the US) or adherence to officially recognised special contractual obligations (“standard contractual clauses”).

Rights of the data subjects

You have the right to obtain confirmation as to whether we process your personal data, the right to access to such data and the right to further information as well as a copy of the data in accordance with Art. 15 of the GDPR.

According to Art. 16 of the GDPR, you have the right to have any incomplete data concerning you completed and/or the rectification of inaccurate data concerning you.

According to Art. 17 of the GDPR, you have the right to obtain the erasure of data concerning you without delay or, alternatively, according to Art. 18 of the GDPR, the restriction of processing of data.

You have the right to receive the data concerning you, which you have provided to us, in accordance with Art. 20 of the GDPR and to transmit those data to another controller.

Furthermore, you have the right, according to Art. 77 of the GDPR, to lodge a complaint with a competent supervisory authority.

Right to withdraw consent

You have the right, according to Art. 7 (3) of the GDPR, to withdraw with future effect any consent you have given.

Right to object (opt out)

You may object at any time to the future processing of data concerning you in accordance with Art. 21 of the GDPR. In particular, the data subject may opt out of processing for direct marketing purposes.

Cookies and right to opt out of direct marketing

“Cookies” are small files that are placed on a user’s computer. The cookie may contain various details. The primary purpose of a cookie is to save a user’s details (or the details of the device on which the cookie is placed) while or after visiting an online presence. Temporary cookies, that is, “session cookies” or “transient cookies” are cookies that are erased when the user leaves the online presence and closes the browser. Such cookies may contain the contents of a basket in an online shop or the user’s login details for example. “Permanent” or “persistent” cookies are cookies that remain stored even after the browser is closed. For example, the user’s login details can be retrieved when the user returns after a number of days. Such cookies may also contain the user’s interests, which are used for audience reach measurement or marketing purposes. A “third-party cookie” is a cookie set by a party other than the Controller who operates the online presence (otherwise they are called “first-party cookies”).

We may use temporary and permanent cookies and inform you about this in our Privacy Policy.

If users do not want cookies to be placed on their computer, they are prompted to change their browser settings accordingly. Stored cookies may be cleared in the browser settings. Disabling cookies may limit the functionality of this online presence.

You can opt out of the use of cookies for the purposes of online behavioural marketing by a number of businesses in general, especially in the case of tracking, on the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, you can disable cookies in your browser settings. Please note that if you do so you may not be able to use all the functions of this online presence.

Erasure of data

The data we process are erased, or their processing is restricted, pursuant to Art. 17 and 18 of the GDPR. Unless expressly stated in this Privacy Policy, the data stored by us are erased as soon as they are no longer required for their intended purpose and erasure does not conflict with statutory storage obligations. If the data are not erased because they are required for other, lawful purposes, their processing is restricted. That is, the data are blocked and not processed for other purposes. This applies, for example, to data that must be stored under commercial or tax law.

The statutory retention period in Germany is 10 years in particular according to section 147 (1) of the German Fiscal Code (Abgabenordnung – AO), section 257 (1) nos 1 and 4 of the German Commercial Code (Handelsgesetzbuch – HGB) (books, records, management reports, accounting records, trading books, tax-relevant documentation, etc.) and 6 years according to section 257 (1) nos 2 and 3, (4) of the Commercial Code (commercial papers).

The statutory retention period in Austria is 7 years in particular according to section 132 (1) of the Austrian Federal Fiscal Code (Bundesabgabenordnung – BAO) (bookkeeping documents, records/invoices, accounts, receipts, business papers, statement of income and expenditure, etc.), for 22 years in relation to property and for 10 years in the case of documentation in relation to telecommunications, broadcasting and electronic services provided to non-commercial enterprises in EU member states and for whom the mini one-stop-shop (MOSS) scheme is used.

