1. Scope of this policy

This policy explains how personal data is handled by the operator of superiuusi.com and of the casino resort, hotel, restaurants, theatre and spa at Kaskirannankatu 14, 00570 Helsinki, Finland. It applies to this website, to enquiries made by telephone or email, to bookings, to membership accounts and, from opening, to visits to the property itself. Where a service is operated on our behalf by a third party, that party acts as our processor under a written agreement and may not use your data for its own purposes.

The operator is the data controller. Contact details for privacy matters are: Kaskirannankatu 14, Kaskiranta Quay, 00570 Helsinki, Finland; telephone +358 9 4245 8800; email support@superiuusi.com marked “For the DPO”.

2. Categories of personal data we collect

2.1 Data you give us

• Identity data: full name, date of birth, nationality, and the details of the photo identification you present on entry.
• Contact data: postal address, email address, telephone number.
• Booking data: arrival and departure dates, room preferences, dietary requirements, accessibility requirements, party composition.
• Payment data: card token, billing address and transaction records. We do not store full card numbers; card data is captured directly by our payment processor.
• Communication data: the content of emails, contact forms, letters and recorded telephone calls with our teams.
• Preference data: marketing choices, limit settings, membership tier, and any self-exclusion instruction you give us.

2.2 Data generated by your use of our services

• Play data: card-tracked wagering, session duration, machine and table identifiers, and cash-desk transactions.
• Financial-crime data: source-of-funds evidence and transaction monitoring records required by anti-money-laundering law.
• Security data: closed-circuit television footage of public and gaming areas, entry and exit logs, and incident reports.
• Technical data: IP address, browser type and version, device type, operating system, referring page, and pages viewed on this website.

2.3 Data from third parties

We receive data from identity verification providers, from the national self-exclusion register, from payment processors, from anti-money-laundering screening services including politically exposed person and sanctions lists, and from booking partners where you reserved through them rather than directly.

3. Why we use your data and on what legal basis

• To provide what you booked — rooms, tables, meals, tickets, membership. Legal basis: performance of a contract.
• To verify age and identity at entry. Legal basis: legal obligation, and substantial public interest.
• To operate self-exclusion, limits and player protection. Legal basis: legal obligation and vital interests, supported by our licence conditions.
• To prevent money laundering, fraud, cheating and advantage play. Legal basis: legal obligation and legitimate interests in protecting the integrity of our games.
• To keep people and property safe through video surveillance. Legal basis: legitimate interests and legal obligation.
• To send you marketing you asked for. Legal basis: consent, which you may withdraw at any time.
• To improve the website and our services through analytics. Legal basis: consent, given through the cookie banner.
• To handle complaints, disputes and legal claims. Legal basis: legitimate interests and establishment or defence of legal claims.

4. Special category and sensitive data

We do not seek special category data. We will process health-related information you volunteer — an accessibility requirement, an allergy, or a disclosure about gambling harm — only to give you the service or protection you asked for, on the basis of your explicit consent or, where the situation is urgent, to protect vital interests. Records of gambling-harm interventions are kept separately from marketing systems and are never used to target communications at you.

5. Automated decision-making and profiling

We use rule-based monitoring to flag patterns that may indicate gambling harm, money laundering or game manipulation. These systems raise an alert for a trained human being to review; they do not by themselves produce legal or similarly significant effects. No decision to refuse entry, close an account or refuse a transaction is taken by software alone. You have the right to ask how such a decision was reached and to contest it.

6. Who we share data with

We share personal data with: the Finnish gaming supervisory authority and other regulators where required; police and courts on lawful request; the operator of the national self-exclusion register; payment institutions and banks; identity verification and screening providers; hotel, booking and ticketing platforms where you used them; IT hosting, email and customer-service providers; and professional advisers. We do not sell personal data, and we do not share it with advertising networks for their own purposes.

7. International transfers

Our infrastructure is hosted within the European Economic Area. Where a supplier processes data outside the EEA, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses together with a transfer risk assessment and, where necessary, additional technical measures such as encryption in transit and at rest. You may request a copy of the safeguards applied.

