1. Data Controller

The Data Controller responsible for your personal data is:

If you have any questions, concerns, or requests regarding the processing of your personal data, please contact our Data Protection Officer (DPO) whose details are provided in Section 11 of this policy.

2. Scope and Applicability

This Privacy Policy applies to all individuals ("data subjects") whose personal data we collect and process, including but not limited to:

• Visitors to our website at www.delquessagrandretreat.com;
• Guests who make reservations or stay at our hotel;
• Casino patrons who visit or register for our casino services;
• Individuals who subscribe to our newsletters, promotional offers, or loyalty programmes;
• Applicants who submit enquiries or job applications;
• Business partners, vendors, and contractors;
• Any individual who contacts us through any channel, including social media, telephone, or email.

This policy applies regardless of your country of residence or nationality, to the extent that applicable data protection law requires us to respect your privacy rights.

3. Personal Data We Collect

We collect and process various categories of personal data depending on your interaction with us. The categories of personal data we may collect include:

3.1 Identity and Contact Data

• Full name (first name, last name, title);
• Date of birth and age verification information;
• Gender;
• Nationality and country of residence;
• Passport or government-issued identification number (where required by law);
• Email address;
• Telephone and mobile number;
• Postal and billing address;
• Signature.

3.2 Reservation and Stay Data

• Check-in and check-out dates;
• Room type, preferences, and special requests;
• Number of guests and accompanying persons' details (where provided);
• Booking reference numbers;
• Loyalty programme membership number and history;
• Hotel service usage records (spa, dining, room service, etc.);
• Guest feedback and complaints.

3.3 Financial and Payment Data

• Credit or debit card details (processed securely through PCI-DSS compliant payment processors);
• Bank account information (where relevant for refunds);
• Billing records and invoices;
• Transaction history relating to hotel and casino services.

3.4 Casino and Gaming Data

• Casino membership registration details;
• Gaming activity records, betting history, and wagering data;
• Responsible gambling assessments and self-exclusion requests;
• Identity verification documents for anti-money laundering (AML) compliance;
• Source of funds documentation where legally required;
• Winnings and losses records.

3.5 Technical and Usage Data

• IP address and device identifiers;
• Browser type, version, and language settings;
• Operating system and platform;
• Pages visited on our website, time spent, and clickstream data;
• Referral URLs and search terms used to find our website;
• Cookie data and similar tracking technologies (see our Cookie Policy for more detail);
• Log files and access records.

3.6 Marketing and Communications Data

• Marketing preferences and opt-in/opt-out records;
• Newsletter subscription details;
• Survey responses and competition entries;
• Communication history with our team (emails, chat records, phone call logs).

3.7 Special Categories of Personal Data

In certain limited circumstances, we may collect and process special categories of personal data as defined under GDPR Article 9. These include:

• Health and dietary information: such as food allergies, medical conditions, or mobility requirements, when voluntarily provided by you to enable us to tailor your experience or accommodate your needs;
• Data relating to criminal convictions and offences: where required for regulatory compliance, including responsible gambling obligations and anti-money laundering checks.

We will only process special category data where we have an explicit legal basis to do so, as further described in Section 5 of this policy. We apply enhanced safeguards to such data and will never process it for purposes beyond those strictly necessary.

3.8 Data Collected from Third Parties

We may also receive personal data about you from third parties, including:

• Online travel agents and booking platforms (e.g., Booking.com, Expedia);
• Credit reference and fraud prevention agencies;
• Gaming regulatory authorities;
• Marketing and analytics partners;
• Social media platforms, where you interact with our pages or use social login features.

4. How We Collect Your Personal Data

We collect your personal data through the following methods:

4.1 Direct Collection

• When you complete a reservation or enquiry form on our website;
• When you check in or check out at the hotel;
• When you register for our casino or loyalty programme;
• When you contact us by telephone, email, live chat, or in person;
• When you complete a guest satisfaction survey or competition entry form;
• When you subscribe to our newsletter or marketing communications;
• When you submit a job application or enquiry.

4.2 Automated Collection

• Through cookies, web beacons, and similar tracking technologies on our website;
• Through CCTV and security surveillance systems on our premises (as required by law and for security purposes);
• Through server logs and analytics tools.

4.3 Third-Party Sources

• From travel agents, booking platforms, and business partners who refer bookings to us;
• From publicly available sources such as company registers and public directories;
• From fraud prevention and identity verification service providers.