Privacy policy in relation to the application process

We process applicant data only for the purpose and in the context of the application process in accordance with the statutory requirements. Applicant data are processed for the performance of our contract or in order to take steps prior to entering into a contract in the context of the application process within the meaning of Art. 6 (1) (b) of the GDPR, Art. 6 (1) (f) of the GDPR, provided that data processing is necessary for us, e.g. in the context of legal proceedings (section 26 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

The application process is contingent upon applicants disclosing applicant data to us. The necessary applicant data are identified in the case of an online form and otherwise follow from the job descriptions and essentially include the personal particulars, postal and contact addresses and the documents that form part of the application, such as cover letter, CV and references. In addition, applicants may supply us with additional information voluntarily.

By sending in the application to us, applicants consent to the processing of their data for the purposes of the application process in the nature and scope outlined in this Privacy Policy.

To the extent that special categories of personal data within the meaning of Art. 9 (1) of the GDPR are voluntarily disclosed in the context of the application process, they will be processed in addition in accordance with Art. 9 (2) (b) of the GDPR (e.g. health data, such as disability or ethnicity). To the extent that special categories of personal data within the meaning of Art. 9 (1) of the GDPR are requested from applicants in the context of the application process, they will be processed in addition in accordance with Art. 9 (2) (a) of the GDPR (e.g. health data if necessary to do the job).

If available, applicants can send in their applications to us via an online form on our website. The data transfer uses state-of-the-art encryption.
Furthermore, applicants can send us their applications via email. However, please note that emails are generally not encrypted and the applicants themselves must see to encryption. Therefore, we cannot take responsibility for the application’s transmission route between the sender and arrival on our server and recommend that applicants use an online form or the postal service instead. In addition to sending an application via the online form and email, applicants have the option to send us their application by post.

In the event that the application is successful, the data provided by the applicant may be further processed by us for the purposes of employment. Otherwise, if an application for a vacancy is unsuccessful, the applicant’s data are erased. Applicants’ data are also erased if an application is withdrawn, which applicants are entitled to do at any time.

Erasure takes place, subject to a justified withdrawal of consent by the applicant, after six months have expired to enable us to answer any follow-on questions about the application and provide supporting documents, which is a requirement under the Equal Treatment Act. Invoices for reimbursement of travel expenses are archived in accordance with the requirements of tax law.

Talent pool

In the context of the application, we offer applicants the option to be added to our talent pool for a period of two years on the basis of consent within the meaning of Art. 6 (1) (b) and Art. 7 of the GDPR.

The applications in the talent pool are processed solely in the context of future job vacancies and recruitment, and are destroyed at the end of the two-year period at the latest. Applicants are informed that their consent to being added to the talent pool is voluntary, has no effect on the ongoing application process and they may withdraw their consent at any time with future effect as well as object within the meaning of Art. 21 of the GDPR.

Making contact

When making contact with us (e.g. via the contact form, email, by phone or on social media) the user’s data are processed to deal with and process the contact request in accordance with Art. 6 (1) (b) of the GDPR. The user’s data may be stored in a Customer Relationship Management (CRM) system or similar system.

We erase the queries if they are no longer required. We review necessity every two years; in addition, the statutory archiving obligations apply.

Newsletter

The following contains information about the contents of our newsletter as well as the subscription, mailing and statistical evaluation process, and also your rights to opt out. By subscribing to our newsletter, you consent to receive the newsletter and the processes described.

Contents of the newsletter: We send newsletters, emails and other electronic notifications containing commercial information (hereafter “newsletter”) only with the recipient’s consent or with legal permission. If, in the context of subscription to the newsletter, its contents are described in concrete terms, then they are relevant for users’ consent. For the rest, our newsletters contain information about our services and us.

Double opt-in and logging: Subscription to our newsletter is on the basis of a double opt-in process. This means that after signing up, you receive an email asking you to confirm your subscription. This confirmation is necessary so that no one with an unknown email address can sign up. Newsletter subscriptions are logged to verify the subscription process in line with the legal requirements. This involves storing the time of subscription and confirmation, and the IP address. In addition, changes to the data stored on you by the mailing provider are logged.

Subscription data: In order to subscribe to the newsletter, all we need is your email address. We give you the option of entering your name, so that we can address the newsletter to you personally.

