1. Data Controller

The entity responsible for the processing of your personal data (the "Data Controller") is:

As Data Controller, we determine the purposes and means of processing your personal data. We are accountable for ensuring that all processing activities comply with applicable data protection laws and that your rights are respected at all times.

2. Data Protection Officer (DPO)

We have appointed a Data Protection Officer who is responsible for overseeing our data protection strategy and ensuring compliance with data protection legislation. You may contact our Data Protection Officer at any time regarding matters related to your personal data:

3. Personal Data We Collect

We collect personal data directly from you, automatically through your use of our website, and from third parties where applicable. The categories of personal data we process are as follows:

3.1 Identity and Contact Data

• Full name (first name, last name)
• Date of birth and age verification information
• Gender (where voluntarily provided)
• Nationality and passport or national identity card details (where legally required)
• Postal address (home and/or billing address)
• Email address
• Telephone and mobile phone numbers
• Profile photograph (where provided by you)

3.2 Booking and Reservation Data

• Room type preferences and special requests
• Check-in and check-out dates
• Number of guests and guest details
• Meal plan and dietary requirements or allergies
• Loyalty programme membership details
• Stay history and previous reservation records

3.3 Payment and Financial Data

• Credit card or debit card type and last four digits
• Billing address associated with payment methods
• Bank account details (where direct debit or wire transfer is used)
• Transaction history and invoices
• Refund and chargeback records

Please note: Full payment card numbers are processed exclusively by our certified Payment Card Industry Data Security Standard (PCI-DSS) compliant payment processors and are never stored on our systems.

3.4 Casino and Gaming Data

• Government-issued identification documents for age verification and anti-money laundering (AML) compliance
• Gaming account registration information
• Gaming activity records, including session data, wagering history, wins, and losses
• Responsible gambling self-exclusion requests and programme participation
• Source of funds documentation (where required by law)
• Player loyalty card data

3.5 Technical and Usage Data

• Internet Protocol (IP) address
• Browser type, version, and settings
• Operating system and device type
• Pages visited, clickstream data, and time spent on pages
• Referring URLs and search terms
• Cookie identifiers and session tokens (see our Cookie Policy for further details)
• Log files and error reports

3.6 Communications Data

• Records of communications you have sent to us via email, contact forms, live chat, or telephone
• Feedback, survey responses, and reviews
• Marketing preferences and subscription status
• Complaints and dispute correspondence

3.7 Special Categories of Personal Data

In certain limited circumstances, we may process special categories of personal data as defined under Article 9 GDPR. These include:

• Health data: Dietary requirements, allergies, and accessibility needs disclosed to us for the purpose of providing appropriate services or accommodation adjustments.
• Biometric data: Facial recognition or fingerprint data used for venue access control, where separately consented to and permitted by law.

We process special category data only where you have given explicit consent, or where processing is necessary for reasons of substantial public interest, or to protect your vital interests, all in accordance with Article 9(2) GDPR.

3.8 Data Collected from Third Parties

• Booking data received from online travel agencies (OTAs) such as Booking.com, Expedia, and similar platforms
• Social media profile data where you log in or interact with our services via social media platforms
• Publicly available information used for fraud prevention purposes
• Data from credit reference or identity verification agencies

4. Legal Basis for Processing

We process your personal data only where we have a lawful basis to do so. In accordance with Article 6 of the GDPR, we rely on the following legal bases:

4.1 Performance of a Contract (Article 6(1)(b) GDPR)

We process your personal data where it is necessary to enter into or perform a contract with you. This includes:

• Processing your hotel room reservation and managing your stay
• Processing payments for accommodation, dining, spa, and casino services
• Administering your loyalty programme membership
• Responding to your pre-booking enquiries
• Managing cancellations, amendments, and refunds

4.2 Compliance with a Legal Obligation (Article 6(1)(c) GDPR)

We process your personal data where we are required to do so by law. This includes:

• Age verification obligations under Australian casino and gaming regulations
• Anti-money laundering (AML) and counter-terrorism financing (CTF) checks required under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
• Guest registration requirements under accommodation and tourism legislation
• Responding to lawful requests from regulatory authorities, law enforcement agencies, or courts
• Tax, accounting, and financial reporting obligations
• Responsible gambling obligations under applicable gambling legislation

4.3 Legitimate Interests (Article 6(1)(f) GDPR)

We process your personal data where it is in our legitimate interests to do so, provided those interests are not overridden by your rights and interests. Our legitimate interests include:

• Preventing fraud, cheating, and other unlawful activity within our premises and online platforms
• Improving the security and integrity of our website and IT infrastructure
• Conducting analytics and research to improve our services and guest experience
• Direct marketing of our own similar products and services to existing customers (subject to your right to opt out)
• Enforcing our terms and conditions and protecting our legal rights
• Training our staff using anonymised or aggregated data
• Managing and administering our business operations efficiently

Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment (LIA) to ensure that our interests do not unfairly override your fundamental rights and freedoms.

