1. Privacy and personal data protection policy

In accordance with the Spanish Data Protection Act 15/1999 of 13 December (hereinafter the LOPD) and Royal Decree 1720/2007 of 21 December approving the LOPD (hereinafter the RDLPOD), Sociedad Estatal Loterías y Apuestas del Estado, S.A. (hereinafter SELAE) with registered address at C/ Capitán Haya 53, 28020 Madrid, wishes to inform the user of the website www.loteriasyapuestas.es of its policy regarding the protection of personal data pertaining to those persons who voluntarily communicate with SELAE via the channels indicated in this website, fill in data gathering forms or use any other service present on the website that involves the communication of their personal data to SELAE, including -but not restricted to- signing up on the site and participating in SELAE games online.

SELAE undertakes to uphold the privacy of the personal data of the users of the gaming services available on this site, the payment of prizes and economic transactions made by adhering to the specifications of the LOPD, the gaming regulations in force and any other standards complementing these.

SELAE informs the user of the website, that this privacy policy covers all matters relating to the treatment of personal data by SELAE through this website. If the user "after reading this document continues to browse and use the web services herein, he/she shall be expressly manifesting his/her acceptance of this privacy and personal data treatment policy. Otherwise the user should abandon the website. Similarly, the user is informed that these conditions shall be applied subject to any such other specific conditions that may be established and notified to the user -without limitations- on user registration and gaming contract forms, rendering these conditions complementary to those specific terms in the event of contradiction.

SELAE informs that user that any treatment of personal data shall be in accordance with the prevailing data protection laws in Spain as established in the LOPD, the RDLOPD and any legislation complementary thereto or expanding thereupon, as well as gambling legislation, fundamentally comprising Law 13/2011 of 27 May regulating gambling and corresponding regulations (including Royal Decree 1613/2011 of 14 November, which develops Law 13/2011 of 27 Mayon gambling regulation with regard to the technical requirements of gambling activities; Royal Decree 1614/2011 of 14 November which develops Law 13/2011 regulating gambling matters pertaining to licences, authorisations and gambling registers; the Spanish National Gaming Authority Resolution of 16 November 2011, which approves the provision pertaining to the technical specifications to be met by technical gambling systems with licences granted under Law 13/2011 of 27 May on gambling regulations; the Spanish National Gaming Authority Resolution of 16 November 2011 which establishes the responsible gaming test and conditions for the prevention of gambling addiction, in accordance with article 36 of Royal Decree 1614/2011 of 14 November, which develops Law 13/2011 of 27 May on gambling regulations, regarding licences, authorisations and gambling registers.

For these purposes, personal data without limitations shall be understood to be any information pertaining to identified or identifiable private individuals "including their e-mail address and/or IP address in the event that interested parties are identified inequivocally- and the user shall be understood to be any identified or identifiable private individual that communicates his/her personal details to SELAE via communication channels with SELAE, such as SMS, e-mail, telephone, data gathering forms, registration or signup and/or in any event use of any service on the website that involves communicating personal data to SELAE and/or any other form of communication of data thereto.

2. Identification of registered activity of file manager

SELAE informs the website user of the existence of certain personal data processing and data files which are the responsibility of Sociedad Estatal Loterías y Apuestas del Estado, S.A., (SELAE), with registered offices at C/ Capitán Haya 53, 28020 Madrid, where the personal data that users communicate to SELAE via the website and other communication channels contained therein are gathered and stored

3. Purposes for which personal data shall be used

Users who merely browse through the SELAE website are not required to provide personal information in order to use the site. Therefore, any communication of data will be informed because the user has voluntarily decided to browse or use the services on a personalised basis and take part in a gaming activity.

Notwithstanding, in the event that the user is interested in accessing specific services requiring registration, such as taking part in games sold online and/or signing up for SELAE information, and contacting SELAE, must fill in the personal data forms or fulfil other user registration conditions for the corresponding use of services and the online gaming contract. Without prejudice to these conditions, the conditions to be applied preferrably shall be the data treatment conditions established in each case and notified by SELAE to the user on the registration form and/or in the gaming contract, or, if applicable, the conditions of other private services and these policies are complementary and of subsidiary application to the former in the event of a contradiction in terms.

SELAE does not ask the user for especially protected details, which in accordance with articles 7 and 8 of the LOPD are those details relating to race or ethnicity, religious creed, criminal record, physical or mental state of health or sexual orientation.

