Loterías y apuestas

Data Protection Policy

In this page we inform you about how SELAE processes and protects the personal data of (unregistered) users of the Platform's services. Participants (registered users) have specific information regarding this matter in the Gaming Contract.

 

If you want to exercise your personal data protection rights with respect to SELAE, whatever your relationship with us, you can do so on this page: https://www.selae.es/es/web-corporativa/contacto-proteccion-datos.

 

Basic data protection information (layer I)

 

Data Controller	SOCIEDAD ESTATAL LOTERÍAS Y APUESTAS DEL ESTADO, S.M.E., S.A. (SELAE) – A86171964
Purposes	To allow you to use the Platform.
Legitimation	The legitimating grounds for processing is the legitimate interest of both parties.
Recipients	No other communication will be made to other entities, except those required by legal obligation or necessity.   No transfers will be made to third countries or international organisations that do not offer sufficient guarantees.
Rights	Your have the right to access, rectify and erase the data, as well as other rights, as explained in the layer II information .
Data Source	The data subject.
Additional information	You can check additional and detailed information on Data Protection here.

 

Detailed information

 

The service offered by SELAE, , in terms of access to its websites and for its mobile and device applications, whether operated by SELAE or on behalf of SELAE, and any digital channel put into service by SELAE (the “Platform”), necessarily involves the processing of personal user data by SELAE (“Personal Data”). The aforementioned data will normally be confined to the use of the IP address of the user's system, exclusively for technical communication purposes essential to the service offered, unless other personal data is explicitly collected from the user in any of the services offered and unless specifically indicated. These IP addresses are only used individually to operate the platform and to manage the security and quality of the same.

Users freely visit the information on the Platform based solely on their own decision to browse it.

Whatever the nature of the data processes, SELAE declares that it scrupulously observes users’ fundamental rights regarding the processing of their personal data and strict compliance with current regulations:

• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and the free movement of such data (“GDPR”).
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD").
  Any other applicable national or European Union legislation on data protection.

These terms and conditions regarding personal data treatment and protection cover the use of the Platform by visitors and users and shall apply in a subsidiary fashion to any others concerning the same subject matter that are established specifically for particular processing actions and are communicated to the data subject unrestrictedly through registration forms, gaming contract, communication and consultation channels, and any other appropriate points of contact, thus rendering them complementary to those of a specific nature wherever they do not contradict the same.

 

Users not registered on the Platform do so entirely voluntarily.

 

The purpose of the data processing is to be able to provide Platform services, consisting of on-demand information services for users, as well as offering intercommunication channels.

 

Data Controller

SOCIEDAD ESTATAL LOTERÍAS Y APUESTAS DEL ESTADO, S.M.E., S.A. (SELAE)   Tax ID No.: A-86171964 Address: C/Poeta Joan Maragall, 53, 28020 Madrid. Telephone No.: 902112313 (Customer Service) Contact the Data Protection Officer: Postal: SELAE, Register, For the attention of: “Data Protection”, C/Poeta Joan Maragall 53, 28020 Madrid Electronic: communication form at www.loteriasyapuestas.es

 

Personal Data, purposes and period during which the data is stored

In compliance with the principle of limitation of purpose, SELAE shall only request and process Personal Data that are appropriate, relevant and restricted to the purposes for which they are processed, namely: particular, explicit and legitimate purposes. The data collected and their specific purpose, together with the storage period and the consequence of not providing them, are:

Personal Data collected, obtained by means of disclosures and generated	Purposes	Storage Period	Consequence if the data are NOT provided
IP address of the user's computer	Allow intercommunication between the user's system and SELAE servers	1 month	You cannot use the Platform.
Data in consultation forms, exercise of rights and contacts with Customer Service and Data Protection Officer: First name, first and second surname (second surname, optional). Date of birth: day, month, year. Foreign Resident’s ID No. or Tax No. Processing Email Telephone No. Postal address including postal code How much information the user sends	Allow receipt of communications from users and manage the appropriate replies.	5 years	You cannot send queries or exercise rights through the Platform.

 

Legal basis of the processing

The various components of the processing entail different legitimating grounds. These are:

Mutual legitimate interest of the parties. User consent.

