MERKUR Casino Limited
Psaila Street 172, Level 1
BKR 9077 Birkirkara
Telefon: + 356 21240142
Authorized representative managing director:
David Schnabel, Kurt Duers
Registration Number: C 76548
Tax Number: 998040721
Responsible according to Section 10 para. 3 German Public Media Services Act:
BEIT Systemhaus GmbH
Liability note: In spite of careful control of content, we do not take over any liability for the content of external links. The operators bear sole responsibility for the content of linked pages.
MERKUR Casino Limited
No. 12, Tigne Place
Office 2/1 Tigne Street
Sliema SLM 3173
Tel.: + 356 21240142
Internet: www. merkur-mare.com
Authorized representative managing director:
David Schnabel, Kurt Duers
Contact details for the Data Protection Officer:
Types of processed data:
- Master data (e.g. names, addresses).
- Contact data (e.g. email addresses, telephone numbers).
- Content data (e.g. text, photographs, videos).
- Usage data (e.g. websites visited, interest in content, times of access).
- Metadata/Communication data (e.g. device information, IP addresses).
Categories of data subjects
Visitors to and users of the online presence (data subjects are also collectively referred to as “users” hereafter).
Purpose of processing
- Provision of the online presence, the functions and content thereof.
- Replying to requests for contact and communication with users.
- Security measures.
- Audience reach measurement/marketing
“Personal data” means any information relating to an identified or identifiable natural person (hereafter “data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and encompasses practically all handling of data.
“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Relevant legal bases
Pursuant to Art. 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes or processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organisation measures to ensure a level of security appropriate to the risk.
Such measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data as well as access relating to the data, input, dissemination, ensuring availability and their segregation. Furthermore, we have put in place processes to ensure the exercise of data subjects’ rights, erasure of data and response to a data compromise. Moreover, we take personal data protection into account as early as the development/selection stage of hardware, software as well as processes, in accordance with the principle of data protection by design and by default (Art. 25 of the GDPR).
Working with processors and third parties
If we disclose, pass on or otherwise give access to the data to other persons and companies (processors or third parties) in the context of our processing activities, this will only take place on the basis of legal permission (e.g. if it is necessary to pass on the data to third parties, such as to payment providers, for the performance of a contract in accordance with Art. 6 (1) (b) of the GDPR), you have given consent, we have a legal obligation to do so or on the basis of our legitimate interests (e.g. when engaging contractors, web hosts, etc.).
If we engage third parties to process data on the basis of a “processing contract”, we do so on the basis of Art. 28 of the GDPR.
Transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or we do so by availing of third-party services or by disclosing or passing on data to third parties, this only takes place for the performance of a contract or in order to take steps prior to entering into a contract, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process data or have them processed in a third country only if the special conditions of Art. 44 et seq. of the GDPR are met. That is, processing takes place, for instance, on the basis of special guarantees, such as an officially recognised statement of compliance with a level of data protection equivalent to the EU (e.g. with the “Privacy Shield” in the US) or adherence to officially recognised special contractual obligations (“standard contractual clauses”).
Rights of the data subjects
You have the right to obtain confirmation as to whether we process your personal data, the right to access to such data and the right to further information as well as a copy of the data in accordance with Art. 15 of the GDPR.
According to Art. 16 of the GDPR, you have the right to have any incomplete data concerning you completed and/or the rectification of inaccurate data concerning you.
According to Art. 17 of the GDPR, you have the right to obtain the erasure of data concerning you without delay or, alternatively, according to Art. 18 of the GDPR, the restriction of processing of data.
You have the right to receive the data concerning you, which you have provided to us, in accordance with Art. 20 of the GDPR and to transmit those data to another controller.
Furthermore, you have the right, according to Art. 77 of the GDPR, to lodge a complaint with a competent supervisory authority.
Right to withdraw consent
You have the right, according to Art. 7 (3) of the GDPR, to withdraw with future effect any consent you have given.
Right to object (opt out)
You may object at any time to the future processing of data concerning you in accordance with Art. 21 of the GDPR. In particular, the data subject may opt out of processing for direct marketing purposes.