4. Information and consent

When the user does not have a legal relationship with SELAE he/she shall take into account and shall be informed that any personalised communication that the user may send to SELAE through any means implies or conveys that he/she grants his/her express and informed consent freely, inequivocally and specifically for the treatment of his/her personal details by SELAE in order to serve him/her and send information that may be asked of SELAE.

In those cases in which the user requests or uses any of the specific web services and/or plays or takes part in the online games on this site, all data supplied in each case shall be dealt with on the basis of the service requested or used and the gaming activity carried out by the user, so as to manage these services and allow for the operational and/or commercial management of the games in accordance with the regulations applicable and the terms and conditions of each one. Similarly, when the user has requested and/or consented to the sending of information on gaming services and/or additional services, and/or commercial and/or advertising from SELAE, their details are only used for these purposes.

Specifically, user participation in the online games on this site shall imply -in unlimited terms- for the operational management of the game, the treatment of their personal details for the following purposes: user registration needed to allow access to play games on this website; identification of the user to verify that he/she is not subject to any of the subjective bans set forth in prevailing gaming regulations; management of the gaming account opened by the user and linked to the user account into which any prize winnings are paid and against which the amounts payable for participation in games are charged; management and processing of the gaming account which the user must adhere to if he/she is to take part in games on the site; fraud control and verification of compliance with gaming regulations in force. In any event, all users playing on this website are informed of the following:

• True, accurate and updated information must be provided for which the user is answerable and committed to keeping duly up-to-date. All personal details provided must be consistent with those of the actual user
• Personal data communication for the purposes of managing online gambling shall be included into a personal data file which is the responsibility of SELAE and which is used for the purposes of the operational management of the games, including sending service notifications and those other purposes outlined in this clause, as well as any other purpose duly informed to the participants. This file shall store, among other data, information relevant to operations regarding user registrations and game registrations, including the opening of accounts and the data provided by the participant, the acceptance of terms and conditions, the modification of account parameters, economic movements, income and payments on the gaming account and account closures.
• Providing the personal details required during the registration process and adhering to the gaming contract is mandatory in order to play SELAE games.
• Providing personal details for the purposes of receiving information on other services and/or commercial and/or other items/services is on a voluntary basis. If the user does not wish to provide personal data for treatment by SELAE for this purpose, the user must not fill in the corresponding forms on the website. If personal details are gathered, they are placed in a personal data file which is the responsibility of SELAE and is used purely to provide these services and information

Based on the above, if the user does not agree to the treatment of his/her personal details by SELAE, he/she must refrain from communicating or sending his/her personal details to SELAE via any means including, but not limited to, e-mail, registration and e-mail subscription, adhesion to the gaming contract, filling in forms, and limit him/herself to browsing anonymously on the website. He/she must also refrain from playing on the site.

Personal details shall be used for limited purposes, as stated heretofore and/or in unlimited terms, cases in which users are informed in advance and inequivocally that their information is being gathered for treatment. Within the context of the rendering of services and contents offered via the website, SELAE may request pesonal details from the website user at any time through forms for filling out or by other means. In these cases, SELAE shall include a notification in the data gathering form stating all the conditions for personal data treatment in accordance with article 5 of the Spanish Data Protection Act (LOPD), such as highlighting which fields are mandatory, the consequences of obtaining data or refusal to supply data, the purposes of gathering the data, the possible transfers of data that may be performed and, if applicable, SELAE shall request user consent.

 

5. Shipment of electronic communications

SELAE can send the user two types of communications: Those service notifications that are mandatory for participation in games; and those commercial nofications about games and/or commercial information on products and services offered by SELAE, and other additional services. Service communications are sent to users who play on the website and other types of communications, including commercial communications, are only sent to those users who have expressly requested this of SELAE in the registration process or at another time.

Accepting the sending of commercial information and/or advertising is completely voluntary and shall not be a mandatory condition for taking part in the games. Service communications on the other hand are mandatory. All service communications with the user in relation to participation in games shall be via e-mail or text message, except in exceptional cases wherein other channels may be used. In those cases, the identity of the message recipient shall have to be verified.

