1. Data Controller

The entity responsible for the processing of your personal data (the "Data Controller") is:

2. Data Protection Officer (DPO)

We have appointed a Data Protection Officer who is responsible for overseeing matters relating to this Privacy Policy and our data protection compliance. If you have any questions, concerns, or requests regarding this Policy or your personal data, you may contact our DPO at:

3. Scope and Application

This Privacy Policy applies to all personal data we collect and process in connection with:

• Visits to our website at torvellianprestigecourt.com;
• Hotel room reservations, check-in and check-out processes, and on-property stays;
• Casino access, gaming activities, and loyalty programme participation;
• Food and beverage services, spa, entertainment, and other ancillary services;
• Enquiries, complaints, or other communications directed to us;
• Employment applications and contractor engagements; and
• Any other interaction you have with .

This Policy applies regardless of whether you are located in Australia, the European Union, the United Kingdom, or another jurisdiction, to the extent that applicable law requires us to comply with GDPR or equivalent standards in relation to your personal data.

4. Personal Data We Collect

We collect personal data from you directly (e.g., when you make a booking or contact us), from third parties (e.g., travel agents, booking platforms, or payment processors), and automatically (e.g., through cookies and similar technologies on our website). The categories of personal data we collect include the following:

4.1 Identity and Contact Data

• Full name, title, date of birth, and gender;
• Postal address, email address, and telephone numbers;
• Passport number, national identity card number, or other government-issued identification as required by law or for age verification;
• Nationality and country of residence.

4.2 Booking and Reservation Data

• Arrival and departure dates, room type preferences, and special requests;
• Number and age of guests in your party;
• Booking reference numbers and booking history;
• Details of services requested or used during your stay.

4.3 Financial and Payment Data

• Payment card details (processed securely through our payment service providers; we do not store full card numbers);
• Billing address and transaction history;
• Bank account details where refunds or transfers are required.

4.4 Gaming and Casino Data

• Gaming activity records, including games played, session duration, and wagering history;
• Responsible gaming declarations, self-exclusion elections, and limit-setting records;
• Source of funds information collected for anti-money-laundering (AML) compliance purposes;
• Loyalty programme membership details and points balance.

4.5 Technical and Usage Data

• IP address, browser type and version, device identifiers, and operating system;
• Pages visited on our website, time spent, referring URLs, and clickstream data;
• Cookie identifiers and similar tracking technology data (see our Cookie Policy for further details);
• Log files generated by our servers and security systems.

4.6 CCTV and Security Data

• Closed-circuit television (CCTV) footage recorded on our premises, including the casino floor, hotel lobby, corridors, and public areas;
• Access control records for restricted areas.

4.7 Marketing and Communications Data

• Your marketing and communication preferences;
• Records of your interactions with our marketing communications, including email open and click-through data;
• Responses to surveys, competitions, or promotional activities.

4.8 Special Categories of Personal Data

In limited circumstances, we may process special categories of personal data as defined under GDPR Article 9. This includes:

• Health data: dietary requirements, accessibility needs, or medical conditions disclosed to us for the purpose of providing appropriate services or ensuring your safety;
• Biometric data: where required by applicable gambling regulations for identity verification purposes;
• Data relating to criminal convictions and offences: where required for regulatory compliance in connection with our casino operations, including gaming licence obligations.

We only process special categories of personal data where a specific legal basis under Article 9 GDPR applies, such as your explicit consent, or where processing is necessary for reasons of substantial public interest or compliance with a legal obligation.

4.9 Data Collected from Children

Our casino services are strictly available only to persons who are 18 years of age or older. We do not knowingly collect personal data from children under the age of 18 in connection with casino activities. Hotel services may be provided to families with children; however, we only collect the minimum personal data necessary about accompanying minors and always with the consent of a parent or legal guardian.