Cookies and right to opt out of direct marketing
“Cookies” are small files that are placed on a user’s computer. The cookie may contain various details. The primary purpose of a cookie is to save a user’s details (or the details of the device on which the cookie is placed) while or after visiting an online presence. Temporary cookies, that is, “session cookies” or “transient cookies” are cookies that are erased when the user leaves the online presence and closes the browser. Such cookies may contain the contents of a basket in an online shop or the user’s login details for example. “Permanent” or “persistent” cookies are cookies that remain stored even after the browser is closed. For example, the user’s login details can be retrieved when the user returns after a number of days. Such cookies may also contain the user’s interests, which are used for audience reach measurement or marketing purposes. A “third-party cookie” is a cookie set by a party other than the Controller who operates the online presence (otherwise they are called “first-party cookies”).
If users do not want cookies to be placed on their computer, they are prompted to change their browser settings accordingly. Stored cookies may be cleared in the browser settings. Disabling cookies may limit the functionality of this online presence.
Erasure of data
The statutory retention period in Germany is 10 years in particular according to section 147 (1) of the German Fiscal Code (Abgabenordnung – AO), section 257 (1) nos 1 and 4 of the German Commercial Code (Handelsgesetzbuch – HGB) (books, records, management reports, accounting records, trading books, tax-relevant documentation, etc.) and 6 years according to section 257 (1) nos 2 and 3, (4) of the Commercial Code (commercial papers).
The statutory retention period in Austria is 7 years in particular according to section 132 (1) of the Austrian Federal Fiscal Code (Bundesabgabenordnung – BAO) (bookkeeping documents, records/invoices, accounts, receipts, business papers, statement of income and expenditure, etc.), for 22 years in relation to property and for 10 years in the case of documentation in relation to telecommunications, broadcasting and electronic services provided to non-commercial enterprises in EU member states and for whom the mini one-stop-shop (MOSS) scheme is used.
We process applicant data only for the purpose and in the context of the application process in accordance with the statutory requirements. Applicant data are processed for the performance of our contract or in order to take steps prior to entering into a contract in the context of the application process within the meaning of Art. 6 (1) (b) of the GDPR, Art. 6 (1) (f) of the GDPR, provided that data processing is necessary for us, e.g. in the context of legal proceedings (section 26 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).
The application process is contingent upon applicants disclosing applicant data to us. The necessary applicant data are identified in the case of an online form and otherwise follow from the job descriptions and essentially include the personal particulars, postal and contact addresses and the documents that form part of the application, such as cover letter, CV and references. In addition, applicants may supply us with additional information voluntarily.
To the extent that special categories of personal data within the meaning of Art. 9 (1) of the GDPR are voluntarily disclosed in the context of the application process, they will be processed in addition in accordance with Art. 9 (2) (b) of the GDPR (e.g. health data, such as disability or ethnicity). To the extent that special categories of personal data within the meaning of Art. 9 (1) of the GDPR are requested from applicants in the context of the application process, they will be processed in addition in accordance with Art. 9 (2) (a) of the GDPR (e.g. health data if necessary to do the job).
If available, applicants can send in their applications to us via an online form on our website. The data transfer uses state-of-the-art encryption.
Furthermore, applicants can send us their applications via email. However, please note that emails are generally not encrypted and the applicants themselves must see to encryption. Therefore, we cannot take responsibility for the application’s transmission route between the sender and arrival on our server and recommend that applicants use an online form or the postal service instead. In addition to sending an application via the online form and email, applicants have the option to send us their application by post.
In the event that the application is successful, the data provided by the applicant may be further processed by us for the purposes of employment. Otherwise, if an application for a vacancy is unsuccessful, the applicant’s data are erased. Applicants’ data are also erased if an application is withdrawn, which applicants are entitled to do at any time.
Erasure takes place, subject to a justified withdrawal of consent by the applicant, after six months have expired to enable us to answer any follow-on questions about the application and provide supporting documents, which is a requirement under the Equal Treatment Act. Invoices for reimbursement of travel expenses are archived in accordance with the requirements of tax law.
