1. Data Controller

The entity responsible for the processing of your personal data (the "Data Controller") is:

If you are located in the European Economic Area (EEA) or the United Kingdom, acts as the Data Controller for any personal data you provide when accessing our services. All enquiries relating to data protection and the exercise of your rights should be directed to our Data Protection Officer (see Section 11).

2. Data Protection Officer (DPO)

We have appointed a Data Protection Officer to oversee compliance with this Privacy Policy and applicable data protection legislation. You may contact the DPO at any time with questions, requests, or concerns regarding how we handle your personal data:

3. Personal Data We Collect

We collect personal data about you when you interact with our website, make a booking, stay at our hotel, use our casino facilities, or communicate with us. The categories of personal data we collect include, but are not limited to, the following:

3.1 Identity and Contact Information

• Full name (first name, last name, title)
• Date of birth and age verification data
• Gender (where voluntarily provided)
• Nationality and passport or government-issued identification details (required for hotel check-in and casino compliance)
• Email address
• Telephone number(s)
• Postal address and billing address

3.2 Reservation and Stay Information

• Booking reference numbers and reservation details
• Check-in and check-out dates
• Room type, preferences and special requests
• Number and ages of guests accompanying you
• Loyalty programme membership number and history
• Previous stay history and guest preferences

3.3 Payment and Financial Information

• Payment card type, number (partially masked), expiry date and cardholder name
• Bank account details (where applicable for direct debit or refunds)
• Transaction history, invoices and receipts
• Anti-money laundering (AML) and Know Your Customer (KYC) documentation as required by applicable gaming legislation

3.4 Casino and Gaming Information

• Casino membership or player card number
• Gaming activity records, including games played, amounts wagered, wins and losses
• Responsible gambling self-exclusion records and interaction history
• Identity verification documents required under the Interactive Gambling Act 2001 (Cth) and Queensland gaming legislation
• Source of funds declarations (where required by law)

3.5 Technical and Usage Data

• Internet Protocol (IP) address
• Browser type and version
• Operating system and device type
• Referral URL and pages visited on our website
• Date and time of access
• Cookie identifiers and similar tracking technologies (see Section 10)
• Session duration and clickstream data

3.6 Communication and Preference Data

• Records of correspondence, emails, live chat transcripts and telephone call logs
• Marketing preferences and opt-in/opt-out records
• Survey responses, feedback and reviews

3.7 Special Categories of Personal Data

In certain circumstances, we may process special categories of personal data as defined under Article 9 of the GDPR. This may include:

• Health data: information about dietary requirements, allergies, mobility or accessibility needs, or medical conditions that you voluntarily provide to enable us to accommodate your needs during your stay.
• Biometric data: where we use access control systems that involve biometric identification, with your explicit prior consent.

We will only process special categories of personal data where we have obtained your explicit consent (Article 9(2)(a) GDPR) or where processing is necessary for reasons of substantial public interest in accordance with applicable law (Article 9(2)(g) GDPR). You may withdraw consent for the processing of special category data at any time without affecting any prior processing carried out on the basis of that consent.

3.8 Data Collected from Third Parties

We may also receive personal data about you from third parties, including:

• Online travel agencies (OTAs) and booking platforms (e.g., Booking.com, Expedia, Hotels.com)
• Corporate travel management companies
• Regulatory and law enforcement authorities
• Credit reference and fraud prevention agencies
• Social media platforms (where you interact with our social media pages)

4. Legal Basis for Processing Your Personal Data

We process your personal data only where we have a valid legal basis to do so. In accordance with Article 6 of the GDPR, the legal bases upon which we rely are as follows:

4.1 Performance of a Contract (Article 6(1)(b) GDPR)

Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract. This applies when we:

• Process your reservation and booking information
• Manage your hotel stay, room allocation and guest services
• Process payments for accommodation, dining, spa and casino services
• Manage your casino membership and gaming account
• Administer your loyalty programme membership