5. Legal Basis for Processing

In accordance with GDPR Article 6, we rely on one or more of the following legal bases when processing your personal data:

5.1 Performance of a Contract (Article 6(1)(b))

Processing is necessary to enter into or perform a contract with you, or to take steps at your request prior to entering a contract. This applies, for example, when:

• Processing your hotel room reservation, including check-in and check-out procedures;
• Delivering the services you have booked, such as spa treatments, restaurant reservations, or event tickets;
• Processing payments for services rendered;
• Managing your loyalty programme membership and associated benefits.

5.2 Compliance with a Legal Obligation (Article 6(1)(c))

Processing is necessary to comply with a legal obligation to which we are subject as a data controller. This applies, for example, when:

• Verifying the identity of guests and casino patrons in accordance with anti-money-laundering (AML) and counter-terrorism financing (CTF) laws, including the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth);
• Collecting and retaining guest registration records in accordance with applicable hotel and gaming legislation;
• Reporting suspicious transactions or activities to AUSTRAC or other competent authorities;
• Maintaining financial records for taxation purposes under Australian tax law;
• Complying with gaming licence conditions imposed by the relevant gaming regulatory authority in the Australian Capital Territory;
• Responding to lawful requests from law enforcement or regulatory agencies.

5.3 Legitimate Interests (Article 6(1)(f))

Processing is necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your interests or fundamental rights and freedoms. We rely on this basis for activities such as:

• Operating and maintaining the security of our premises through CCTV surveillance to protect guests, staff, and property;
• Preventing, detecting, and investigating fraud, cheating, theft, or other illegal activities within our hotel and casino;
• Analysing website usage and guest behaviour to improve our services, website functionality, and user experience;
• Sending direct marketing communications to existing customers about similar products and services (subject to your right to opt out at any time);
• Managing and resolving disputes, complaints, and legal claims;
• Conducting due diligence on business partners, suppliers, and service providers;
• Internal administrative and reporting purposes across our corporate group.

5.4 Consent (Article 6(1)(a))

Where we rely on your consent as the legal basis for processing, we will always ask for your explicit, freely given, specific, informed, and unambiguous consent before processing your personal data for that purpose. This includes:

• Sending you direct marketing communications if you are not an existing customer;
• Placing non-essential cookies and similar tracking technologies on your device;
• Processing special categories of personal data, such as health information, where no other legal basis is available;
• Conducting profiling activities for personalised marketing purposes.

You have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact us at privacy@torvellianprestigecourt.com.

5.5 Protection of Vital Interests (Article 6(1)(d))

In exceptional circumstances, we may process personal data where it is necessary to protect the vital interests of you or another individual. This may arise, for example, in a medical emergency affecting a guest on our premises.

5.6 Public Task (Article 6(1)(e))

In certain circumstances, processing may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, for example where we are required to cooperate with regulatory investigations or public health obligations.

6. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

6.1 Provision of Hotel Services

• Processing and managing room reservations, including pre-arrival communications;
• Registering guests upon arrival in accordance with legal requirements;
• Facilitating check-in and check-out procedures;
• Coordinating housekeeping, concierge, and ancillary hotel services;
• Accommodating special requests, accessibility requirements, or dietary needs;
• Processing billing and payment for hotel services.

6.2 Provision of Casino and Gaming Services

• Verifying the age and identity of casino patrons in compliance with gaming legislation;
• Registering patrons for gaming programmes and managing gaming accounts;
• Recording and monitoring gaming activities for regulatory and compliance purposes;
• Administering responsible gambling programmes, including processing self-exclusion requests and implementing voluntary limit-setting;
• Preventing and detecting fraudulent activity, cheating, and money laundering on the casino floor;
• Complying with reporting obligations to gaming regulators and AUSTRAC.

6.3 Security and Safety

• Operating CCTV surveillance systems throughout our property to maintain the safety and security of guests and staff;
• Monitoring access to restricted areas;
• Investigating incidents, accidents, or security breaches;
• Sharing information with law enforcement agencies where required by law or to prevent serious harm.

