Privacy Policy & Data Protection Framework

Data Controller Identification & Statutory Details

The data controller responsible for the processing of personal data gathered through this website, during commercial negotiations, and through our telemetry hardware platforms is Grand Casino Gear UK Ltd (Companies House Registration No. 08942152), having its registered office and executive showroom at Level 38, One Canada Square, Canary Wharf, London, E14 5AA, United Kingdom.

Grand Casino Gear is registered as a data controller with the UK Information Commissioner's Office (ICO) under registration reference ZA894215. The Data Protection Officer (DPO) may be contacted formally in writing at the registered address or via electronic correspondence addressed to [email protected].

Legal Basis for Processing under UK GDPR

We process corporate and personal information strictly in accordance with Article 6 of the UK GDPR. The lawful grounds upon which we rely include: (a) Performance of a Contract, where processing is required to fulfill commercial equipment supply contracts, architectural design briefs, or warranty services; (b) Legal Obligation, to comply with statutory duties imposed by the UK Gambling Act 2005, Anti-Money Laundering Regulations, and HMRC tax accounting directives; (c) Legitimate Interests, to operate, optimize, and safeguard our digital infrastructure and showroom facilities; and (d) Explicit Consent, where you have provided formal opt-in authorisation for technical product updates or exhibition invitations.

Categories of Personal & Corporate Data Collected

We collect and maintain only data strictly necessary for our commercial B2B operations. This includes: (a) Business Identification Data, including executive name, corporate title, employer name, casino operating licence numbers, and registered corporate billing addresses; (b) Contact Information, comprising direct business email addresses, telephone numbers, and secure messaging handles; (c) Commercial Transaction Records, including quotations, technical CAD sign-off documents, payment histories, and supply schedules; and (d) Digital Telemetry and Connection Data, including IP addresses, browser user-agent strings, referring URLs, and session timestamps collected when navigating our digital portals.

Hardware Telemetry & Pit Operational Data Separation

Grand Casino Gear manufactures smart casino table hardware including 13.56 MHz RFID readers, optical ball detection sensors, and automated continuous shufflers. We hereby affirm that Grand Casino Gear hardware deployed inside licensed casino premises captures only equipment operational metrics (e.g., rotor spin velocities, chip inventory totals, tray float valuations, and device diagnostic fault codes).

Our equipment does not collect, record, or transmit patron personal identification, biometric markers, or patron financial card data. All gaming event data processed by on-premise table hardware remains exclusively under the data controller authority of the licensed casino operator deploying the equipment.

Purposes of Data Processing & Commercial Operations

Your information is utilized exclusively for genuine commercial operations, specifically: (a) formulating formal equipment quotations and technical engineering specifications; (b) scheduling and managing physical demonstrations inside our Canary Wharf showroom; (c) coordinating precision white-glove delivery, rigging, and site commissioning across licensed casino properties; (d) fulfilling mandatory regulatory logging of gaming cylinder serial numbers as mandated by the UK Gambling Commission; and (e) maintaining continuous technical warranty, calibration logs, and safety recall registers.

Technical Data Security & Encryption Standards

Grand Casino Gear implements rigorous technical and organisational measures certified to ISO 27001 data security standards. All web communications are encrypted in transit using Transport Layer Security (TLS 1.3) with 256-bit Advanced Encryption Standard (AES) cipher suites.

Data stored on our UK-based servers is safeguarded at rest using hardware-accelerated AES-256 volume encryption. Access to corporate and technical databases is restricted to authorized personnel using multi-factor biometric authentication, role-based access control (RBAC), and continuous audit logging. Physical security at our Canary Wharf offices and Docklands joinery workshops includes 24/7 CCTV surveillance, biometric mantraps, and alarmed perimeter access controls.

Data Retention Schedules & Statutory Archiving

We retain personal and corporate information only for as long as necessary to fulfill the specific purposes for which it was acquired. Commercial procurement records, CAD engineering approvals, and sales invoices are preserved for a statutory duration of seven (7) years in accordance with UK corporate tax and HMRC requirements.

Metrology laser calibration certificates and serial number records for Sovereign roulette cylinders are maintained for the active operational lifespan of the equipment plus ten (10) years to facilitate regulatory integrity audits. General inquiry correspondence that does not materialize into a commercial order is expunged after twenty-four (24) calendar months.

International Transfers of Data & Safeguards

Primary data processing occurs within the United Kingdom and the European Economic Area (EEA). In the event that technical information (such as CAD files or testing telemetry) must be transmitted to international certification bodies (e.g., Gaming Laboratories International in the United States or BMM Testlabs), such transfers are governed by UK International Data Transfer Agreements (IDTAs) or standard contractual clauses (SCCs) incorporating robust technical encryption and data protection warranties.

Third-Party Data Processors & Sub-Processors

We do not sell, rent, monetize, or disclose personal data to commercial data brokers. We share data solely with vetted sub-processors essential to our manufacturing and legal operations, including: (a) accredited metrology testing laboratories (GLI, BMM Testlabs); (b) high-security logistics contractors vetted for valuable cargo transit; (c) chartered accountancy and legal counsel based in the City of London; and (d) UK-domiciled cloud infrastructure hosting providers compliant with Cyber Essentials Plus certification.

Rights of Data Subjects under UK Data Protection Law

Under Articles 15 through 22 of the UK GDPR, data subjects possess enforceable statutory rights regarding their personal data held by Grand Casino Gear, including: (a) The Right of Access (Subject Access Request); (b) The Right to Rectification of inaccurate or incomplete records; (c) The Right to Erasure ('Right to be Forgotten'), subject to legal retention obligations; (d) The Right to Restriction of Processing; (e) The Right to Data Portability in structured electronic formats; (f) The Right to Object to processing founded upon legitimate interests; and (g) Rights in relation to automated decision-making and profiling.

To exercise any statutory right, submit a formal written request to [email protected]. Grand Casino Gear will respond to verified requests within thirty (30) calendar days without charge.

Absence of Automated Decision-Making & Profiling

Grand Casino Gear does not deploy algorithmic profiling or automated decision-making systems that produce legal or similarly significant effects concerning data subjects. Commercial credit terms, bespoke manufacturing feasibility evaluations, and warranty determinations are invariably conducted through human oversight by our London executive management team.

Strict Exclusion of Minors & Age-Restricted Scope

Our services, website, and commercial gaming equipment are exclusively intended for licensed corporate gaming operators and adults aged 18 and older. We do not knowingly solicit, harvest, or maintain personal data from individuals under 18 years of age. Any data inadvertently identified as originating from a minor will be expunged from our systems immediately.

Incident Notification & Data Breach Procedures

Grand Casino Gear maintains a documented Data Breach Incident Response Plan. In the unlikely event of a security incident leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of personal data, we will notify the Information Commissioner's Office within seventy-two (72) hours of becoming aware of the breach, in accordance with Article 33 of the UK GDPR. Affected corporate clients and data subjects will be notified without undue delay where high risk is identified.

Supervisory Authority & Statutory Complaint Mechanisms

If you believe that Grand Casino Gear UK Ltd has failed to process your personal data in compliance with applicable UK data protection statutes, you retain the statutory right to lodge a formal complaint with the UK supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. Website: https://ico.org.uk. We request that clients contact our Data Protection Officer prior to escalating concerns to the supervisory authority so we may rectify matters expeditiously.