1. Data Controller

The entity responsible for the processing of your personal data (the "Data Controller") is:

If you have any questions, concerns, or requests regarding the processing of your personal data, you may contact us at any time using the contact details provided in Section 12 of this Privacy Policy.

2. Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring compliance with applicable data protection laws. You may contact our DPO directly regarding any matters related to the processing of your personal data:

3. Scope and Applicability

This Privacy Policy applies to all individuals who:

• Visit or browse the Website at www.navquorinluxehaven.com;
• Make a hotel reservation online, by telephone, by email, or in person;
• Register for or use our casino facilities and gaming services;
• Subscribe to our newsletter, promotional offers, or loyalty programme;
• Contact us through the Website, by email, telephone, or in writing;
• Attend events, conferences, or functions hosted at our premises;
• Apply for employment or submit a job enquiry;
• Interact with us through social media channels.

This Privacy Policy does not apply to the data practices of third-party websites, services, or organisations that may be linked to from our Website. We encourage you to review the privacy policies of any third-party services before providing them with your personal information.

4. Personal Data We Collect

We collect various categories of personal data depending on how you interact with us. The categories below describe the types of personal data we may collect, either directly from you or from third parties.

4.1 Data You Provide Directly

• Identity Data: Full name, title, date of birth, nationality, gender, and government-issued identification details (passport number, driving licence, or national identity card) where required by law or for casino compliance purposes.
• Contact Data: Email address, telephone number, postal address, city, and country of residence.
• Reservation Data: Check-in and check-out dates, room preferences, number of guests, special requests, dietary requirements, accessibility needs, and any other information provided during the booking process.
• Payment Data: Credit or debit card details (card number, expiry date, CVV), billing address, and bank account information where applicable. Note: full payment card details are processed by our certified payment service providers and are not stored by us in their entirety.
• Casino and Gaming Data: Gaming activity records, win/loss history, player account details, identification documents required under anti-money laundering (AML) and responsible gambling regulations, and self-exclusion preferences.
• Account and Loyalty Programme Data: Username, password (encrypted), membership number, points balance, reward redemption history, and account preferences.
• Communications Data: Records of correspondence, emails, telephone calls (where recorded with prior notice), feedback, complaints, and survey responses.
• Marketing Preferences: Your choices and preferences regarding receiving marketing communications from us, including opt-in and opt-out records.
• Employment Application Data: Curriculum vitae, cover letters, employment history, qualifications, references, and any information you voluntarily provide during an application process.

4.2 Data We Collect Automatically

• Technical Data: IP address, browser type and version, operating system, device identifiers, time zone setting, browser plug-in types and versions, and other technology identifiers on the devices you use to access our Website.
• Usage Data: Information about how you use our Website, including pages visited, links clicked, search terms entered, referral sources, session duration, and click-stream data.
• Cookie Data: Data collected through cookies, web beacons, pixels, and similar tracking technologies. Please refer to our Cookie Policy for full details on how we use cookies.
• Location Data: Approximate geographic location derived from your IP address. Precise location data is only collected with your explicit consent.

4.3 Data We Receive from Third Parties

• Booking Platforms and Travel Agents: Reservation details forwarded by online travel agencies, booking platforms, or corporate travel management companies acting on your behalf.
• Payment Processors: Transaction confirmation and payment verification data from our authorised payment service providers.
• Identity Verification Providers: Results of identity checks conducted for AML compliance, responsible gambling verification, or age verification purposes.
• Social Media Platforms: Profile information you make publicly available or share with us when interacting through social media.
• Analytics Providers: Aggregated and pseudonymised data about Website usage patterns.
• Publicly Available Sources: Information obtained from public registers, credit reference agencies, or other lawfully accessible public sources where necessary.

4.4 Special Categories of Personal Data

In limited circumstances, we may process special categories of personal data as defined under Article 9 of the GDPR. This may include:

• Health and Disability Data: Where you inform us of a disability, health condition, or dietary requirement (including allergy information) to enable us to provide appropriate accommodations and services.
• Responsible Gambling Data: Information about gambling behaviour where processing is necessary to protect your vital interests or comply with regulatory obligations.

We process special category data only where we have a valid legal basis under Article 9 GDPR, such as your explicit consent, protection of vital interests, or a legal obligation. We apply heightened protection measures to such data.