 

Recipients of Personal Data

The following disclosures of Personal Data are foreseen:

No other communication shall be made to other entities, except for those communications that occur due to legal obligation or necessity to entities, including, among others:   State Law Enforcement Forces and Bodies, Judges, Public Prosecutor's Office, Courts and other Public Administrations or Authorities that may require them in the exercise of their powers. In order to carry out the  communication, the relevant order document must be presented. Others, such as notaries, solicitors, commissioners for oaths and lawyers, to satisfy any legal needs that may arise for the legal defence of SELAE interests.

 

The following data transfers are planned:

No transfers will be made to third countries or international organisations that do not offer adequate guarantees, except in the event that the user provides a contact email address whose service provider may be involved in such a situation.   Note that the service provider processes personal data on behalf of the data subject and not of SELAE, therefore, this aspect is the responsibility of the user.

 

Exercise of rights and Contact Data for the Data Protection Officer

The user has the right to ask SELAE to exercise their rights in relation to their Personal Data. SELAE, as the Data Controller/Data Processor, guarantees data subjects the exercise of legally established data protection rights, including their right to:   Access their personal data Rectify or erase their personal data Limit their processing Object to their processing Data portability Exclusion from automatic decisions Any other rights covered by current legislation   You can exercise your rights: a)      Either by means of a duly signed written request sent by post to: SELAE, Register, For the attention of: “Data Protection” service, C/Poeta Joan Maragall 53, 28020 Madrid (or whichever channel may complement or replace it, and, as long as the requirement is maintained, the general register of the Spanish Data Protection Agency is notified), with the reference “Exercise of Rights”, clearly and expressly indicating the processing referred to in the exercise of the right, the petition or right being exercised as well as the name, surname(s) and postal address for the response, and attaching a copy of both sides of a credible identification document (National ID Card, Foreign Resident's ID Card, Passport or Driver’s Licence), in order to identify you unequivocally. SELAE will process said personal data on the legitimating grounds of legal compliance, for the sole purpose of responding to the exercise of your rights.   b)      Or by request sent by means of the Data Protection Form to the Data Protection Officer on this page: https://www.selae.es/es/web-corporativa/contacto-proteccion-datos   You also have the right to contact the Data Protection Officer of SELAE, which you can do using the mechanisms described above.   The user may withdraw any consent that has been given without affecting the legality of the processing based on the consent prior to its withdrawal. You may, in addition to the modification in the Platform through self-service on the corresponding selection panel, and the Customer Service Department, contact the Data Protection Officer.   You can find out about and exercise your rights, send queries and contact the Data Protection Officer on this page: Data Protection Form.

 

Claim made to a Supervisory Authority

Data subjects have the right to seek the protection of the Spanish Data Protection Agency, independent authority for monitoring compliance with data protection regulations.

 

Existence of automated decisions (including profiling)

Users are not profiled. No automated decisions are made.

 

Source of the Personal Data

All data is collected from the data subject.

OTHER TERMS AND CONDITIONS

 

Minors or disabled

The Platform is for over 18s.

No personal data is collected over the Platform nor is any personal information from under 18s. Under 18s are strictly prohibited from accessing the information and/or registering on the Platform.

 

Registering on the Platform and contacts

In the event that the user is interested in accessing particular services on the condition of registering beforehand, such as participating in SELAE games sold through the Platform and/or receiving information from SELAE, as well as contacting SELAE, they must complete the forms or other means to subscribe to the terms and conditions of use of the services and gaming contract that in each case are offered. Without prejudice to that stipulated in these terms and conditions, in the above-mentioned cases, the terms and conditions of data processing in each case established and communicated to the user by SELAE through the registration forms and/or gaming contract or, where appropriate, the terms and conditions of other services will prevail, with these conditions being complementary, and of subsidiary application, to the aforementioned ones, except where they contradict them.

 

Sensitive data

SELAE will not ask the user for sensitive data. However, to register on the Platform, and always in accordance with the applicable gaming regulations, SELAE must seek registration viability from the competent authorities; a viability that rests on the records of gambling access prohibitions by the competent authorities.