4.2 Compliance with a Legal Obligation (Article 6(1)(c) GDPR)

Processing is necessary for compliance with a legal obligation to which we are subject as a data controller. This applies when we:

• Verify the identity of guests and casino patrons in accordance with Australian gaming and anti-money laundering legislation
• Maintain financial and accounting records as required by tax law
• Comply with responsible gambling obligations, including self-exclusion registers
• Respond to lawful requests from regulatory authorities, law enforcement, or courts
• Comply with health, safety and fire regulation obligations
• Process and respond to formal complaints in accordance with consumer protection law

4.3 Legitimate Interests (Article 6(1)(f) GDPR)

Processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. We rely on this basis for:

• Fraud prevention and detection, including analysis of gaming transactions for suspicious activity
• Network and information security, including monitoring of our IT systems
• Improving our website functionality and guest experience
• Conducting internal analytics and business intelligence to enhance our services
• Operating closed-circuit television (CCTV) systems on our premises for the safety and security of guests, staff and assets
• Personalising your experience based on your previous stays and preferences
• Sending service-related communications, such as pre-arrival information and post-stay surveys
• Managing and defending legal claims

Where we rely on legitimate interests, we have carried out a balancing test to ensure that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see Section 9).

4.4 Consent (Article 6(1)(a) GDPR)

Where we rely on your consent as the legal basis for processing, we will request your consent in a clear, specific and informed manner. You may withdraw your consent at any time without detriment. We rely on consent for:

• Sending you direct marketing communications, including promotional emails, newsletters and special offers
• Placing non-essential cookies and similar tracking technologies on your device (see Section 10)
• Processing special category data (e.g., health data for accessibility purposes)
• Sharing your data with selected third-party partners for joint marketing purposes

4.5 Vital Interests (Article 6(1)(d) GDPR)

In exceptional circumstances, we may process personal data where it is necessary to protect your vital interests or those of another person, for example, in a medical emergency occurring on our premises.

4.6 Public Task (Article 6(1)(e) GDPR)

We may process personal data where necessary for the performance of a task carried out in the public interest or in the exercise of official authority, for example, in the context of regulatory compliance related to casino licensing and gambling oversight.

5. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

5.1 Hotel Operations and Guest Services

• Processing and managing your hotel reservation
• Facilitating your check-in and check-out
• Allocating rooms and fulfilling special requests (e.g., accessibility needs, dietary requirements)
• Providing concierge, room service, spa, dining and other ancillary services
• Managing your account if you are a loyalty programme member
• Communicating with you before, during and after your stay

5.2 Casino and Gaming Operations

• Verifying your identity and age for the purposes of casino access
• Managing your casino membership and player account
• Monitoring gaming activity for responsible gambling purposes, including detecting problematic gambling patterns
• Administering self-exclusion programmes and complying with exclusion orders
• Fulfilling anti-money laundering (AML) and counter-terrorism financing (CTF) obligations
• Maintaining gaming records as required by Queensland gaming regulations and federal legislation

5.3 Payment Processing and Financial Management

• Processing payments for all services, including authorising payment cards and processing refunds
• Issuing invoices and maintaining financial records
• Detecting and preventing fraudulent transactions

5.4 Marketing and Personalisation

• Sending you marketing communications about our offers, promotions, events and new services (where you have consented or we otherwise have a lawful basis to do so)
• Personalising your experience on our website and during your stay based on your preferences and history
• Conducting customer satisfaction surveys and collecting feedback
• Managing competitions, prize draws and promotions

5.5 Legal, Safety and Security Purposes

• Operating CCTV systems on our premises for the safety and security of guests and staff
• Investigating and resolving complaints, disputes and legal claims
• Complying with all applicable legal and regulatory requirements
• Preventing, detecting and investigating criminal activity, including fraud, theft and cheating at gaming
• Sharing information with law enforcement or regulatory authorities where required by law

5.6 Business Improvement and Analytics

• Analysing website traffic and usage patterns to improve our online presence
• Carrying out internal research and analytics to improve the quality of our services
• Testing and developing new products, services and features