4.4 Consent (Article 6(1)(a) GDPR)

In certain circumstances, we will ask for your explicit consent before processing your personal data. This applies to:

• Sending you promotional emails, newsletters, or SMS marketing communications from us or selected partners
• Placing non-essential cookies and tracking technologies on your device
• Processing special category data such as biometric identifiers or sensitive health information beyond what is required for service delivery
• Sharing your data with third-party marketing partners

Where we rely on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact us at privacy@sorelviagrandcourt.com or use the unsubscribe link included in our marketing communications.

4.5 Protection of Vital Interests (Article 6(1)(d) GDPR)

We may process personal data where it is necessary to protect the vital interests of you or another individual. This may arise in medical emergency situations occurring on our premises.

4.6 Public Task (Article 6(1)(e) GDPR)

Where applicable under relevant laws, we may process personal data in the exercise of a task carried out in the public interest or in the exercise of official authority, including cooperation with gaming regulators and law enforcement bodies.

5. How We Use Your Personal Data

We use the personal data we collect for the following specific purposes:

5.1 Hotel and Accommodation Services

• To process, confirm, and manage your room reservations and related services
• To facilitate check-in and check-out procedures
• To personalise your stay based on your preferences and prior history
• To process payment transactions and issue invoices and receipts
• To manage your requests for concierge, housekeeping, and other in-stay services
• To administer our guest loyalty and rewards programme

5.2 Casino and Gaming Services

• To verify your identity and age in compliance with gaming regulations
• To create and manage your gaming account
• To conduct Know Your Customer (KYC) and AML checks
• To record gaming activity for regulatory reporting purposes
• To administer responsible gambling programmes, self-exclusion registers, and problem gambling interventions
• To detect and prevent cheating, fraud, and collusion
• To manage the distribution of winnings and jackpots

5.3 Customer Service and Communications

• To respond to your enquiries, complaints, and support requests
• To send you booking confirmations, pre-arrival information, and post-stay follow-ups
• To notify you of changes to your reservation, our services, or this Privacy Policy
• To conduct guest satisfaction surveys and collect feedback

5.4 Marketing and Promotional Activities

• To send you marketing communications about our offers, events, and services (subject to your marketing preferences)
• To display relevant advertising on third-party platforms using anonymised or hashed data
• To analyse the effectiveness of our marketing campaigns
• To administer prize draws, competitions, and promotional events

5.5 Security, Safety, and Fraud Prevention

• To operate CCTV surveillance systems across our premises for the safety and security of guests and staff
• To monitor and investigate suspicious activity, fraud, and criminal behaviour
• To protect the integrity and security of our IT systems and website
• To manage access control to restricted areas of the hotel and casino

5.6 Legal and Regulatory Compliance

• To comply with our obligations under applicable laws and regulations
• To cooperate with governmental authorities, regulators, and law enforcement agencies
• To establish, exercise, or defend legal claims
• To maintain accurate financial, tax, and audit records

5.7 Business Analytics and Improvement

• To analyse usage patterns and trends on our website and booking platform
• To conduct internal research and business intelligence activities
• To improve the functionality, content, and user experience of our website
• To develop new services and product offerings

6. Sharing of Personal Data

We do not sell your personal data. We may, however, share your personal data with carefully selected third parties in the following circumstances:

6.1 Service Providers and Data Processors

We engage third-party service providers who process personal data on our behalf and under our instructions. These include:

• Payment processors: To securely process credit card and other payment transactions
• IT and cloud service providers: For website hosting, data storage, and system maintenance
• Reservation management system providers: To manage hotel bookings and property operations
• Email and communication platforms: To deliver transactional and marketing communications
• Customer relationship management (CRM) system providers
• Identity verification and KYC service providers: For age verification and AML compliance
• Analytics and web optimisation providers
• Cybersecurity and fraud prevention firms

All service providers are required to sign appropriate data processing agreements and to implement adequate technical and organisational security measures to protect your personal data.

6.2 Online Travel Agencies and Booking Platforms

Where you make a reservation through a third-party booking platform such as Booking.com, Expedia, or Hotels.com, we may share or receive your reservation data with or from those platforms in order to fulfil your booking. Those platforms process your data in accordance with their own privacy policies.

6.3 Regulatory and Law Enforcement Authorities

We may disclose your personal data to government authorities, gaming regulators (such as the ACT Gambling and Racing Commission), tax authorities, law enforcement agencies, or courts where we are legally required or permitted to do so. This includes:

• Disclosure required under AML and CTF legislation
• Responses to court orders, subpoenas, or other legal process
• Reporting obligations under gaming and casino regulations
• Cooperation with police or other law enforcement investigations

6.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, asset sale, or other corporate transaction involving , your personal data may be transferred to the relevant acquiring or surviving entity. We will notify you of any such transfer and ensure that appropriate protections are in place.

6.5 Business Partners

Where you have provided your consent, we may share your personal data with our trusted business partners, including partner restaurants, spas, tour operators, and entertainment providers, for the purpose of offering you additional services during your stay or visit.