6.4 Customer Service and Relationship Management

• Responding to enquiries, feedback, and complaints;
• Managing and resolving disputes;
• Maintaining records of your interactions with us to ensure continuity and quality of service;
• Personalising your experience on our website and during your stay based on your preferences and booking history.

6.5 Marketing and Communications

• Sending you information about our services, special offers, promotions, and events where we have a lawful basis to do so;
• Administering competitions, prize draws, and loyalty reward schemes;
• Conducting customer satisfaction surveys;
• Analysing the effectiveness of our marketing campaigns.

6.6 Analytics and Service Improvement

• Analysing how our website is used to improve its content, navigation, and functionality;
• Conducting internal research and analytics to understand guest preferences and behaviour;
• Developing new services and improving existing ones;
• Preparing aggregated and anonymised statistical reports for internal management purposes.

6.7 Legal and Regulatory Compliance

• Meeting our obligations under Australian and applicable international law;
• Establishing, exercising, or defending legal claims;
• Cooperating with regulatory investigations and audits;
• Maintaining records as required by law.

7. Disclosure and Sharing of Personal Data

We do not sell your personal data to third parties. We may disclose your personal data to the following categories of recipients where necessary and proportionate:

7.1 Service Providers and Data Processors

We engage trusted third-party service providers who process personal data on our behalf and under our instructions as data processors in accordance with GDPR Article 28. These include:

• Payment processing providers and banking institutions;
• Cloud hosting, IT infrastructure, and cybersecurity providers;
• Online booking platforms and channel managers;
• Customer relationship management (CRM) software providers;
• Email marketing and communication platforms;
• Accounting, auditing, and legal service providers;
• CCTV monitoring and physical security companies;
• Staff training and HR management platforms.

All service providers are contractually bound to process personal data only on our instructions, to maintain adequate security measures, and to comply with applicable data protection law.

7.2 Business Partners

• Travel agencies, tour operators, and online travel agencies (OTAs) through which you made your booking;
• Airlines or transportation providers where we offer bundled packages;
• Partner entertainment or event venues where joint services are offered.

7.3 Regulatory Authorities and Law Enforcement

• Gaming and casino regulatory bodies in the Australian Capital Territory and, where relevant, the Commonwealth;
• AUSTRAC and other financial intelligence agencies for AML and CTF reporting;
• The Australian Taxation Office (ATO);
• The Office of the Australian Information Commissioner (OAIC);
• Police services and other law enforcement agencies where required by law or where we have a legitimate obligation to report criminal activity;
• Courts, tribunals, and other judicial bodies where required in connection with legal proceedings.

7.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your personal data may be disclosed to prospective or actual purchasers, investors, or advisers, subject to appropriate confidentiality obligations.

7.5 International Transfers

Where personal data is transferred to recipients located outside the European Economic Area (EEA), we ensure that such transfers are made in compliance with applicable data protection law, including GDPR Chapter V. The mechanisms we use to safeguard international transfers include:

• Transfers to countries that have been granted an adequacy decision by the European Commission;
• Standard Contractual Clauses (SCCs) adopted by the European Commission;
• Binding Corporate Rules (BCRs) where applicable;
• Other lawful transfer mechanisms as recognised under applicable data protection law.

You may request a copy of the relevant transfer safeguards by contacting us at privacy@torvellianprestigecourt.com.

8. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures. Where anonymisation is not feasible, we apply appropriate technical and organisational security measures to restrict further processing.

9. Your Data Protection Rights

Subject to applicable law and certain conditions, you have the following rights in relation to your personal data:

9.1 Right of Access (Article 15 GDPR)

You have the right to request confirmation as to whether we process personal data concerning you, and if so, to obtain a copy of that personal data together with supplementary information about how it is processed (a "Subject Access Request" or "SAR").