Newsletter mailing and the associated measurement of success take place on the basis of the recipients’ consent in accordance with Art. 6 (1) (a), Art. 7 of the GDPR in conjunction with section 7 (2) no. 3 of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb – UWG) or on the basis of legal permission pursuant to section 7 (3) of the Act against Unfair Competition.

The subscription process is logged on the basis of our legitimate interests pursuant to Art. 6 (1) (f) of the GDPR. Our interest concerns the use of a user-friendly and secure newsletter system that both serves our business interests and meets users’ expectations and, furthermore, allows us to verify consent.

Cancellation/Withdrawal – You may cancel our newsletter at any time, i.e. withdraw your consent. You will find a link to cancel the newsletter at the bottom of every newsletter. We may store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before we erase them, to enable us to prove that consent had previously been given. The processing of such data is restricted to the purpose of warding off potential claims. It is possible to make an individual erasure request at any time, if, at the same time, the fact that consent was previously given is confirmed.

Collection of access data and log files

We/our hosting provider collect data on every instance of access to the server on which this service is stored (server log files) on the basis of our legitimate interests within the meaning of Art. 6 (1) (f) of the GDPR. Access data include the name of the accessed website, file, the date and time of access, volume of data transferred, successful access message, browser type and version, user’s operating system, referrer URL (last page visited), IP address and the requesting provider.

Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for up to 7 days and then erased. Data whose continued retention is required for evidential purposes are excluded from erasure until final resolution of the incident in question.

Audience reach measurement with Matomo

In the context of audience reach analysis from Matomo, the following data are processed on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and commercial operation of our online presence within the meaning of Art. 6 (1) (f) of the GDPR): the browser type you use and the browser version, the operating system you are running, your country of origin, date and time of the server request, the number of visits, length of stay on the website as well as the external links you clicked. The user IP address is anonymised before it is stored.

Matomo uses cookies that are stored on the user’s computer and enable analysis of the use of our online presence by users. Pseudonymous usage profiles on the users may be generated from the processed data. The cookies are stored for one week. The information about your use of this website that is generated by the cookie is only stored on our server and is not passed on to third parties.

Users can opt out of anonymised data collection by the Matomo programme at any time with future effect by clicking on the link below. In that event, an opt-out cookie will be placed in your browser. As a result, Matomo will no longer collect any session data. However, when users clear their cookies the opt-out cookie also gets deleted and therefore has to be set by users once again.

The logs containing the user data are erased after no more than 6 months.

Online presence on social media

We have an online presence on social networks and platforms in order to communicate with the customers, prospective customers and users active on them and to enable us to inform them through these media of our services.

Please note that in this context user data may be processed outside the European Union. This may entail risks for users because, for instance, this could make it more difficult to enforce user rights. Regarding US providers who are Privacy Shield-certified, please note that certification binds them to adhere to the data protection standards of the EU.

Furthermore, user data are generally processed for market research and advertising purposes. For example, usage profiles may be generated from the usage patterns and the user interests they reveal. In turn, the usage profiles may be used, for example, to deliver ads, both on and outside of the platforms, that are a probable match to the user’s interests. For these purposes, cookies containing the usage pattern and the user’s interests are generally placed on the user’s computer. Furthermore, data can be stored in the usage profiles regardless of the devices used by the users (particularly when the users are active on the platforms in question and are logged on).

Users’ personal data are processed on the basis of our legitimate interests in providing users with effective information and communicating with users in accordance with Art. 6 (1) (f) of the GDPR. If the users are asked for consent to the aforementioned data processing by the individual platform providers, the legal basis for processing is Art. 6 (1) (a), Art. 7 of the GDPR.

For a detailed account of the processing in question and the possibilities to opt out, we refer you to the following provider links.

Also, in relation to requests for information and exercising user rights, please note that the most effective way to do so is through the providers themselves. Only the providers have access to the respective user data and can take appropriate steps directly and give information. Should you still require help, then you may contact us.