The user registered on the website may sign up to or deregister from the additional notifications service (including commercial notifications) at any time, free of charge by selecting the corresponding option in his/her personal account on the website, on the page My account, sending a dereg e-mail to the address cau-lopd@loteriasyapuestas.es with the subject line "BAJA COMUNICACIONES COMERCIALES" or by using the other channels available for exercising these rights.

6. Identification of recipients with respect to whom SELAE intends to transfer or communicate data

SELAE plans to grant or notify personal data in accordance with article 11.2c. of the Spanish Data Protection Act In addition, the user is informed that his/her personal details shall be notified where necessary to carry out management and development of gaming activity, which includes notifications to banking entities for collection purposes and, where applicable, the payment of prizes. Furthermore, in the case of prizes in excess of 5,000 euros it is legally required to notify the Spanish Tax Authorities (AEAT).

Moreover, your personal details may be notified to the Spanish National Gaming Authority or the National Gambling Commission, where applicable, in its capacity as Regulatory Body governing the gambling sector and responsible for auditing, surveillance, inspection and monitoring of all aspects and administrative, economic, procedural, technical, IT, telematic and documentary standards, as well as the functions of investigation and prosecution of illegal gambling. Specifically, whilst exercising the inspection and monitoring functions attributed thereto by Law, the Spanish National Gaming Authority or the National Gambling Commission may perform checks on the user account of the participant in games on this website and may access the personal details of the participant as stated in these accounts within the terms and conditions of prevailing data protection legislation.

For the purposes of controlling fraud and verifying compliance with gaming standards and the frequencies established in this regard by the Spanish National Gaming Authority, where necessary SELAE shall perform regular checks to ensure that the participant's user account is being used correctly, and shall notify the Spanish National Gaming Authority or the National Gambling Commission and the Sepblac (Anti-Money Laundering Service) of any possible violations or anomalies detected in its use as soon as these become known. We will also notify the Spanish National Gaming Authority or the National Gambling Commission of the identification details of those participants who may pose a risk of collusion or have fraudulently used credit cards in their gaming account.

Lastly, SELAE informs the user that any other transfer of data that it is required to make shall be notified to him/her where specified in the Spanish Data Protection Act and he/she will be informed expressly and inequivocally of the parties to whom such information shall be conveyed, the purpose thereof and the nature of the data conveyed, or if applicable, where specified by the Data Protection Act, his/her express, specific and informed consent shall be obtained in advance.

"

7. Other recipients of information

SELAE shall inform the user that this entity is solely responsible and guarantees the confidentiality, security and treatment of the data in accordance with this policy, with respect to the personal data gathered from the user through this website, without accepting any type of responsibility with regard to the treatments and subsequent uses of personal data that may be made by third parties rendering information services that could access these datails for the purposes of rendering their services or performing their activity. Third parties rendering services pertaining to the information society shall be understood -not exclusively- to be those private or legal entities rendering the following services: (i) Transmission via communication network of data provided by the service users. (ii) Services of access to the said network. (iii) Storage or content hosting services. (iv) Services entailing the providing of content or information. Similarly, SELAE does not accept responsibility for the treatment of data by third parties who establish hyperlinks to SELAE sites or those who are responsible for forwarding users to their website through SELAE hyperlinks. SELAE shall be responsible for managing, operating and developing this website by virtue of its functions as ""treatment manager"" in accordance with article 12 of the Spanish Data Protection Act and pursuant to its development regulations.

"

8. Data quality

SELAE informs the user that, unless there exists a legally established proxy, no user may use the identity of another person and communicate his/her personal details and, therefore, users must take into account at all times that, if they communicate personal data via any means to SELAE, they may only include personal details corresponding to their own identity which are suitable, relevant, current, accurate and true.

Thus, the user shall be the only person held responsible in the event of any direct or indirect damages caused to third parties or to SELAE as a result of the use of the personal details of another person or o their own details when these are false, not current, unsuitable or irrelevant.

Similarly, users communicating the personal details of a third party shall be responsible before the said party in the terms established in article 5.4 of the Spanish Data Protection Act in the event that the personal details have not been gathered from the interested party and/or for the consequences of not having informed the said party.

9. Prevention of Money Laundering and Fraud Monitoring

SELAE informs the user that SELAE is subject to Law 10/2010 of 28 April on the prevention of money laundering and terrorism financing insofar as it refers to the payment of prizes. SELAE is obliged, among other things, to examine any events or transactions that, due to their nature, could be related to money laundering or terrorism financing and is obliged to make such circumstances known to the authorities and competent bodies. Therefore, the personal details of prize-winning participants in excess of the established limit shall be dealt with in order to guarantee compliance with the law.