5. Legal Basis for Processing

In accordance with GDPR Article 6, we only process your personal data where we have a valid legal basis. The legal bases we rely upon are as follows:

5.1 Performance of a Contract (Article 6(1)(b))

We process your personal data where it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. This includes:

• Processing hotel reservations and managing your stay;
• Providing casino and gaming services pursuant to your membership agreement;
• Processing payments for services rendered;
• Managing loyalty programme membership and benefits;
• Responding to service requests and special requirements during your stay.

5.2 Compliance with a Legal Obligation (Article 6(1)(c))

We process your personal data where it is necessary for compliance with a legal obligation to which we are subject. This includes:

• Identity verification and age verification obligations under gambling regulations;
• Anti-money laundering (AML) and counter-terrorism financing (CTF) obligations;
• Tax, accounting, and financial reporting obligations;
• Compliance with guest registration requirements under hospitality law;
• Compliance with responsible gambling legislation and regulatory reporting;
• Responding to lawful requests from law enforcement or regulatory authorities.

5.3 Legitimate Interests (Article 6(1)(f))

We process your personal data where it is necessary for the purposes of our legitimate interests, or those of a third party, except where such interests are overridden by your fundamental rights and freedoms. Our legitimate interests include:

• Ensuring the security and safety of our premises, guests, and staff (including CCTV monitoring);
• Preventing and detecting fraud, crime, and other illegal activities;
• Improving and personalising our services based on guest preferences and feedback;
• Administering and optimising our website and digital platforms;
• Sending service-related communications and updates;
• Managing and defending legal claims;
• Conducting market research and internal analytics to improve business operations.

Where we rely on legitimate interests, we carry out a balancing test to ensure that our interests do not override your rights and freedoms. You may request further information about this balancing test at any time by contacting our DPO.

5.4 Consent (Article 6(1)(a))

Where we rely on your consent as the legal basis for processing, we will obtain your explicit, informed, and freely given consent prior to processing. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. We rely on consent for:

• Sending direct marketing emails, SMS, or other promotional communications;
• Placing non-essential cookies on your device (as set out in our Cookie Policy);
• Processing special category data, such as health information for personalised accommodations;
• Enrolling you in targeted advertising or personalisation programmes.

5.5 Vital Interests (Article 6(1)(d))

In exceptional circumstances, we may process personal data where it is necessary to protect your vital interests or those of another person, such as in a medical emergency on our premises.

5.6 Public Task (Article 6(1)(e))

We may process personal data where necessary for the performance of a task carried out in the public interest or in the exercise of official authority, for example, when cooperating with gaming regulatory authorities or public health requirements.

5.7 Legal Basis for Special Category Data

Where we process special categories of personal data, we rely on the following additional legal bases under GDPR Article 9:

• Article 9(2)(a) — Explicit Consent: where you have given us your explicit consent to process health or dietary data to personalise your stay;
• Article 9(2)(b) — Employment and Social Protection: in the context of employee data where applicable;
• Article 9(2)(g) — Substantial Public Interest: for AML compliance, responsible gambling obligations, and regulatory requirements;
• Article 9(2)(f) — Legal Claims: where processing is necessary for the establishment, exercise, or defence of legal claims.

6. How We Use Your Personal Data

We use your personal data for the following purposes:

6.1 Hotel and Hospitality Services

• Processing and confirming reservations and bookings;
• Managing your check-in and check-out experience;
• Providing room service, concierge, spa, dining, and other hotel services;
• Personalising your stay based on your preferences and history;
• Processing payments and issuing receipts and invoices;
• Managing your participation in our loyalty and rewards programme;
• Handling guest complaints, feedback, and service recovery.

6.2 Casino and Gaming Operations

• Registering and administering your casino membership;
• Processing gaming transactions and maintaining accurate records;
• Conducting identity verification and age verification checks;
• Fulfilling responsible gambling obligations, including monitoring for problem gambling behaviours and administering self-exclusion programmes;
• Complying with AML and CTF regulations, including conducting due diligence checks;
• Reporting to gaming regulatory authorities as required by law.

6.3 Security and Safety

• Monitoring our premises using CCTV for the safety and security of guests and staff;
• Preventing and detecting fraud, theft, and other criminal activity;
• Enforcing self-exclusion lists and bans;
• Cooperating with law enforcement and regulatory bodies;
• Ensuring the physical security of our hotel and casino.