5. Legal Basis for Processing

We process your personal data only where we have a valid legal basis for doing so, in accordance with Article 6 of the GDPR. The legal bases we rely upon are described below:

5.1 Performance of a Contract (Article 6(1)(b) GDPR)

We process your personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract. This includes:

• Processing hotel reservations and managing your stay;
• Processing payments for accommodation, dining, and casino services;
• Managing your loyalty programme membership and associated benefits;
• Providing customer support and responding to service-related enquiries.

5.2 Compliance with a Legal Obligation (Article 6(1)(c) GDPR)

We process your personal data where it is necessary to comply with a legal obligation to which we are subject. This includes:

• Compliance with anti-money laundering (AML) and counter-terrorism financing (CTF) legislation;
• Fulfilling mandatory identity verification requirements for casino patrons;
• Compliance with responsible gambling regulations and self-exclusion obligations;
• Maintaining financial records and reporting obligations to tax and regulatory authorities;
• Responding to lawful requests from law enforcement agencies or regulatory bodies;
• Health and safety obligations.

5.3 Legitimate Interests (Article 6(1)(f) GDPR)

We process your personal data where it is necessary for the purposes of our legitimate interests or those of a third party, provided that such interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include:

• Improving and personalising the services and experience we offer to guests;
• Operating, maintaining, and securing our Website and IT systems;
• Conducting fraud prevention and security monitoring, including CCTV surveillance on our premises;
• Sending direct marketing communications to existing customers regarding similar products and services (subject to your right to object at any time);
• Analysing Website usage to improve functionality and user experience;
• Managing and resolving complaints and disputes;
• Conducting internal audits and business planning;
• Protecting the rights, property, and safety of our business, staff, and guests.

Where we rely on legitimate interests, we conduct a balancing test to ensure our interests do not override your rights. You have the right to object to processing based on legitimate interests at any time.

5.4 Consent (Article 6(1)(a) GDPR)

Where required by law, or where we consider it appropriate, we will ask for your explicit consent before processing your personal data. We rely on consent for:

• Sending newsletters and promotional marketing communications where you are not an existing customer;
• Placing non-essential cookies and similar tracking technologies on your device;
• Sending personalised offers based on detailed profiling of your preferences;
• Processing special category data, such as health or disability information, where no other legal basis applies.

Where we rely on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal. To withdraw consent, please contact us using the details in Section 12.

5.5 Vital Interests (Article 6(1)(d) GDPR)

In exceptional circumstances, we may process personal data where it is necessary to protect the vital interests of you or another person, for example in a medical emergency situation on our premises.

5.6 Public Task (Article 6(1)(e) GDPR)

We may, where applicable, process personal data in the performance of a task carried out in the public interest or in the exercise of official authority, to the extent required by applicable law.

6. How We Use Your Personal Data

We use the personal data we collect for the following specific purposes:

6.1 Reservation and Accommodation Management

• Processing, confirming, and managing hotel reservations;
• Communicating pre-arrival, in-stay, and post-stay information;
• Arranging special requests, accessibility accommodations, and personalised preferences;
• Processing check-in and check-out procedures;
• Managing invoicing and billing for accommodation and ancillary services.

6.2 Casino and Gaming Operations

• Verifying the identity and age of casino patrons as required by law;
• Maintaining gaming activity records for regulatory compliance;
• Implementing and monitoring responsible gambling measures, including self-exclusion lists;
• Conducting AML and CTF checks on casino transactions;
• Processing winnings, credits, and loyalty rewards;
• Reporting to gaming regulatory authorities as required by applicable legislation.

6.3 Payment Processing

• Processing and authorising payments for all services;
• Handling refunds, chargebacks, and payment disputes;
• Detecting and preventing fraudulent transactions;
• Maintaining financial records as required by law.

6.4 Customer Communications and Support

• Responding to enquiries, feedback, and complaints;
• Providing customer support via telephone, email, or live chat;
• Sending transactional communications related to your reservation or account;
• Notifying you of changes to our services, policies, or terms.

6.5 Marketing and Promotional Activities

• Sending newsletters, special offers, and promotional communications (where you have provided consent or we have a legitimate interest as an existing customer);
• Personalising marketing messages based on your preferences and previous interactions with us;
• Administering prize draws, competitions, and loyalty programme promotions;
• Conducting customer satisfaction surveys and market research.