- Facebook, -pages, -groups, (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) on the basis of an agreement on joint processing of personal data - Privacy Policy: https://www.facebook.com/about/privacy/, specifically for pages: https://www.facebook.com/legal/terms/information_about_page_insights_data , Opt-out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.

- Google/ YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – Privacy Policy: https://policies.google.com/privacy, Opt-out: https://adssettings.google.com/authenticated, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

Embedding third-party services and content

We use third-party content or services on our online presence on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and commercial operation of our online presence within the meaning of Art. 6 (1) (f) of the GDPR) in order to embed their content and services, such as videos or fonts (hereafter collectively referred to as “content”).

This is contingent upon the third-party providers of such content finding the user’s IP address, as without the IP address they would not be able to send the content to their browser. The IP address is therefore required to display such content. We endeavour only to use content the providers of which only use the IP address to deliver the content. Third-party providers may also use pixel tags (clear GIFs, also known as “web beacons”) for statistical or marketing purposes. Pixel tags enable information, such as visitor traffic on the pages of this website, to be evaluated. The pseudonymous information may also be stored in cookies on the user’s device and contain technical information on the browser and operating system, referrer URLs, time of visit as well as further details on the use of our online presence, amongst other things, and may also be collated with such information from other sources.

Vimeo

We may embed videos from the Vimeo platform provided by Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA. Privacy Policy: https://vimeo.com/privacy. Please note that Vimeo may use Google Analytics. In relation to this, refer to the Privacy Policy (https://policies.google.com/privacy) as well as possibilities to opt-out of Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=de) or the Google settings for the use of data for marketing purposes (https://adssettings.google.com/).

Youtube

We embed videos from the YouTube platform provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/, Opt-out: https://adssettings.google.com/authenticated.

Google Fonts

We embed fonts (“Google Fonts”) provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/, Opt-out: https://adssettings.google.com/authenticated.

Google Maps

We embed maps from the “Google Maps” service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Processed data may include, in particular, IP addresses and location data of users. However, they are not collected without users’ consent (which is generally obtained through your mobile device settings). The data may be processed in the United States. Privacy Policy: https://www.google.com/policies/privacy/, Opt-out: https://adssettings.google.com/authenticated.

Use of Facebook Social Plugins

We use social plugins (“Plugins”) from the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”) on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and commercial operation of our online presence within the meaning of Art. 6 (1) (f) of the GDPR).

These may include content such as images, videos or text and buttons, which enable users to share content from this online presence within Facebook. The list of and what Facebook Social Plugins look like can be viewed here: https://developers.facebook.com/docs/plugins/.

Facebook is certified to the Privacy Shield Framework and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).

When a user calls a function of this online presence that contains such a Plugin, the user’s device establishes a direct connection with the Facebook servers. The content of the Plugin is transferred direct from Facebook to the user’s device, which embeds it in the online presence. In the process, usage profiles on the users may be generated from the processed data. We therefore have no control over the volume of data that Facebook collects using this Plugin and we are informing users to the best of our knowledge.

When the Plugin is embedded, Facebook receives the information that the user has opened that page of the online presence. If the user is logged on to Facebook, Facebook can link the visit with his/her Facebook account. When users interact with the Plugins – by using the Like button or posting a message for example – that information is transferred from your device direct to Facebook and stored there. If a user is not on Facebook, there is still a possibility that Facebook will find out and store the user’s IP address. According to Facebook, in Germany only an anonymised IP address is stored.

Please refer to the Facebook Privacy Policy in relation to the purpose and scope of data collection and the further processing and use of data by Facebook as well as the rights in this regard and settings options to protect users’ privacy: https://www.facebook.com/about/privacy/.

If a user is on Facebook and does not want Facebook to collect data on him/her via this online presence and link them with his/her account data stored by Facebook, he/she must log out of Facebook and clear his/her cookies before using our online presence. Further settings and opt-outs for the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or on the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. The settings are platform-independent; i.e. they apply to all devices, such as desktop computers or mobile devices.