6. Sharing Your Personal Data

We do not sell, rent or trade your personal data to third parties for their own marketing purposes. We may, however, share your personal data with the following categories of recipients where necessary and where a valid legal basis exists:

6.1 Service Providers and Data Processors

We engage third-party service providers to perform functions on our behalf. These providers act as data processors and are contractually bound to process your data only on our instructions and in accordance with applicable data protection law. They include:

• Payment processing and gateway providers
• Cloud hosting and IT infrastructure providers
• Customer relationship management (CRM) software providers
• Email marketing and communication platforms
• Online booking engine and property management system providers
• Casino gaming system operators
• Website analytics and performance monitoring services
• CCTV monitoring and security services
• Legal, accounting and auditing firms

6.2 Online Travel Agencies and Distribution Partners

Where you make a reservation through a third-party online travel agency or booking platform, we may receive your data from that platform and, in some cases, share confirmation and reservation data with them for the purpose of managing your booking.

6.3 Regulatory Authorities and Law Enforcement

We may disclose your personal data to:

• Queensland Office of Liquor and Gaming Regulation (OLGR)
• Australian Transaction Reports and Analysis Centre (AUSTRAC)
• Australian Taxation Office (ATO)
• Police and other law enforcement authorities
• Courts, tribunals and other judicial or quasi-judicial bodies

Such disclosures will only be made where required by applicable law, pursuant to a court order, or where necessary for the prevention or detection of crime.

6.4 Fraud Prevention and Credit Reference Agencies

We may share your data with fraud prevention agencies and credit reference agencies for the purposes of verifying your identity, preventing fraud and managing financial risk. These agencies may retain records of our enquiries.

6.5 Business Transfers

In the event of a merger, acquisition, restructuring, sale of assets or other business transfer involving , your personal data may be transferred to the relevant third parties as part of that transaction. We will notify you of any such change in controller by updating this Privacy Policy and, where required, by providing direct notice.

6.6 International Transfers

is based in Australia. Some of our third-party service providers may be located or operate in countries outside Australia and the European Economic Area (EEA). Where we transfer personal data internationally, we ensure that appropriate safeguards are in place in accordance with Articles 44–49 of the GDPR, including:

• Transfers to countries that have received an adequacy decision from the European Commission
• Use of Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules (BCRs) where applicable
• Your explicit consent to the transfer (Article 49(1)(a) GDPR), where appropriate

You may request a copy of the safeguards we have put in place for international transfers by contacting our DPO.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention periods are determined with reference to the nature of the data, the purpose of processing and our legal obligations. The following indicative retention periods apply:

At the end of the applicable retention period, personal data will be securely deleted, destroyed or anonymised. Where data is retained beyond standard periods for the purposes of pending or anticipated litigation, we will notify you where required by law.

8. Your Rights Under the GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the GDPR with respect to your personal data. We will respond to all valid requests within one calendar month of receipt. In complex cases or where we receive multiple requests, we may extend this period by a further two months, in which case we will inform you accordingly.

8.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we process personal data about you and, if so, to receive a copy of that data along with information about how it is processed. This is commonly known as a "Subject Access Request" (SAR).

8.2 Right to Rectification (Article 16 GDPR)

You have the right to request that we correct any inaccurate personal data we hold about you and to have incomplete data completed.

8.3 Right to Erasure ("Right to be Forgotten") (Article 17 GDPR)

You have the right to request the deletion of your personal data where:

• The data is no longer necessary for the purpose for which it was collected
• You withdraw consent on which the processing was based and no other legal basis exists
• You object to the processing and there are no overriding legitimate interests
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

Please note that this right is not absolute. We may retain your data where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

8.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, including while we verify the accuracy of your data or consider an objection you have raised.

8.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to request that we transmit that data to another controller where technically feasible.

8.6 Right to Object (Article 21 GDPR)

You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. You also have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time. Upon receipt of an objection to direct marketing, we will cease such processing immediately.