You may opt out of receiving marketing communications at any time by clicking the "unsubscribe" link in any marketing email, by updating your account preferences, or by contacting us directly.

6.6 Website and Service Improvement

• Analysing Website traffic, usage patterns, and user behaviour to improve functionality;
• Testing new features and services prior to launch;
• Maintaining the technical security and performance of our Website and systems;
• Troubleshooting technical issues and providing IT support.

6.7 Security, Fraud Prevention, and Compliance

• Monitoring for fraudulent, suspicious, or illegal activity on our premises and online;
• Operating CCTV systems for the security of our guests, staff, and property;
• Conducting internal audits and compliance reviews;
• Responding to law enforcement requests and regulatory enquiries;
• Exercising or defending legal claims.

6.8 Employment and Recruitment

• Processing job applications and assessing candidate suitability;
• Conducting background checks where required and permitted by law;
• Communicating with applicants throughout the recruitment process;
• Maintaining records of unsuccessful applications for a limited period for future opportunities (with consent where required).

7. Sharing of Personal Data

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. However, we may share your personal data with the following categories of recipients where necessary and under appropriate safeguards:

7.1 Service Providers and Data Processors

We engage trusted third-party service providers to assist us in delivering our services. These providers process your data on our behalf, under contractual obligations to protect your data and act only on our documented instructions. Categories of service providers include:

• Payment processing and fraud prevention providers;
• Cloud hosting, IT infrastructure, and cybersecurity service providers;
• Hotel property management system (PMS) and reservation platform providers;
• Casino gaming system and player management platform providers;
• Email marketing and communication platform providers;
• Customer relationship management (CRM) system providers;
• Identity verification and AML screening providers;
• Analytics and Website optimisation providers;
• Printing and postal service providers;
• Legal, accounting, and professional advisory service providers.

7.2 Business Partners

We may share your data with carefully selected business partners who assist in providing services you have requested, such as:

• Online travel agencies and booking platforms through which you made a reservation;
• Corporate travel management companies acting on behalf of your employer;
• Event management companies for conferences or functions hosted at our premises;
• Concierge and local experience providers (shared only with your consent or to fulfil a specific request).

7.3 Regulatory and Law Enforcement Authorities

We may disclose personal data to competent authorities where required or permitted by law, including:

• Gaming regulatory authorities and licensing bodies;
• Financial intelligence units and AML regulatory bodies;
• Tax authorities, including the Canada Revenue Agency (CRA);
• Law enforcement agencies, courts, and other public authorities in response to lawful requests or legal proceedings;
• Health and safety regulators.

7.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, sale of assets, or similar corporate transaction, your personal data may be transferred to the relevant parties as part of that transaction. We will notify you of any such transfer and any material changes to the processing of your personal data.

7.5 International Transfers of Personal Data

Some of our service providers and partners may be located outside the European Economic Area (EEA) or outside Canada. Where we transfer personal data internationally, we ensure that appropriate safeguards are in place, in accordance with Chapter V of the GDPR and applicable Canadian data protection law. Such safeguards may include:

• Transfer to countries recognised by the European Commission as providing an adequate level of data protection;
• Use of Standard Contractual Clauses (SCCs) approved by the European Commission;
• Binding Corporate Rules (BCRs) where applicable;
• Other legally recognised transfer mechanisms.

You may request a copy of the relevant safeguards applicable to international transfers of your data by contacting us at the details provided in Section 12.

8. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data, and whether we can achieve those purposes through other means.

The following general retention periods apply to the main categories of personal data we process:

Upon expiry of the applicable retention period, personal data is securely deleted, anonymised, or pseudonymised so that it can no longer be attributed to an identified or identifiable individual.

9. Your Rights Under the GDPR

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data. We will respond to all valid requests within one calendar month, which may be extended by a further two months in complex or high-volume cases, with prior notification to you.

9.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation of whether we process personal data about you, and if so, to request access to that data and to receive a copy of the personal data we hold, along with information about how it is used.

9.2 Right to Rectification (Article 16 GDPR)

You have the right to request the correction of inaccurate personal data we hold about you, and the completion of incomplete personal data, without undue delay.

