1. Data Controller

The entity responsible for processing your personal data (the "Data Controller") is:

If you have any questions or concerns about how your personal data is handled, you may contact us at any time using the details provided above or in Section 11 of this Policy.

2. Data Protection Officer (DPO)

We have appointed a Data Protection Officer to oversee our data protection strategy and ensure compliance with applicable data protection legislation. You may contact our DPO directly at:

3. Scope and Applicability

This Privacy Policy applies to all personal data collected by through the following channels:

• Our official website at velquorianprestigehouse.com, including all sub-pages, reservation portals, and online forms;
• On-property interactions at our hotel-casino located in Stratford, Canada;
• Casino floor operations, loyalty programme enrolment, and gaming activities;
• Telephone, email, and written correspondence with our staff;
• Social media platforms and online advertising channels operated by or on behalf of Velquorianprestigehouse;
• Third-party booking platforms and travel agencies that refer guests to us;
• CCTV and security monitoring systems on our premises.

This Policy applies to guests, visitors, online users, job applicants, casino patrons, loyalty programme members, business partners, and any other individuals whose personal data we process. It does not apply to the websites of third parties that may be linked from our website; we are not responsible for the privacy practices of those external sites.

4. Personal Data We Collect

We collect a variety of personal data depending on the nature of your interaction with us. The categories of personal data we may collect include, but are not limited to, the following:

4.1 Identity and Contact Data

• Full name (first name, middle name, last name);
• Date of birth and age verification information;
• Gender;
• Nationality and country of residence;
• Passport, national identity card, or driving licence number and copies (required by law for check-in and casino regulatory compliance);
• Home address, billing address, and correspondence address;
• Email address(es);
• Telephone and mobile phone numbers.

4.2 Reservation and Booking Data

• Check-in and check-out dates;
• Room type, number of guests, and special room preferences;
• Booking reference numbers and confirmation codes;
• Source of booking (direct, travel agency, online travel agent);
• Special requests, including dietary requirements and accessibility needs;
• Loyalty or rewards programme membership number.

4.3 Financial and Payment Data

• Credit card, debit card, or other payment instrument details (card number, expiry date, cardholder name — processed securely via PCI-DSS compliant payment processors);
• Bank account details where applicable;
• Billing history, invoices, and receipts;
• Casino credit accounts, casino chips, and gaming wallet balances;
• Details of deposits, withdrawals, and financial transactions made at our casino.

4.4 Casino and Gaming Data

• Casino patron registration data, including government-issued identification details as required by law;
• Gaming activity records, including games played, stakes, wins, and losses;
• Responsible gaming declarations, self-exclusion requests, and spending limit settings;
• Anti-money laundering (AML) and Know Your Customer (KYC) documentation;
• Source of funds declarations where legally required;
• Casino loyalty points, tier status, and redemption history.

4.5 Health and Special Category Data

• Dietary requirements and food allergies (where voluntarily disclosed to facilitate catering services);
• Accessibility and disability-related requirements (where voluntarily disclosed to arrange appropriate accommodations);
• Medical information shared with us in an emergency situation on our premises.

We treat all health-related and special category data with the highest level of care and process such data only where we have a specific legal basis as described in Section 5 below. We will never process special category data for marketing purposes without your explicit consent.

4.6 Technical and Usage Data

• IP address and approximate geolocation derived from IP address;
• Browser type, version, and operating system;
• Device identifiers and device type;
• Pages visited, time spent on each page, and navigation path through our website;
• Referring URL (the website that directed you to ours);
• Cookie identifiers and similar tracking technology data (see Section 10 for our Cookie Policy);
• Log files and server access logs.

4.7 Communication Data

• Records of email, telephone, and written correspondence with our guest services, reservations, and casino teams;
• Call recordings where you have been notified that calls are recorded for training and quality purposes;
• Online chat and messaging interactions on our website or social media channels;
• Guest feedback, reviews, and survey responses.

4.8 Marketing and Preference Data

• Marketing preferences and opt-in or opt-out records;
• Lifestyle preferences, interests, and favourite amenities (where disclosed by you);
• Loyalty programme activity and preferences;
• Response rates to marketing campaigns, including email open and click-through rates.

4.9 Security and Surveillance Data

• CCTV footage and images captured on our hotel and casino premises for security purposes;
• Access control records for restricted areas of the property;
• Incident reports, security logs, and details of any accidents, complaints, or incidents on our premises.