 

Other Services (digital, telephone and postal)

 

SELAE will process personal data to provide services for the following purposes:

1. I.              To contact the public or users: When a data subject that does not have a prior legal relationship with SELAE makes any personalised communication to SELAE through any means, the data subject in question expressly consents to the subsequent processing of their personal data by SELAE in order to attend and manage it and send the information that, where appropriate, is asked of SELAE. In any case, the collection of personal data that is not for the mere contacting or supporting of the data subject, will be considered accidental data, the collection of which has not been requested by SELAE, rather provided by the user freely, being normally erased ex officio unless it is necessary for processing. Any sensitive data that the data subject may send will be erased ex officio.
2. II.           Request for and use of services: In those cases in which the data subject requests or uses any of the specific services for the purpose and/or carries out and participates in the games, the personal data provided in each case will be processed, depending on the service requested or used and the gaming activity carried out by the user, to manage said activities and allow the operational and/or commercial management of the games in accordance with the rules and regulations of each one. Likewise, when the user has requested and/or consented to the sending of gaming service information and/or additional, and/or commercial and/or advertising services of SELAE, their data will be processed for such purposes.
3. III.        Requests and/or queries: If the data subject contacts SELAE to make inquiries or request information, said data processing will be carried out to attend to and answer the received communications as well as to send the information requested from SELAE, including commercial and/or advertising information, when so consented.
4. IV.         News request service and/or app download: If the data is provided to subscribe to a news reception service or to download an app, the data will be processed to manage the download or subscription to said service, to enable identification of the registered user each time he/she accesses the service or app subscribed to/downloaded, as well as to send SELAE news and newsletters.
5. V.            Subscription to commercial communications: When the data subject expressly accepts that he/she wishes to receive commercial communications about SELAE products and/or services, his/her data will be processed to manage the sending of said communications, as well as the possible revocation of the user's consent, objection to the processing or withdrawal from the service.
6. VI.         Exercising data protection rights: When data subjects contact SELAE to exercise their rights regarding data protection, their data will be processed to attend to, manage and reply to the exercise of the right.

 

Anonymisation, aggregation and subsequent uses

The information on the use of the services (including personal data) may be anonymised (with or without previous aggregation), after it has been dissociated, for later use by SELAE or by third parties for statistical, historical, analytical or research purposes and for the improvement of its services.

 

Acceptance

In accordance with the foregoing, if the data subject does not accept the processing of their personal data by SELAE, they must refrain from using the SELAE services that require processing, and from communicating or sending their personal data to SELAE through any medium such as, albeit not exclusively, email, SMS, registration and subscription, where appropriate, to the services offered through websites, apps and mobile or filling in forms, merely browsing unregistered on websites, apps and mobile phones.

 

Other recipients of information

SELAE hereby informs the user that this entity is only responsible and only guarantees the confidentiality, security and processing of the data in accordance with these terms and conditions with respect to the personal data collected from the user through the Platform. Moreover, it accepts no liability for the processing and subsequent uses of personal data that could be carried out by third party service providers of the information society that may access such data to provide their services or pursue their business activities. Those natural or legal persons who provide the following services shall be understood, albeit not restricted to the same, as third party service providers of the information society:

(i)     transmission over a communication network of data provided by the recipients of the service;

(ii)   access services to said network;

(iii) data storage or hosting services; and

(iv) the supply of content or information.

 

Likewise, SELAE is not responsible for the data processing carried out by third parties that establish hyperlinks with SELAE or for those responsible parties to whom SELAE refers users of its website via hyperlinks or for those responsible for payment gateways.

 

Data quality

SELAE hereby informs data subjects that, except for the existence of a legally constituted representation, no person can use the identity of another person and communicate their personal data. Accordingly, data subjects must always remember that, if they communicate personal data through any medium to SELAE, it can only include personal data corresponding to their own identity and that are appropriate, pertinent, current, accurate and genuine.

Accordingly, data subjects will be solely responsible for any damage, direct and/or indirect, caused to third parties or SELAE due to use of personal data of another person, or their own personal data when they are false, erroneous, not current, inadequate or not relevant.

Likewise, data subjects that communicate the personal data of a third party to SELAE must have due authorisation from the third party and will be answerable to SELAE and the third party for this obligation, without SELAE having to carry out any additional action, and relieving SELAE of any liability in this respect.