SELAE informs the user that the collaborating entities perform the necessary activities to preserve the participants and eliminate fraud.

10. Verification of the prevailing gaming legislation

SELAE informs the user that in accordance with the Spanish Gambling Act, Law 13/2011 of 27 May, there are certain subjective prohibitions that prevent certain persons from participating in the gaming activities offered on this website. SELAE is legally obliged to contrast the personal data provided by the participants in order to fulfil the participant confirmation and identity verification requirements established by law. For these purposes, SELAE may adopt appropriate measures to treat the personal data of users in order to prevent gaming fraud and the participation of the persons stated in the previous section. In any event, identifying the participant and verifying that he/she is not subject to any of the subjective bans is essential in order to collect any prizes won, regardless of the amount or nature thereof. Participants will be identified by SELAE through an unique active user register which records, at least, the necessary identification details to verify that none of the subjective bans referred to in this section applies. To ensure this, in the user signup process, before enabling the user account, and in the process of paying out prizes, SELAE must check the data contained in the user register off against the data recorded in the General Register of Banned Gamblers, in order to verify that the participant is not one the Register. At least once a year, SELAE will compare the data recorded on their user records against the General Register of Banned Gamblers, in accordance with the procedures established in this respect by the National Gaming Commission. Similarly, SELAE will adopt specific control measures with respect to those participants who have requested self-banning from a specific game. For the purposes set forth herein and at the intervals established by the National Gaming Commission, SELAE will perform regular checks on the proper use of participants' gaming accounts, notifying the National Gaming Commission and the SEPLAC Anti-Money Laundering Service of any possible violations or anomalies detected in account usage as soon as they become known. Similarly, SELAE will notify the National Gaming Commission of the identification details for those participants who may pose a risk of collusion or may have committed fraudulent use of credit cards in their gaming account.

11. Updating of details

The user is the only source of information for personal data and, hence, SELAE asks that in order to keep their details up to date at all times in accordance with the principles of the Data Protection Act, users notify SELAE of any change in their personal details. Such notifications can be addressed to the address given for exercising the right to access, rectify, cancel or oppose personal details.

11. Exercising the right to object to, access, rectify or cancel personal details

SELAE informs the user of their right to access, rectify, cancel or object to their personal data record, which can be done by the following means:

Customer Service Centre

• By post, addressed to: C/ Capitán Haya, 53, 28020 Madrid
• By phone, at 902112313
• By fax, at 915962560
• By e-mail: cau-lopd@loteriasyapuestas.es
• Via the user account on the website www.loteriasyapuestas.es

Exercising this right is exclusively personal, which means that the interested party can only do so by proving his her identity, via a legally-appointed proxy, in which case in will be necessary to prove such appointment as proxy, and/or via a voluntary representative expressly designated for the purposes of exercising this right.

In cases where users are represented, the identity of the represented user must be clearly proven by providing a copy of his/her official national ID card or equivalent identification document and the representation conferred by him/her.

In any event, communications sent to SELAE must clearly state the request or right being exercised.

 

12. Exercising right to object or revoke consent granted for receipt of communications associated to other services and/or commercial electronic communications

In accordance with articles 21.2 and 22.1 of the LSSICE (Spanish law on information society services and e-commerce), users are informed of their right to object to the treatment of their personal details for promotional purposes for the reception of commercial communications or additional services and their right to revoke their consent at any time, by providing a simple notification to this effect to SELAE. To do this, the user can address his/her objection by sending an e-mail to the following e-mail address: cau-lopd@loteriasyapuestas.es, with the subject line "LSSICE OBJECTION", and his/her right to revoke his/her consent and request to be removed from the commercial e-mail subscription by sending an e-mail to the same address with the subject line "UNREGISTER".