4.10 Data Collected from Third Parties

We may also receive personal data about you from the following third-party sources:

• Online travel agents, global distribution systems, and third-party booking platforms (e.g., Booking.com, Expedia, and similar services);
• Travel agents and corporate travel managers making reservations on your behalf;
• Regulatory and law enforcement authorities as required or permitted by law;
• Credit reference agencies and fraud prevention services;
• Social media platforms where you interact with our official accounts or use social login features;
• Marketing data providers, where you have given your consent to that provider to share your information with businesses such as ours.

5. Legal Basis for Processing Personal Data

In accordance with Article 6 of the GDPR, we only process your personal data where we have a valid legal basis to do so. The legal bases we rely upon are set out below, along with specific examples of processing activities associated with each basis:

5.1 Performance of a Contract (Article 6(1)(b) GDPR)

We process personal data where it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. This includes:

• Processing your reservation and managing your hotel stay;
• Providing access to casino facilities under our terms and conditions;
• Processing payments for accommodation, dining, gaming, and other services;
• Administering loyalty programme membership and benefits;
• Responding to pre-booking enquiries and special requests;
• Managing cancellations, amendments, and refunds.

5.2 Compliance with a Legal Obligation (Article 6(1)(c) GDPR)

We process personal data where processing is necessary for compliance with a legal obligation to which we are subject. This includes:

• Verifying the identity and age of casino patrons as required by Canadian gaming regulations and applicable provincial law;
• Conducting Anti-Money Laundering (AML) checks and Know Your Customer (KYC) verification as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and related regulations;
• Collecting and retaining guest identity information as required by immigration and hotel registration laws;
• Maintaining financial records for tax, accounting, and audit purposes as required by the Income Tax Act and GST/HST regulations;
• Responding to lawful requests from regulatory bodies, law enforcement agencies, or courts;
• Complying with self-exclusion and responsible gambling obligations under applicable gaming regulations;
• Reporting obligations to gaming regulators and financial intelligence units.

5.3 Legitimate Interests (Article 6(1)(f) GDPR)

We process personal data where it is necessary for the purposes of our legitimate interests, or those of a third party, except where such interests are overridden by your fundamental rights and freedoms. Our legitimate interests include:

• Ensuring the security of our hotel, casino premises, staff, and guests through CCTV monitoring and access control systems;
• Preventing and detecting fraud, theft, cheating, and other criminal activity on our premises and through our website;
• Analysing website traffic and user behaviour to improve our website and online services;
• Sending direct marketing communications by email or post to existing customers who have not opted out (subject to applicable rules on direct marketing);
• Administering and improving our loyalty programme;
• Managing and resolving complaints, disputes, and legal claims;
• Conducting internal audits and quality assurance activities;
• Maintaining business records necessary for the effective administration of our business.

Where we rely on legitimate interests, we always conduct a balancing test to ensure that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see Section 9).

5.4 Consent (Article 6(1)(a) GDPR)

Where none of the above bases apply, or where we are required by law to obtain your consent, we will ask for your freely given, specific, informed, and unambiguous consent before processing your personal data. This includes:

• Sending marketing communications by email, SMS, or telephone to individuals who are not existing customers;
• Using non-essential cookies and similar tracking technologies on our website (see Section 10);
• Processing special category data such as health information for personalised services beyond those strictly necessary to perform our contract;
• Sharing your personal data with selected third-party partners for their own marketing purposes (we will only do this with your explicit consent).

Where we rely on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before your withdrawal. To withdraw consent, please contact us at privacy@velquorianprestigehouse.com.

5.5 Vital Interests (Article 6(1)(d) GDPR)

In exceptional circumstances, we may process personal data where it is necessary to protect your vital interests or the vital interests of another person. This would typically arise in the context of a medical emergency on our premises, where sharing relevant personal data with emergency medical services is necessary to protect life.

5.6 Public Task (Article 6(1)(e) GDPR)

We may process personal data where necessary for the performance of a task carried out in the public interest or in the exercise of official authority. This basis may apply where we cooperate with gaming regulators, law enforcement, or other public authorities in their official capacity.