 

Data subjects’ rights regarding commercial communications

Data subjects that have authorised SELAE to send commercial communications by email, SMS or other equivalent means of electronic communication are hereby informed that users have the right to object to the processing of their data for promotional purposes for the receipt of commercial communications, as well as the right to revoke at any time the consent given to that effect by simply notifying SELAE of their intention, at any time.

Data users have the following options available to exercise their rights:

• Through the platform itself, in the case of registered participants, in self-service.
• Through Customer Service https://www.loteriasyapuestas.es/es/contacto, being the fastest, most direct and simplest channel.
• Data users are referred to the Data Protection Form to formally exercise their data protection rights.

 

Cookies and beacons

To obtain information about data storage and recovery devices on Platform users' terminals, you can consult our Cookies policy.

 

Personal data published on SELAE websites, apps and mobile phones

Users undertake not to use, process or reproduce any personal data that SELAE publishes on the Platform, beyond its mere visualisation —not even when reference is made to the origin thereof— unless prior authorisation is obtained and express consent given by the data subject and/or SELAE. The personal data published on the Platform may consist, albeit not exclusively, of any numerical, alphabetical, graphic, photographic, acoustic or any other information concerning identified or identifiable individuals, such as name, surname, IP address, postal address and/or email, photos, videos, and images of events held by SELAE. Therefore, all personal data —including images, videos, texts, data and any other information published on this website about identified and/or identifiable individuals— may only be used by the user who owns them to participate in the services and contents in the manner established in the Platform's use policy and these terms and conditions, for domestic purposes and within the framework of current legislation, neither for profit nor commercial purposes of any nature, being expressly prohibited any other uses than those indicated, including the incorporation of the images or data to files or processing and/or creation of databases of people and/or sending of advertising or transfer to third parties, without the prior informed consent of the user. SELAE is not liable for uses that third-party users make of the website or app contrary to the provisions of this clause.

 

Updating of terms and conditions

Occasionally, SELAE will update these terms and conditions. Any modification will be published and notified on the Platform. Users must bear in mind that the processing of the data that they have communicated to SELAE will be governed by the current terms and conditions published at the time of providing their personal data to SELAE, without prejudice to the preferential application of applicable, specific legal texts, such as informative texts inserted in data collection forms and/or the terms and conditions of particular services.

In any case, users shall be responsible for periodically accessing the published terms and conditions to learn of the latest valid version of the same.

 

Social networks

Social networks are services provided by third-party providers that allow the user to participate in a virtual community with other users through which they can generate their own public profile where they can create and share content, information and personal data with other users of the network. Users can create an account or profile for professional purposes or for personal purposes on a social network. The operation of the social network is regulated firstly by the terms and conditions established by the owner and/or provider of the network and secondly, when it comes to accounts or profiles for commercial purposes, by the terms and conditions established by the party responsible for the profile or commercial account.

SELAE has profiles on some social networks such as, albeit not exclusively, Facebook and Twitter. The user can follow us and become a fan of SELAE on the aforementioned social networks and on the different social networks that we indicate through the Platform.

Our official sites and pages on social networks are for over 18s, so if users want to be part of our official sites and pages they must be over 18 and read the terms and conditions and policies published by SELAE carefully.

SELAE is responsible for the administration of the sites and the official pages on social networks provided they are the original official websites and pages and therefore have been created by SELAE.

If the user becomes a follower of the official sites and pages of SELAE, their use and the processing of their personal data that is done through them will be regulated by the specific terms and conditions provided and published on each site or official page. The fact of becoming “friend” or “follower” of our sites and official pages on social networks implies that the user consents to the processing of their data as established in the policies and terms and conditions that regulate their use in each case.

SELAE is not responsible for the sites and unofficial pages that third parties may create on social networks. That is why the user is recommended to always activate the “follow SELAE” option through our websites, apps and mobiles.

SELAE is responsible for the processing done on its websites and official pages on social networks. If users become a friend or follower of our websites and official pages on social networks, their personal data will be processed to properly administer the website or the official page, learn of their opinions and/or comments, as well as inform and involve them in the different contests, promotions and/or events that are carried out by SELAE through the websites and the official pages on their social networks.

In any case, users are hereby informed that SELAE may remove from its websites and official pages on social networks any information that goes against the rules established in the particular terms and conditions that regulate its websites and official pages, the general conditions of use established by the provider or owner of the social network as well as against the provisions of the law, morality, public order and/or any SELAE policies and website, app and mobile phone manuals.