9.2 Right to Rectification (Article 16 GDPR)

You have the right to request that we correct any inaccurate personal data we hold about you without undue delay, and to have incomplete personal data completed.

9.3 Right to Erasure / Right to be Forgotten (Article 17 GDPR)

You have the right to request that we delete your personal data in certain circumstances, such as where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis applies, or where the data has been unlawfully processed. This right is not absolute and may be limited where we are required to retain data to comply with a legal obligation or to establish, exercise, or defend a legal claim.

9.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data, or where you have objected to processing and we are considering whether our legitimate grounds override your interests.

9.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.

9.6 Right to Object (Article 21 GDPR)

You have the right to object at any time to:

• Processing of your personal data based on our legitimate interests, on grounds relating to your particular situation; and
• Processing of your personal data for direct marketing purposes (including profiling for direct marketing), in which case we will cease such processing immediately without requiring justification.

9.7 Right to Withdraw Consent (Article 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9.8 Rights in Relation to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless such processing is necessary for entering into or performing a contract with you, is authorised by applicable law, or is based on your explicit consent.

9.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a competent supervisory authority if you believe that our processing of your personal data infringes applicable data protection law. In Australia, the relevant authority is:

• Office of the Australian Information Commissioner (OAIC)
  Website: www.oaic.gov.au

If you are located in the European Union, you may also have the right to lodge a complaint with your local EU Data Protection Authority (DPA).

9.10 How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request to our Data Protection Officer at:

• Email: privacy@torvellianprestigecourt.com
• Post: The Data Protection Officer, ,

We will respond to your request without undue delay and in any event within one calendar month of receipt. This period may be extended by a further two months where requests are complex or numerous, in which case we will notify you within the first month and explain the reason for the extension. We may need to verify your identity before processing your request. There is generally no charge for exercising your rights, although we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

10. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies (such as web beacons and pixel tags) to enhance your browsing experience, analyse website traffic, and deliver relevant marketing content. Cookies are small text files placed on your device when you visit our website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of our website, enabling basic functions such as page navigation and access to secure areas. These cookies do not require your consent.
• Performance and Analytics Cookies: Collect information about how visitors use our website, such as pages most visited and error messages, to help us improve website performance. These cookies are only placed with your consent.
• Functionality Cookies: Remember your preferences and choices (such as language or region) to provide enhanced, personalised features. These cookies are only placed with your consent.
• Targeting and Advertising Cookies: Used to deliver advertising relevant to your interests, limit the number of times you see an advertisement, and measure the effectiveness of campaigns. These cookies are only placed with your explicit consent.

You may manage your cookie preferences at any time through the cookie consent banner displayed on our website or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For full details about the cookies we use and how to manage them, please refer to our separate Cookie Policy available on our website.

11. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption of personal data in transit using Transport Layer Security (TLS) and at rest where appropriate;
• Access controls, including role-based access management and multi-factor authentication for systems containing personal data;
• Regular security assessments, penetration testing, and vulnerability management;
• Staff training on data protection and information security obligations;
• Incident response procedures and a documented data breach notification process;
• Physical security measures at our premises, including CCTV, key card access, and visitor management systems.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk to individuals, we will also notify affected individuals without undue delay in accordance with GDPR Article 34.

12. Third-Party Websites and Links

Our website may contain links to third-party websites, social media platforms, or services that are not operated by us. This Privacy Policy does not apply to those third-party websites. We encourage you to review the privacy policies of any third-party websites you visit, as we have no control over and accept no responsibility for their content or privacy practices.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. When we make material changes to this Policy, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or by a prominent notice on our website prior to the change becoming effective. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

Your continued use of our website or services after any changes to this Policy have been made and notified to you constitutes your acknowledgement of the updated Policy.

14. Contact Information

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have any concerns about how we handle your personal data, please contact us using the details below:

We are committed to working with you to resolve any concerns about our privacy practices and will endeavour to respond to all enquiries promptly and thoroughly.