Last reviewed: 2025
1. Introduction
This Privacy Policy sets out how Grosvenor Casino The Rialto collects, uses, stores, shares and protects personal data relating to customers, prospective customers and visitors to its premises and services. It applies to all individuals whose personal data is processed in connection with operations in the United Kingdom.
Personal data is handled in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable guidance issued by the Information Commissioner’s Office (ICO) and the UK Gambling Commission (UKGC).
By using the services of Grosvenor Casino The Rialto or by providing personal information, you acknowledge that your data will be processed as described in this Privacy Policy.
2. Data Controller
Grosvenor Casino The Rialto acts as the data controller in respect of personal data collected through its premises and associated services. As data controller, Grosvenor Casino The Rialto determines the purposes and means by which personal data is processed.
Questions about the handling of personal data, or requests to exercise rights under UK data protection law, can be directed to the contact details set out in Section 9 of this Privacy Policy.
3. Personal Data Collected
Personal data is collected where necessary for the lawful operation of casino and betting services, including identity verification, regulatory compliance and account management.
Categories of personal data that may be collected include:
- Full name, date of birth and residential address
- Government-issued identification documents
- Contact details, including email address and telephone number
- Financial information required for payment processing and anti-money laundering (AML) checks
- Records of transactions, gaming activity and account history
- Communications sent to the company, including support requests and complaints
- Technical data collected when you interact with digital services, such as IP address, browser type and device identifiers
- Responses to responsible gambling assessments and self-exclusion requests
Personal data is not collected beyond what is required for the purposes described in this Privacy Policy.
4. Legal Basis for Processing
Personal data is processed on one or more of the following legal bases:
Legal obligation - Certain data must be collected and retained to comply with legal requirements and UKGC licence conditions, including identity verification records and transaction histories. Regulatory compliance data is retained for a minimum of five years following the end of the customer relationship, in line with UKGC guidance.
Contract performance - Processing is necessary to fulfil obligations to you as a customer, including account management and the handling of deposits and withdrawals.
Legitimate interests - Personal data may be processed where there is a legitimate interest in doing so and where that interest is not overridden by your rights and freedoms. This includes fraud prevention, security monitoring and service improvement.
Consent - Where consent is relied upon as a legal basis, for example for certain marketing communications, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
5. Use of Personal Data
Personal data collected by Grosvenor Casino The Rialto is used for the following purposes:
- Verifying identity and age in accordance with UKGC requirements
- Conducting AML and Know Your Customer (KYC) checks
- Managing accounts and processing transactions
- Monitoring gaming activity for responsible gambling purposes, including identifying signs of problem gambling
- Complying with legal and regulatory obligations
- Investigating and responding to complaints or disputes
- Communicating about accounts, including service updates and required notifications
- Preventing fraud, money laundering and other unlawful activity
Personal data is not used for automated decision-making that produces legal or similarly significant effects without human review, except where permitted by law and where appropriate safeguards are in place.
6. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected or as required by law.
Purpose - Retention period:
- Identity and KYC records - Minimum 5 years after account closure
- Transaction and gaming history - 5 to 7 years after account closure
- Responsible gambling records - Duration of relationship plus minimum 5 years
- Communications and complaints - Up to 6 years from resolution
These retention periods reflect obligations under the Proceeds of Crime Act 2002, the Money Laundering Regulations 2017 and UKGC licence conditions. After the applicable retention period expires, data is securely deleted or anonymised.
7. Sharing of Personal Data
Personal data is not sold to third parties. Data may be shared in the following circumstances:
- With regulatory authorities, including the UKGC and HMRC, where required by law
- With law enforcement agencies in connection with the prevention or detection of crime
- With third-party service providers that process data on behalf of Grosvenor Casino The Rialto, such as identity verification providers and payment processors, under contractual data processing agreements
- With the national self-exclusion scheme (GAMSTOP) and other responsible gambling bodies where required by UKGC licence conditions
Any third party that processes personal data on behalf of Grosvenor Casino The Rialto is required to process such data only in accordance with instructions and applicable data protection law.
8. Your Rights
Under UK GDPR, individuals have the following rights in relation to their personal data:
- Right of access - To request a copy of the personal data held.
- Right to rectification - To request correction of inaccurate or incomplete personal data.
- Right to erasure - To request deletion of personal data where there is no lawful basis for continued processing.
- Right to restriction - To request that the use of personal data is limited in certain circumstances.
- Right to object - To object to processing based on legitimate interests or for direct marketing purposes.
- Right to data portability - Where processing is based on consent or contract and carried out by automated means, to request personal data in a structured, commonly used and machine-readable format.
- Rights related to automated decision-making - To not be subject to solely automated decisions that significantly affect you, and to request human review.
Some rights are subject to legal exemptions. For example, erasure may not be possible where data is required to be retained for regulatory purposes.
To exercise any of these rights, please use the contact details provided in Section 9. A response will be provided within one calendar month of receipt of a valid request. If a request is complex or numerous, this period may be extended by a further two months, in which case you will be informed.
9. Contact and Complaints
Questions about this Privacy Policy, requests to exercise data protection rights or concerns about the handling of personal data should be addressed directly to Grosvenor Casino The Rialto using the contact channels provided by the casino.
If you are not satisfied with the response to a query or complaint, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters. The ICO can be contacted via its website at ico.org.uk or by telephone on 0303 123 1113.
10. Changes to This Policy
This Privacy Policy is reviewed periodically and updated where necessary to reflect changes in law, regulatory guidance or internal practices. The “Last reviewed” date at the top of this document indicates when it was most recently assessed. Continued use of the services of Grosvenor Casino The Rialto following any update constitutes acknowledgement of the revised Privacy Policy.