5.7 Legal Basis for Special Category Data

Where we process special category data (such as health or disability information), we rely on the following conditions under Article 9 GDPR in addition to an Article 6 legal basis:

• Explicit consent (Article 9(2)(a)): Where you have explicitly consented to the processing of your special category data for one or more specified purposes;
• Vital interests (Article 9(2)(c)): Where processing is necessary to protect your vital interests or those of another person and you are physically or legally incapable of giving consent (e.g., a medical emergency);
• Legal claims (Article 9(2)(f)): Where processing is necessary for the establishment, exercise, or defence of legal claims.

6. How We Use Your Personal Data

We use the personal data we collect for the following specific purposes:

6.1 Providing Hotel Services

• Processing, confirming, and managing accommodation bookings and reservations;
• Facilitating check-in and check-out processes, including identity verification;
• Providing in-room services, housekeeping, concierge, dining, spa, and all other hotel amenities;
• Responding to special requests, accessibility needs, and dietary requirements;
• Sending booking confirmation emails, pre-arrival information, and post-stay follow-ups;
• Processing payments and issuing invoices, receipts, and credit notes.

6.2 Providing Casino Services

• Registering and verifying casino patrons in accordance with gaming regulatory requirements;
• Managing access to the casino floor and gaming facilities;
• Processing casino financial transactions, including chip exchanges, cage transactions, and winnings payments;
• Administering responsible gaming measures including self-exclusion programmes and spending limits;
• Conducting mandatory AML/KYC checks and reporting obligations;
• Investigating and responding to disputes, complaints, and gaming irregularities.

6.3 Loyalty Programme Administration

• Enrolling members and managing their loyalty programme accounts;
• Tracking and crediting points for qualifying hotel stays, dining, and casino activity;
• Processing points redemptions for rewards, upgrades, and complimentary services;
• Sending personalised member communications, offers, and tier status updates.

6.4 Marketing and Promotions

• Sending you information about our services, special offers, events, and promotions where you have opted in or where we have a legitimate interest to do so;
• Tailoring marketing messages based on your preferences, past stays, and gaming activity;
• Conducting market research and guest satisfaction surveys (participation is always voluntary);
• Managing our social media presence and online advertising campaigns.

6.5 Security and Safety

• Operating and monitoring CCTV systems on our hotel and casino premises to ensure the safety of guests, staff, and property;
• Preventing, detecting, and investigating fraud, theft, cheating, money laundering, and other criminal activities;
• Managing access control to restricted areas of our property;
• Responding to and documenting security incidents, accidents, and emergencies.

6.6 Legal and Regulatory Compliance

• Complying with all applicable laws and regulations, including gaming law, AML/KYC regulations, tax law, and employment law;
• Responding to lawful requests from government authorities, regulators, or law enforcement agencies;
• Establishing, exercising, or defending legal claims;
• Maintaining accurate financial and guest records for audit and compliance purposes.

6.7 Website and Service Improvement

• Analysing how visitors use our website in order to improve its content, design, and functionality;
• Diagnosing and resolving technical problems with our website and IT systems;
• Conducting A/B testing and user experience research to optimise online booking processes;
• Monitoring and improving the quality of our services based on guest feedback and reviews.

7. How We Share Your Personal Data

We do not sell your personal data to third parties. We may share your personal data with third parties only in the circumstances described below, and always subject to appropriate contractual or legal safeguards.

7.1 Service Providers and Data Processors

We engage trusted third-party service providers to assist us in delivering our services. These parties act as data processors on our behalf and are contractually required to process your data only on our instructions and in accordance with our Privacy Policy. They include:

• Payment processors: To securely process credit card and other payment transactions (processed in compliance with PCI-DSS standards);
• Cloud and IT infrastructure providers: To host our website, property management system, casino management system, and loyalty programme platform;
• Email and communication service providers: To send booking confirmations, marketing communications, and transactional notifications;
• CCTV and security system operators: To maintain and monitor our security infrastructure;
• Marketing and analytics agencies: To help us plan, execute, and measure marketing campaigns and website analytics;
• Customer relationship management (CRM) platform providers;
• Online booking platform operators (where applicable).

7.2 Business Partners

We may share limited personal data with carefully selected business partners, such as:

• Hotel group members or affiliate properties within the same corporate group as , where relevant for loyalty programme administration or group-wide guest services;
• Travel agents and tour operators through whose platforms you made your booking, to the extent necessary to fulfil the booking;
• Restaurants, entertainment venues, and other hospitality partners on our premises, strictly for the purpose of fulfilling your requests and reservations.