In the context of the application, we offer applicants the option to be added to our talent pool for a period of two years on the basis of consent within the meaning of Art. 6 (1) (b) and Art. 7 of the GDPR.
The applications in the talent pool are processed solely in the context of future job vacancies and recruitment, and are destroyed at the end of the two-year period at the latest. Applicants are informed that their consent to being added to the talent pool is voluntary, has no effect on the ongoing application process and they may withdraw their consent at any time with future effect as well as object within the meaning of Art. 21 of the GDPR.
When making contact with us (e.g. via the contact form, email, by phone or on social media) the user’s data are processed to deal with and process the contact request in accordance with Art. 6 (1) (b) of the GDPR. The user’s data may be stored in a Customer Relationship Management (CRM) system or similar system.
We erase the queries if they are no longer required. We review necessity every two years; in addition, the statutory archiving obligations apply.
The following contains information about the contents of our newsletter as well as the subscription, mailing and statistical evaluation process, and also your rights to opt out. By subscribing to our newsletter, you consent to receive the newsletter and the processes described.
Contents of the newsletter: We send newsletters, emails and other electronic notifications containing commercial information (hereafter “newsletter”) only with the recipient’s consent or with legal permission. If, in the context of subscription to the newsletter, its contents are described in concrete terms, then they are relevant for users’ consent. For the rest, our newsletters contain information about our services and us.
Double opt-in and logging: Subscription to our newsletter is on the basis of a double opt-in process. This means that after signing up, you receive an email asking you to confirm your subscription. This confirmation is necessary so that no one with an unknown email address can sign up. Newsletter subscriptions are logged to verify the subscription process in line with the legal requirements. This involves storing the time of subscription and confirmation, and the IP address. In addition, changes to the data stored on you by the mailing provider are logged.
Subscription data: In order to subscribe to the newsletter, all we need is your email address. We give you the option of entering your name, so that we can address the newsletter to you personally.
Newsletter mailing and the associated measurement of success take place on the basis of the recipients’ consent in accordance with Art. 6 (1) (a), Art. 7 of the GDPR in conjunction with section 7 (2) no. 3 of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb – UWG) or on the basis of legal permission pursuant to section 7 (3) of the Act against Unfair Competition.
The subscription process is logged on the basis of our legitimate interests pursuant to Art. 6 (1) (f) of the GDPR. Our interest concerns the use of a user-friendly and secure newsletter system that both serves our business interests and meets users’ expectations and, furthermore, allows us to verify consent.
Cancellation/Withdrawal – You may cancel our newsletter at any time, i.e. withdraw your consent. You will find a link to cancel the newsletter at the bottom of every newsletter. We may store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before we erase them, to enable us to prove that consent had previously been given. The processing of such data is restricted to the purpose of warding off potential claims. It is possible to make an individual erasure request at any time, if, at the same time, the fact that consent was previously given is confirmed.
Collection of access data and log files
We/our hosting provider collect data on every instance of access to the server on which this service is stored (server log files) on the basis of our legitimate interests within the meaning of Art. 6 (1) (f) of the GDPR. Access data include the name of the accessed website, file, the date and time of access, volume of data transferred, successful access message, browser type and version, user’s operating system, referrer URL (last page visited), IP address and the requesting provider.
Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for up to 7 days and then erased. Data whose continued retention is required for evidential purposes are excluded from erasure until final resolution of the incident in question.
Audience reach measurement with Matomo
In the context of audience reach analysis from Matomo, the following data are processed on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and commercial operation of our online presence within the meaning of Art. 6 (1) (f) of the GDPR): the browser type you use and the browser version, the operating system you are running, your country of origin, date and time of the server request, the number of visits, length of stay on the website as well as the external links you clicked. The user IP address is anonymised before it is stored.
Users can opt out of anonymised data collection by the Matomo programme at any time with future effect by clicking on the link below. In that event, an opt-out cookie will be placed in your browser. As a result, Matomo will no longer collect any session data. However, when users clear their cookies the opt-out cookie also gets deleted and therefore has to be set by users once again.