6.4 Marketing and Communications

• Sending promotional offers, packages, and newsletters (where you have consented or where permitted by applicable law);
• Informing you about relevant hotel and casino events, promotions, and news;
• Conducting surveys, competitions, and prize draws;
• Personalising our marketing communications based on your preferences and past interactions.

6.5 Website and Digital Operations

• Operating, maintaining, and improving our website;
• Analysing website traffic and user behaviour to enhance user experience;
• Managing online bookings, enquiries, and customer accounts;
• Administering cookies and tracking technologies in accordance with your preferences.

6.6 Legal, Regulatory, and Administrative Purposes

• Complying with applicable laws, regulations, and regulatory requirements;
• Maintaining accurate financial and business records;
• Establishing, exercising, or defending legal claims;
• Conducting internal audits and risk management assessments;
• Responding to data subject rights requests.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. However, we may share your personal data with the following categories of recipients where necessary and lawful:

7.1 Service Providers and Data Processors

We engage trusted third-party service providers to assist us in operating our business. These providers act as data processors on our behalf and are contractually obligated to process your data only on our instructions and in accordance with applicable data protection law. They include:

• Payment processing and banking service providers;
• Property Management System (PMS) and hotel booking software providers;
• Casino management system providers;
• IT infrastructure, hosting, and cloud service providers;
• Email and communications platform providers;
• Customer Relationship Management (CRM) software providers;
• Identity and age verification service providers;
• Online travel agents and booking platforms (acting as joint controllers in some cases);
• Marketing, analytics, and advertising technology providers;
• Legal, audit, and professional advisory firms.

7.2 Regulatory and Law Enforcement Authorities

We may share your personal data with government bodies, regulators, and law enforcement agencies where we are legally required or permitted to do so. This includes:

• The Queensland Office of Liquor and Gaming Regulation;
• The Australian Transaction Reports and Analysis Centre (AUSTRAC);
• The Australian Taxation Office (ATO);
• Police services and law enforcement agencies;
• Courts and judicial bodies where required by legal proceedings.

7.3 Business Partners

Where you have booked through a travel agent, tour operator, or corporate partner, we may share relevant booking and stay information with that partner for the purposes of fulfilling your reservation or managing the corporate relationship.

7.4 Group Companies

Where applicable, we may share your personal data with other entities within the same corporate group as , where necessary for operational, administrative, or compliance purposes. All such transfers are subject to appropriate data protection agreements.

7.5 Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, or other business transfer, your personal data may be transferred to the relevant acquiring or successor entity. We will notify you of any such change where required by law and ensure appropriate data protection safeguards are in place.

7.6 International Data Transfers

Some of our service providers and partners may be located outside of Australia or the European Economic Area (EEA). Where we transfer personal data internationally, we ensure that appropriate safeguards are in place, including:

• Transfers to countries recognised by the European Commission as providing an adequate level of data protection;
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Binding Corporate Rules (BCRs);
• Compliance with the Australian Privacy Principles (APPs) regarding cross-border disclosures under Australian Privacy Act Section 16C;
• Any other lawful transfer mechanism recognised under applicable data protection law.

You may request further information about international transfers and the safeguards in place by contacting our DPO.

8. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The specific retention period will depend on the nature of the data and the purpose for which it is processed.

The following general retention periods apply:

After the applicable retention period has expired, your personal data will be securely deleted, anonymised, or pseudonymised in accordance with our internal data disposal procedures. Where data is anonymised, it may be retained for analytical or statistical purposes without further limitation.

In some circumstances, we may retain your personal data for longer periods where required by law, regulation, or for the establishment, exercise, or defence of legal claims.

9. Your Rights as a Data Subject

Under the GDPR and other applicable data protection legislation, you have a number of important rights in relation to your personal data. We are committed to facilitating the exercise of these rights in a timely and transparent manner.

9.1 Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you, along with information about how we process it. This is known as a Subject Access Request (SAR). We will respond to your request within one month of receipt, which may be extended by a further two months in complex cases.

9.2 Right to Rectification (Article 16)

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you without undue delay.