9.3 Right to Erasure ("Right to be Forgotten") (Article 17 GDPR)

You have the right to request the deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing and there are no overriding legitimate grounds. This right is not absolute and may be limited by legal obligations requiring us to retain certain data.

9.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data, or where you object to processing and we are considering whether our legitimate interests override your rights.

9.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transmit that data directly to another controller where technically feasible.

9.6 Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data where such processing is based on our legitimate interests (Article 6(1)(f)). You also have an unconditional right to object to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing, at any time and without providing any justification.

9.7 Rights Related to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such processing is necessary for entering into or performing a contract, is authorised by law, or is based on your explicit consent. Where automated decision-making applies, you have the right to obtain human intervention, express your point of view, and challenge the decision.

9.8 Right to Withdraw Consent (Article 7(3) GDPR)

Where we process your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9.9 How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to us using the contact details set out in Section 12 of this Privacy Policy. We may need to verify your identity before processing your request to ensure the security of your personal data. We will not charge a fee for processing your request unless the request is manifestly unfounded or excessive.

9.10 Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR or other applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. In Canada, you may contact the Office of the Privacy Commissioner of Canada:

• Office of the Privacy Commissioner of Canada
• 30 Victoria Street, Gatineau, Quebec, K1A 1H3, Canada
• Telephone: 1-800-282-1376
• Website: www.priv.gc.ca

If you are located in the European Economic Area, you may also have the right to contact the data protection supervisory authority in your country of residence. We encourage you to contact us first so that we may address your concern directly.

10. Cookies and Tracking Technologies

Our Website uses cookies and similar tracking technologies to enhance your browsing experience, analyse Website traffic, and deliver relevant content and advertising. Cookies are small text files placed on your device when you visit a website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of our Website and to enable core functionality such as secure login, reservation management, and payment processing. These cookies cannot be disabled.
• Functional Cookies: Enable enhanced functionality and personalisation, such as remembering your preferences and language settings. These cookies may be set by us or third-party providers whose services we use.
• Performance and Analytics Cookies: Allow us to count visits, measure traffic sources, and understand how users interact with our Website in order to improve its performance. All data collected is aggregated and anonymised where possible.
• Targeting and Advertising Cookies: Used to deliver advertisements relevant to your interests, and to track the effectiveness of our marketing campaigns. These cookies may be set by our advertising partners.

With the exception of strictly necessary cookies, all cookies require your prior consent, which we obtain through our cookie consent banner when you first visit our Website. You may update your cookie preferences at any time through the cookie settings tool available on our Website, or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of our Website.

11. Data Security

We implement appropriate technical and organisational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 of the GDPR. These measures include:

• Encryption of personal data in transit using Secure Socket Layer (SSL) / Transport Layer Security (TLS) technology;
• Encryption of sensitive data at rest;
• Access controls limiting access to personal data to authorised personnel on a need-to-know basis;
• Multi-factor authentication for access to systems containing personal data;
• Regular security assessments, penetration testing, and vulnerability scanning;
• Staff training on data protection and information security awareness;
• Documented incident response and data breach notification procedures;
• Physical security controls at our premises, including CCTV and access restrictions.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and will notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms, in accordance with Articles 33 and 34 of the GDPR.

While we take every reasonable step to protect your personal data, please be aware that no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of data transmitted to our Website.

12. Children's Privacy

Our Website and casino services are not directed at children under the age of 18. We do not knowingly collect personal data from individuals under the age of 18. Persons under 18 are prohibited from accessing or using our casino facilities, in accordance with applicable gaming laws.

If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately using the details in Section 13. We will take prompt steps to delete such information from our records.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or the introduction of new services. When we make material changes, we will notify you by posting the updated Privacy Policy on this page with a revised "Last Updated" date, and where appropriate, by sending you an email notification or displaying a prominent notice on our Website.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data. Your continued use of our Website or services after the publication of an updated Privacy Policy constitutes your acknowledgement of the changes.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your personal data, please do not hesitate to contact us using the details below. We are committed to addressing your enquiries promptly and transparently.

We aim to respond to all written enquiries within 30 days of receipt. Where your request is particularly complex or you have submitted multiple requests, we may extend this period by up to two further months, and will notify you accordingly within the initial 30-day period.