Likewise, the owners or providers of social networks may eliminate any content which, either officially or through a complaint from another user, goes against the rules or operating rules imposed by the provider of each of the networks.

To stop following the site or the official page of SELAE on any of the websites or official pages on social networks, the user must follow the steps indicated in the conditions of operation and use of each network provider without SELAE being able to intervene in this process. However, SELAE reserves the right to create, edit, modify and/or delete the websites and/or official pages without having to inform the user in advance.

To make any inquiry regarding processing that is carried out on followers’ data on the websites or the official pages of SELAE on social networks, the user can contact SELAE through Customer Service (https://www.loteriasyapuestas.es/es/contacto), which is the fastest, most direct and simplest channel.

To learn more about the terms and conditions governing the processing and protection of personal data and conditions of use of our websites and official pages on social networks, the user can visit the notices and conditions that are published on each of the websites and official pages of the different social networks.

 

About the terms and conditions of personal data processing and protection on SELAE applications

SELAE owns various applications that the user can download onto their computer. Beyond the processing of IP addresses and allocators essential for technical intercommunications between teams, the applications, unless otherwise indicated, do not collect any other personal data of users or process this type of information. If an application collects or processes other personal data, it will offer the user the chance to read the corresponding terms and conditions of personal data protection and processing, which the user must read before using the application, in order to accept or not the personal data processing indicated therein. The installation and use of the mobile application presupposes that the user accepts the terms and conditions of personal data protection and processing.

Likewise, SELAE hereby informs that some of its applications may incorporate utilities related to the user's geolocation, an aspect that will be duly indicated, where appropriate.

This geolocation can be carried out through the applications if the user has the geolocation function activated on their device, in which case it will be understood that the user authorises said geolocation with the SELAE application if, when using the SELAE application, the user does not deactivate this function on their device. However, when geolocation is activated, the user can withdraw their consent at any time, without having to leave the application.

In addition, SELAE  offers the user the chance to receive messages about games’ products and services and SELAE promotions over the applications. Accordingly, when downloading the app you will be asked for your consent to send these messages. On agreeing to receive these messages, the user consents to SELAE processing the unique universal identifier (UUID) ​​of their device to send messages under the terms and conditions provided herein. In any case, the user can unsubscribe at any time and stop receiving messages without having to leave the app, or register, by means of the settings on the device used or through the application itself in the “Adjustments” section.

 

User recommendations

Users are solely responsible for the adoption of preventive measures to safeguard the keeping and storage of files and other content on their terminals that may be affected during the loading, installation, visualisation and use of the mobile services application, as well as the custody and secrecy of any types of passwords and access keys and use of the application, as well as the consequences of the erroneous or fraudulent use thereof.

SELAE recommends users use the latest versions of computer programs to browse the Internet given their incorporation of greater security measures.

Likewise SELAE recommends users use the security mechanisms available to them (secure web servers, cryptography, digital signature, firewall, etc.) to protect the confidentiality and integrity of their data to the necessary extent, given the risks of impersonation or communication infringement.

SELAE reminds users that the Internet is not secure. However, means have been developed and are available to allow you to improve the protection of your data. Therefore, use any means at your disposal to protect your data and your communications, such as the legally available encryption for confidential email and access codes for your own Internet-connected device.

SELAE warns users that whenever they provide personal information over the Internet via email, newsgroups, discussion forums, etc., they should bear in mind that such information can be collected and processed for purposes not desired by users, thus SELAE recommends users find out about the privacy and personal data processing policies of the websites they visit.

SELAE warns users to bear in mind that, unless they use encryption mechanisms, email confidentiality over the Internet is not assured. Likewise, email messages and discussion forums may be subject to falsification and impersonation, which should be taken into account whenever they are used. If the user does not want to publish their email address, they must configure their browser so that they do not leave their email address on the web servers they access.

Finally, SELAE hereby alerts the user to the importance of reading, understanding and accepting the particular terms and conditions that may be established prior to contracting the online products and services of this website and these apps.

latest update: 1 Sept 2018

Copyright © Sociedad Estatal Loterías y Apuestas del Estado, S.M.E., S.A. 2022. All rights reserved.