7.3 Regulatory and Law Enforcement Authorities

We may disclose your personal data to regulatory bodies, law enforcement agencies, gaming authorities, financial intelligence units, or courts where we are legally required or permitted to do so. This includes:

• Disclosures to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act;
• Disclosures to provincial gaming regulatory bodies as required by applicable gaming licences and regulations;
• Responses to court orders, warrants, or legal proceedings;
• Cooperation with law enforcement investigations where we have a legal obligation or lawful basis to do so.

7.4 Professional Advisers

We may share your personal data with our professional advisers including lawyers, auditors, accountants, and insurers where necessary for them to provide their services to us, subject to strict confidentiality obligations.

7.5 Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, or insolvency proceedings involving , your personal data may be transferred to a successor entity or prospective purchaser as part of the transaction. We will take reasonable steps to ensure that any successor entity honours the commitments made in this Privacy Policy. Where required by applicable law, we will notify you of such a transfer.

7.6 International Transfers

Some of our service providers and partners may be located outside Canada or the European Economic Area (EEA). Where we transfer personal data internationally, we ensure that appropriate safeguards are in place to protect your data, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Transfers to countries that the European Commission has determined provide an adequate level of data protection;
• Binding Corporate Rules where applicable;
• Compliance with PIPEDA rules on cross-border data transfers, including ensuring that recipients provide comparable protection.

You may request details of the specific safeguards in place for any particular international transfer by contacting us at privacy@velquorianprestigehouse.com.

8. Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law, regulation, or legitimate business need. Our retention periods are determined based on the following criteria:

• The nature of the personal data and its sensitivity;
• The purpose for which it was collected and whether that purpose has been fulfilled;
• Legal, regulatory, and contractual retention obligations applicable to our business as a hotel and casino operator;
• The potential risks and consequences of retaining or deleting the data too early or too late.

The following table provides a general guide to our key retention periods:

At the end of the applicable retention period, personal data is securely deleted, anonymised, or destroyed in accordance with our internal data deletion procedures. Where data cannot be immediately deleted due to technical constraints, we will ensure that it is restricted from further processing until deletion is possible.

9. Your Data Protection Rights

Depending on your location and the applicable data protection laws, you may have a number of rights with respect to your personal data. We are committed to enabling you to exercise these rights effectively. Your rights under the GDPR include:

9.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we process personal data about you and, if so, to receive a copy of that data along with information about how it is used (a "Subject Access Request" or SAR). We will respond to your request within one calendar month, which may be extended by a further two months where the request is complex or numerous.

9.2 Right to Rectification (Article 16 GDPR)

You have the right to request that we correct any inaccurate personal data we hold about you, or complete any incomplete data, without undue delay.

9.3 Right to Erasure / Right to be Forgotten (Article 17 GDPR)

You have the right to request the deletion of your personal data where one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was collected;
• You withdraw your consent and there is no other legal basis for processing;
• You object to the processing and there are no overriding legitimate grounds;
• The personal data has been unlawfully processed;
• The personal data must be erased to comply with a legal obligation.

Please note that this right is not absolute; we may need to retain certain data to comply with legal obligations (for example, AML/KYC records or tax records).

9.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in the following circumstances:

• You contest the accuracy of the personal data while we verify it;
• The processing is unlawful and you oppose erasure and request restriction instead;
• We no longer need the data but you need us to retain it for legal claims;
• You have objected to processing based on legitimate interests, pending verification of whether our legitimate grounds override yours.

9.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

9.6 Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data where it is based on our legitimate interests (Article 6(1)(f) GDPR). Upon receiving your objection, we will cease processing unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

You also have an absolute right to object to your personal data being processed for direct marketing purposes at any time, and without any justification. We will honour all such objections without delay.

9.7 Rights in Relation to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you. Where we engage in any automated decision-making that may significantly affect you (for example, automated fraud detection or responsible gaming triggers), we will notify you and, where required, obtain your explicit consent or ensure that appropriate human oversight is in place.

9.8 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. To withdraw your consent, please contact us at privacy@velquorianprestigehouse.com or use the unsubscribe link in any marketing email.

9.9 How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to our Data Protection Officer using the contact details set out in Section 11. We may need to verify your identity before processing your request. We will not charge a fee for processing your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to respond.

We will respond to all valid requests within one calendar month of receipt. Where requests are complex or numerous, we may extend this period by a further two months and will notify you accordingly.