9.3 Right to Erasure / Right to Be Forgotten (Article 17)

You have the right to request the deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected, you withdraw your consent (where consent was the legal basis), or you object to processing and there are no overriding legitimate grounds. This right is not absolute and may be subject to exceptions where we are required to retain data for legal or regulatory reasons.

9.4 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we are verifying the accuracy of data you have contested, or where you have objected to processing pending verification of our legitimate grounds.

9.5 Right to Data Portability (Article 20)

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit this data directly to another controller, where technically feasible.

9.6 Right to Object (Article 21)

You have the right to object to the processing of your personal data where we rely on our legitimate interests as the legal basis. Upon receipt of such an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

You have an unconditional right to object at any time to the processing of your personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. We will cease such processing immediately upon receipt of your objection.

9.7 Right to Withdraw Consent (Article 7(3))

Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. You may withdraw your consent by contacting us using the details in Section 11, or by using the unsubscribe link in our marketing emails.

9.8 Rights Related to Automated Decision-Making and Profiling (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you. Where we engage in automated decision-making, we will inform you of this and provide you with the opportunity to request human intervention, express your point of view, or contest the decision.

9.9 Right to Lodge a Complaint with a Supervisory Authority (Article 77)

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority. In Australia, the relevant authority is:

• Office of the Australian Information Commissioner (OAIC)
  Website: www.oaic.gov.au
  Phone: 1300 363 992

If you are located in the European Economic Area or the United Kingdom, you may also lodge a complaint with the data protection authority in your country of residence.

9.10 How to Exercise Your Rights

To exercise any of your rights, please submit a written request to our Data Protection Officer using the contact details provided in Section 11. We may need to verify your identity before processing your request. We will not charge a fee for responding to your request unless it is manifestly unfounded or excessive.

10. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic, and deliver relevant content and advertising. Cookies are small text files stored on your device when you visit a website.

We use the following types of cookies:

• Strictly Necessary Cookies: Essential for the operation of our website, including enabling you to navigate and use its features. These do not require your consent.
• Performance and Analytics Cookies: Help us understand how visitors interact with our website by collecting aggregated and anonymised information. These require your consent.
• Functional Cookies: Allow our website to remember your preferences and settings to provide a more personalised experience. These require your consent.
• Marketing and Advertising Cookies: Used to deliver relevant advertisements based on your interests. These require your explicit consent.

You may manage your cookie preferences at any time through our Cookie Consent Manager, accessible via the cookie banner displayed on your first visit to our website, or through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

For full details of the cookies we use, their purposes, and their retention periods, please refer to our full Cookie Policy, available on our website.

11. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Encryption of data in transit using SSL/TLS protocols;
• Encryption of sensitive data at rest;
• Access controls and role-based permissions to restrict access to personal data;
• Regular security assessments, penetration testing, and vulnerability scans;
• Staff training on data protection and information security;
• PCI-DSS compliant payment processing systems;
• Secure data disposal and destruction procedures;
• Business continuity and disaster recovery plans.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay in accordance with GDPR Article 34.

Please note that no method of data transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

12. Third-Party Links and Services

Our website may contain links to third-party websites, social media platforms, and services that are not operated by us. These third parties have their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices of such third parties and do not accept any liability in connection with them. The inclusion of a link on our website does not imply our endorsement of the linked website or its privacy practices.

13. Children's Privacy

Our hotel-casino services are not directed at children under the age of 18. We do not knowingly collect personal data from individuals under 18 years of age. Our casino facilities are strictly restricted to adults of legal gambling age, and we conduct age verification checks as required by applicable gambling legislation.

If we become aware that we have inadvertently collected personal data from a child under 18 without appropriate parental consent, we will take immediate steps to delete such data from our systems. If you believe we may have collected data from a child, please contact our DPO immediately.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or business operations. When we make material changes to this policy, we will notify you by posting the revised policy on our website with an updated "Last Updated" date, and where appropriate, we may notify you by email or through a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website or services after the effective date of any changes constitutes your acknowledgment of the revised policy.

Previous versions of this Privacy Policy are available upon request from our DPO.

15. Contact Us and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please do not hesitate to contact us. Our Data Protection Officer is responsible for overseeing compliance with this policy and applicable data protection legislation.

We are committed to working with you to resolve any concerns you may have about our use of your personal data. If you are not satisfied with our response, you retain the right to lodge a complaint with the relevant supervisory authority as described in Section 9.9 above.