6.6 International Data Transfers

is based in Australia. Some of our service providers and technology partners may be located in countries outside of Australia and, where applicable, outside of the European Economic Area (EEA). Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, including:

• Transfer to countries recognised by the European Commission as providing an adequate level of data protection
• Use of Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules or other legally approved transfer mechanisms
• Compliance with the Australian Privacy Principles regarding overseas disclosure

You may request further information about international data transfers and the safeguards in place by contacting us at privacy@sorelviagrandcourt.com.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal, regulatory, and contractual obligations, and to resolve disputes. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised, or archived in accordance with our internal data retention and destruction procedures. Where data is anonymised, it may be retained indefinitely for statistical and analytical purposes, as anonymised data is no longer considered personal data under applicable law.

8. Your Rights as a Data Subject

Subject to applicable law, you have the following rights in relation to your personal data. These rights apply under the GDPR and, to the extent they are recognised, under Australian privacy law. We will respond to any valid request within 30 days of receipt, though we may extend this period by a further two months where requests are complex or numerous, and will notify you accordingly.

8.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we process personal data about you and, if so, to receive a copy of that data along with information about how it is processed, the purposes of processing, the categories of data concerned, recipients, retention periods, and your other rights.

8.2 Right to Rectification (Article 16 GDPR)

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you without undue delay.

8.3 Right to Erasure / "Right to be Forgotten" (Article 17 GDPR)

You have the right to request that we delete your personal data where:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis for processing
• You object to processing based on legitimate interests and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

Please note that this right is subject to exceptions, particularly where processing is necessary to comply with a legal obligation or for the establishment, exercise, or defence of legal claims.

8.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, including while we verify the accuracy of data you have contested, or while we assess an objection you have raised.

8.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or the performance of a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

8.6 Right to Object (Article 21 GDPR)

You have the right to object to the processing of your personal data where we rely on legitimate interests or public task as our legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

You have an unconditional right to object at any time to the processing of your personal data for direct marketing purposes, including profiling carried out for direct marketing. Upon receipt of such an objection, we will immediately cease processing your data for those purposes.

8.7 Rights in Relation to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you. Where we engage in such processing, we will ensure that appropriate human oversight is available and that you can request human review of any automated decision.

8.8 Right to Withdraw Consent

Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to withdrawal. To withdraw your consent, please email privacy@sorelviagrandcourt.com or use the opt-out mechanisms provided in our communications.

8.9 Right to Lodge a Complaint

If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority:

• For Australian residents: The Office of the Australian Information Commissioner (OAIC)
  Website: www.oaic.gov.au
  GPO Box 5218, Sydney NSW 2001, Australia
• For EU/EEA residents: Your local data protection authority. A list of EU supervisory authorities is available on the European Data Protection Board website at www.edpb.europa.eu.

We encourage you to contact us first at privacy@sorelviagrandcourt.com so that we have the opportunity to resolve any concerns directly.

8.10 How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to:

• Email: privacy@sorelviagrandcourt.com
• Postal Address: The Data Protection Officer, ,

We may ask you to verify your identity before processing your request. This is to ensure that personal data is not disclosed to or amended by an unauthorised person. We will process your request free of charge, unless your request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee or decline to respond, with written explanation.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse traffic, and deliver personalised content and advertising. Cookies are small text files placed on your device when you visit our website.

We use the following types of cookies:

• Strictly necessary cookies: Essential for the operation of our website and cannot be switched off. No consent is required for these cookies.
• Performance and analytics cookies: Allow us to count visits and measure traffic sources to improve website performance. Consent is required.
• Functional cookies: Enable enhanced functionality and personalisation, such as remembering your preferences. Consent is required.
• Targeting and advertising cookies: Set by our advertising partners to build a profile of your interests and deliver relevant ads. Consent is required.

You can manage your cookie preferences at any time by clicking on the Cookie Settings link on our website footer or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more detailed information, please refer to our dedicated Cookie Policy, available on our website.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption of data in transit using Transport Layer Security (TLS) protocol
• Encryption of sensitive data at rest
• Access controls and role-based permissions limiting access to personal data to authorised personnel only
• Regular security assessments, vulnerability scans, and penetration testing
• Multi-factor authentication for systems that process personal data
• Staff training and awareness programmes on data protection and information security
• Incident response and data breach notification procedures
• PCI-DSS compliant payment processing infrastructure

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach and, where required, will notify you without undue delay.

11. Children's Privacy

Our casino services are strictly prohibited to persons under the age of 18 years. Our website and digital services are not directed at children under the age of 16 years, and we do not knowingly collect personal data from children. If you are under 16, please do not use our website or submit any personal data to us.

If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take immediate steps to delete that data. If you believe we may have collected personal data from or about a child, please contact us at privacy@sorelviagrandcourt.com.

12. Third-Party Websites and Links

Our website may contain links to third-party websites, social media platforms, or external booking services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party websites you visit, as those sites process your personal data independently and in accordance with their own policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing activities, legal requirements, or business operations. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page
• Display a prominent notice on our website
• Where required, notify you directly via email

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website or services following the posting of an updated Privacy Policy constitutes your acknowledgement of the revised terms.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us using any of the following methods:

We are committed to working with you to resolve any concerns about your privacy promptly and transparently. We aim to acknowledge all privacy enquiries within 5 business days and to provide a substantive response within 30 days of receipt.