9.10 Right to Lodge a Complaint

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority. In Canada, the applicable authority is:

• Office of the Privacy Commissioner of Canada (OPC)
  30 Victoria Street, Gatineau, Quebec K1A 1H3, Canada
  Website: www.priv.gc.ca
  Telephone: 1-800-282-1376

If you are located in the European Economic Area (EEA), you may also have the right to lodge a complaint with the data protection supervisory authority in your country of residence or place of work.

We would, however, appreciate the opportunity to address your concerns directly before you approach a supervisory authority, and we encourage you to contact us in the first instance.

10. Cookies and Tracking Technologies

Our website at velquorianprestigehouse.com uses cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic, and deliver relevant content and advertising.

10.1 What Are Cookies?

Cookies are small text files that are placed on your device by websites when you visit them. They are widely used to make websites function efficiently and to provide information to website owners. Cookies can be "session cookies" (deleted when you close your browser) or "persistent cookies" (which remain on your device for a set period or until you delete them).

10.2 Types of Cookies We Use

• Strictly Necessary Cookies: These are essential for the website to function and cannot be switched off in our systems. They are usually set in response to actions you take, such as setting your privacy preferences, logging in, or filling in forms. These cookies do not require your consent.
• Performance and Analytics Cookies: These cookies collect information about how visitors use our website, such as which pages are visited most often and whether visitors receive error messages. We use this data to improve the website. These cookies require your consent.
• Functionality Cookies: These cookies allow the website to remember choices you make (such as your language preference or region) and provide enhanced, more personalised features. These cookies require your consent.
• Targeting and Advertising Cookies: These cookies may be set through our website by our advertising partners to build a profile of your interests and show you relevant adverts on other sites. They do not directly store personal data but uniquely identify your browser and internet device. These cookies require your consent.

10.3 Managing Your Cookie Preferences

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You may change your cookie preferences at any time by accessing the cookie settings tool available on our website. You can also control and delete cookies through your browser settings. Please note that if you disable certain cookies, some parts of our website may not function correctly.

For more information about cookies and how to manage them, please visit www.allaboutcookies.org.

11. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

• Encryption of data in transit using TLS (Transport Layer Security) protocols;
• Encryption of sensitive data at rest;
• PCI-DSS compliant payment processing systems for all card transactions;
• Access controls and role-based permissions to limit access to personal data to authorised personnel only;
• Regular security assessments, vulnerability testing, and penetration testing;
• Staff training on data protection and information security;
• Incident response and data breach notification procedures;
• Physical security measures at our hotel and casino premises.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with our obligations under applicable data protection law, and will notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

While we take all reasonable steps to protect your personal data, no data transmission over the internet or electronic storage system is completely secure. You are responsible for keeping your account credentials confidential and for ensuring the security of your own devices.

12. Children's Privacy

Our casino services are strictly restricted to individuals who are of legal gambling age in the applicable jurisdiction. We do not knowingly collect personal data from individuals under the age of 19 in connection with our casino operations.

Our hotel services may accommodate families with children; however, we do not intentionally collect personal data directly from children under the age of 16. Where a parent or guardian makes a reservation that includes children as guests, any data relating to the child is provided by and collected from the parent or guardian.

If you believe that we have inadvertently collected personal data from a child under the age of 16, please contact us immediately at privacy@velquorianprestigehouse.com and we will take prompt steps to delete such information.

13. Third-Party Links and Services

Our website may contain links to third-party websites, social media platforms, and services that are not operated or controlled by We are not responsible for the privacy practices of those third-party websites. When you click on a link to a third-party site, you do so at your own risk, and we encourage you to review the privacy policy of every website you visit.

Our website may include social media features (such as "Share" or "Like" buttons) and widgets from platforms such as Facebook, Instagram, and X (formerly Twitter). These features may collect your IP address and set cookies. Your interactions with these features are governed by the privacy policies of the companies providing them.

14. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our business practices, legal requirements, or technological developments. When we make material changes to this Policy, we will:

• Update the "Last updated" date at the top of this page;
• Post the revised Policy prominently on our website at velquorianprestigehouse.com;
• Where required by law or where the changes materially affect your rights, notify you directly by email or by a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website or services after any changes to this Policy are posted constitutes your acknowledgement of the revised Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your personal data, please do not hesitate to contact us:

We are committed to resolving any privacy concerns you may have promptly and transparently. Please allow up to 30 days for a response, though we will endeavour to address your enquiry as quickly as possible.