The logs containing the user data are erased after no more than 6 months.
Online presence on social media
We have an online presence on social networks and platforms in order to communicate with the customers, prospective customers and users active on them and to enable us to inform them through these media of our services.
Please note that in this context user data may be processed outside the European Union. This may entail risks for users because, for instance, this could make it more difficult to enforce user rights. Regarding US providers who are Privacy Shield-certified, please note that certification binds them to adhere to the data protection standards of the EU.
Furthermore, user data are generally processed for market research and advertising purposes. For example, usage profiles may be generated from the usage patterns and the user interests they reveal. In turn, the usage profiles may be used, for example, to deliver ads, both on and outside of the platforms, that are a probable match to the user’s interests. For these purposes, cookies containing the usage pattern and the user’s interests are generally placed on the user’s computer. Furthermore, data can be stored in the usage profiles regardless of the devices used by the users (particularly when the users are active on the platforms in question and are logged on).
Users’ personal data are processed on the basis of our legitimate interests in providing users with effective information and communicating with users in accordance with Art. 6 (1) (f) of the GDPR. If the users are asked for consent to the aforementioned data processing by the individual platform providers, the legal basis for processing is Art. 6 (1) (a), Art. 7 of the GDPR.
For a detailed account of the processing in question and the possibilities to opt out, we refer you to the following provider links.
Also, in relation to requests for information and exercising user rights, please note that the most effective way to do so is through the providers themselves. Only the providers have access to the respective user data and can take appropriate steps directly and give information. Should you still require help, then you may contact us.
Embedding third-party services and content
We use third-party content or services on our online presence on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and commercial operation of our online presence within the meaning of Art. 6 (1) (f) of the GDPR) in order to embed their content and services, such as videos or fonts (hereafter collectively referred to as “content”).
This is contingent upon the third-party providers of such content finding the user’s IP address, as without the IP address they would not be able to send the content to their browser. The IP address is therefore required to display such content. We endeavour only to use content the providers of which only use the IP address to deliver the content. Third-party providers may also use pixel tags (clear GIFs, also known as “web beacons”) for statistical or marketing purposes. Pixel tags enable information, such as visitor traffic on the pages of this website, to be evaluated. The pseudonymous information may also be stored in cookies on the user’s device and contain technical information on the browser and operating system, referrer URLs, time of visit as well as further details on the use of our online presence, amongst other things, and may also be collated with such information from other sources.
Use of Facebook Social Plugins
We use social plugins (“Plugins”) from the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”) on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and commercial operation of our online presence within the meaning of Art. 6 (1) (f) of the GDPR).
These may include content such as images, videos or text and buttons, which enable users to share content from this online presence within Facebook. The list of and what Facebook Social Plugins look like can be viewed here: https://developers.facebook.com/docs/plugins/.
Facebook is certified to the Privacy Shield Framework and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
When a user calls a function of this online presence that contains such a Plugin, the user’s device establishes a direct connection with the Facebook servers. The content of the Plugin is transferred direct from Facebook to the user’s device, which embeds it in the online presence. In the process, usage profiles on the users may be generated from the processed data. We therefore have no control over the volume of data that Facebook collects using this Plugin and we are informing users to the best of our knowledge.
When the Plugin is embedded, Facebook receives the information that the user has opened that page of the online presence. If the user is logged on to Facebook, Facebook can link the visit with his/her Facebook account. When users interact with the Plugins – by using the Like button or posting a message for example – that information is transferred from your device direct to Facebook and stored there. If a user is not on Facebook, there is still a possibility that Facebook will find out and store the user’s IP address. According to Facebook, in Germany only an anonymised IP address is stored.
If a user is on Facebook and does not want Facebook to collect data on him/her via this online presence and link them with his/her account data stored by Facebook, he/she must log out of Facebook and clear his/her cookies before using our online presence. Further settings and opt-outs for the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or on the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. The settings are platform-independent; i.e. they apply to all devices, such as desktop computers or mobile devices.