8.7 Rights in Relation to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you. Where we use automated decision-making processes (for example, in fraud detection or responsible gambling monitoring), you have the right to request human review of such decisions, to express your point of view and to contest the decision.

8.8 Right to Withdraw Consent (Article 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

8.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes the GDPR. If you are located in the EEA, you may contact the relevant supervisory authority in your EU member state of residence, place of work or place of the alleged infringement. If you are located in Australia, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

We encourage you to contact us directly in the first instance so that we may address your concerns before you approach a supervisory authority.

8.10 How to Exercise Your Rights

To exercise any of your rights listed above, please submit a written request to our Data Protection Officer by:

• Email: info@dravonteprestigeinn.com
• Post: The Data Protection Officer, ,

We may need to verify your identity before processing your request. We will not charge a fee for handling your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act on the request, in accordance with Article 12(5) GDPR.

9. Security of Your Personal Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, alteration or disclosure. These measures include, but are not limited to:

• Encryption of personal data in transit using Transport Layer Security (TLS/SSL) technology
• Encryption of sensitive data at rest
• Role-based access controls and authentication procedures limiting access to personal data to authorised personnel only
• Regular security assessments, penetration testing and vulnerability scanning
• Staff training on data protection and information security
• Physical access controls at our premises and data facilities
• Incident response and data breach notification procedures
• Data minimisation and pseudonymisation where appropriate

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay in accordance with Article 34 GDPR.

Please note that no method of transmission over the internet or electronic storage is completely secure. Whilst we use commercially reasonable means to protect your personal data, we cannot guarantee absolute security.

10. Cookies and Similar Technologies

Our website dravonteprestigeinn.com uses cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic and support our marketing activities. Cookies are small text files that are placed on your device when you visit a website.

We use the following categories of cookies:

• Strictly Necessary Cookies: These are essential for the operation of our website and enable core functions such as page navigation, access to secure areas and online booking. They cannot be disabled.
• Performance and Analytics Cookies: These cookies collect information about how visitors use our website, including which pages are visited most frequently. We use this information to improve our website. These cookies are only placed with your consent.
• Functionality Cookies: These cookies enable us to remember your preferences and personalise your experience on our website. These cookies are only placed with your consent.
• Targeting and Advertising Cookies: These cookies are used to deliver advertising relevant to your interests and to measure the effectiveness of our marketing campaigns. These cookies are only placed with your explicit consent.

When you first visit our website, you will be presented with a cookie consent banner giving you the option to accept or decline non-essential cookies. You may withdraw or change your cookie consent at any time by accessing our Cookie Preference Centre on the website or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

For full details of the cookies we use, including their names, purposes and durations, please refer to our Cookie Policy, which is available on our website.

11. Children and Minors

Our hotel and casino services are intended for adults only. The casino facilities at Dravonte Prestigeinn are strictly restricted to persons aged 18 years and over in accordance with Queensland gaming legislation. We do not knowingly collect or process personal data relating to children under the age of 18 for casino-related purposes.

Where children accompany guests at the hotel, we collect only the minimum personal data necessary (such as the number of children and any relevant dietary or accessibility needs) for the purpose of providing our hotel services, with parental or guardian consent.

Our website is not directed at children under the age of 18. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take immediate steps to delete that information.

12. Third-Party Links

Our website may contain links to third-party websites, social media platforms, booking platforms and other online services. These third-party websites operate independently of us and have their own privacy policies. We are not responsible for the privacy practices or content of those third-party websites. We encourage you to review the privacy policies of any third-party websites you visit.

13. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legislation, or for other operational, legal or regulatory reasons. Where we make material changes to this Privacy Policy, we will notify you by posting a prominent notice on our website and, where appropriate, by sending you a direct notification by email.

The date at the top of this Privacy Policy indicates when it was last updated. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

14. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or the way in which we handle your personal data, please contact our Data Protection Officer using the details below:

We are committed to working with you to resolve any concerns you may have about our use of your personal data. If, however, you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority, as described in Section 8.9 above.