13. "Cookies" and "Beacons"

This website uses or may use both cookies and web beacons. In any event these elements doe not include any personal information, they are held temporarily in the memory of the user's computer and their only purpose is to maintain the user session. SELAE does not follow up or treat cookies or web beacons other than for aggregated statistical use (see Google Analytics). Most browsers allow users to opt out of cookies. It should be noted that in specific circumstances, access to certain parts of our website may be denied to those visitors or users whose browsers reject the use of web cookies. This website uses Google Analytics, an web analytical service provided by Google, Inc.: "a company located in Delaware with headquarters at 1600 Amphitheatre Parkway, Mountain View (California), CA 94043, USA ("Google")". Google Analytics uses cookies (text files located in the user's computer) to help the SELAE website to follow up the user's browsing throughout the website. According to Google, "The information generated by the cookie regarding your website usage (including your IP address) will be directly transmitted and filed by Google in its US servers. Google will use this information on our behalf for the purpose of tracking your use of the website, drawing up reports on the website's activity and providing other services related to the website's activity and the use of the Internet. Google may also share this information with third parties when required to do so by law, or if Google commissions the processing of this data by a third party. Google will never associate your IP address with any other data held by Google. You may reject the handling of the data or information, rejecting the use of cookies by changing your web browser settings. However, please be advised that if you do this, you may not be able to use the full functionality of this website. When using this website, be aware of the treatment of your personal information by Google in the manner and for the purposes stated above".

14. Security measures adopted in relation to treatment of personal data

SELAE informs the user that, in accordance with the Spanish Data Protection Act and the Royal Decree which enacts it, SELAE has adopted the necessary technical and organisational measures to guarantee the security of all personal data and avoid any alteration, loss, treatment or unauthorised access, taking into account the status of the technology, the nature of the data stored and the risks to which they are exposed, allbeit by human action or due to physical or national forces. Personal details will only be stored in files that meet the conditions set forth in the corresponding Standards with respect to their integrity and safety and those pertaining to data processing centres, premises, equipment, systems and programmes. Similarly, SELAE guarantees to the user that it shall comply with its duty to keep professional secrecy regarding their personal details and the duty to safeguard these.

15. Personal details published on the SELAE website

On occasion, some individuals consent to the publication of personal details on the SELAE website. In relation to the personal details of persons who have consented to the publication of their personal details on this website, the user is informed that this data forms part of one or several data treatments which are owned by or entrusted to SELAE and into which their data has been incorporated with the prior informed consent of the interested parties and cannot be freely treated or reproduced by third party users of the website -not even when reference is made to the source- unless prior authorisation and informed consent is obtained from the interested party him/herself. The personal details published on the website may consist of -although are not limited to- any numerical, alphabetical, graphic, photographic, audio or other type of information concerning identified or identifiable private individuals, such as name, surname, IP address, postal and/or e-mail address, photos, videos, pictures of events held by SELAE and any other information. Therefore, all personal details - including images, videos, texts, data and any other information that is published in this website pertaining to identified and/or identifiable individuals - can only be used by the website user for the purposes of participating in the services and contents in the manner established in the website use policies and in these privacy policies, for private purposes and within the boundaries of prevailing legislation and without the intent to gain from these or use them for commercial purposes of any kind. Any purposes other than those stated are expressly forbidden, including the incorporation of the images or data into files or processes and/or the creation of person databases and/or the sending of advertising or transferring of data to third parties, without the prior informed consent of the user. Moreover, SELAE shall not be held responsible for the uses implemented by third party users of the website in breach of the conditions established in this clause.

17. Updating of policies

SELAE may occassionally update this privacy policy and policy for treatment of personal data pertaining to website users. Any modification to this policy shall be published and announced on the SELAE website and in the policy wording itself and the user shall take into account that the data treatment informed by SELAE shall adhere to the policies and conditions of data treatment in force and published at the time when their personal details were submitted to SELAE, without prejudice to the preferential application of specific legal texts to this effect, such as informative texts inserted on data gathering forms and/or the conditions pertaining to certain specific services.

In any event, it shall be the user's responsibility to regularly consult the SELAE privacy policies in order to be familiar with the latest version at all times. SELAE reminds the user that "if, after reading this document, he/she continues to use the services of this website and he/she submits his/her personal details to SELAE, he/she shall thus be confirming his/her express acceptance of this privacy policy and personal data protection policy. Otherwise the user shall abstain from using this website's services and contents and choose to browse the site anonymously.

18. Contact information

SELAE is happy to receive feedback and comments from users in relation to this privacy and personal data protection policy. For these purposes or to make any other consultation in relation with this matter, the user can contact SELAE by means of the mechanisms placed at your disposal in this form.