8. How long we keep data

• Enquiry and contact-form data: 24 months from last contact.
• Booking and payment records: 6 years from the end of the accounting period, as required by tax and accounting law.
• Identity and anti-money-laundering records: 5 years from the end of the customer relationship, or longer where an authority requires it.
• Play and account data: 5 years from account closure.
• Self-exclusion records: for the duration of the exclusion and 5 years afterwards, so that an exclusion cannot be quietly reversed.
• Video surveillance: 30 days, unless retained for a specific incident, investigation or legal claim.
• Marketing consent records: until consent is withdrawn, plus 2 years to evidence the withdrawal.

9. How we protect your data

We apply technical and organisational measures proportionate to the risk, including encryption of data in transit using current TLS, encryption at rest for identity and payment-related stores, network segmentation between the gaming, hotel and public networks, role-based access control with least-privilege defaults, mandatory multi-factor authentication for staff systems, tamper-evident logging, annual penetration testing by an external firm, and documented incident-response procedures rehearsed twice a year. Staff receive data-protection training on induction and annually thereafter. Where a personal data breach is likely to result in a risk to your rights, we notify the supervisory authority within 72 hours and, where the risk is high, we notify you directly and without undue delay.

10. Your rights

Subject to the conditions in applicable law, you may request access to your data, correction of inaccurate data, erasure, restriction of processing, portability of data you provided to us, and you may object to processing based on legitimate interests or to direct marketing at any time. Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Some rights are limited: we cannot erase records we are legally required to keep, and we will not erase a self-exclusion record while the exclusion is running.

To exercise a right, email support@superiuusi.com with “For the DPO” in the subject line, or write to the postal address above. We respond within one month and may extend by two further months for complex requests, telling you why. We may ask for proof of identity before acting, because handing your data to somebody else would be a worse outcome than a short delay.

11. Children

Our services are not directed at anyone under 18 and we do not knowingly collect data from minors. If we learn that we hold data about a person under 18 who has attempted to use gaming services, we delete it except where a record must be kept to evidence the refusal of entry.

12. Complaints

If you are unhappy with how we have handled your data, tell us first — most issues are resolved quickly. You also have the right to complain to the Finnish Data Protection Ombudsman, or to the supervisory authority in your country of residence or place of the alleged infringement.

13. Changes to this policy

We review this policy at least annually. Material changes will be announced on this page and, where the change affects processing based on consent, we will ask for consent again. The date at the top of this page always reflects the current version.

Part A — GDPR notice for EEA and UK residents

A1. Controller and representative

The operator of superiuusi.com is the controller of personal data described in this notice and is established in Finland, within the European Union. Contact: Kaskirannankatu 14, 00570 Helsinki, Finland; +358 9 4245 8800; support@superiuusi.com. A data protection officer is appointed and reachable at the same address and email, marked “For the DPO”.

A2. Lawful bases we rely on

We process personal data under Article 6(1) GDPR on the bases of contract, legal obligation, legitimate interests, consent and, in narrow circumstances involving player welfare, vital interests. Where we rely on legitimate interests — principally security, fraud prevention, game integrity and service improvement — we have carried out and documented a balancing assessment, and you may request a summary of it.

A3. Your rights in full

• Article 15 — the right of access, including a copy of your data and the information in this notice.
• Article 16 — the right to rectification of inaccurate or incomplete data.
• Article 17 — the right to erasure, subject to our legal retention duties.
• Article 18 — the right to restriction of processing while a dispute is resolved.
• Article 20 — the right to portability of data you supplied, in a structured, machine-readable format.
• Article 21 — the right to object, absolutely in the case of direct marketing.
• Article 22 — the right not to be subject to solely automated decisions with legal or similarly significant effect.
• Article 7(3) — the right to withdraw consent at any time.
• Article 77 — the right to lodge a complaint with a supervisory authority.

A4. Response times and cost

Requests are free. We respond within one month, extendable by two months for complex or numerous requests, with reasons given. Manifestly unfounded or excessive repeat requests may attract a reasonable administrative fee or be refused, with an explanation and information about your right to complain.

A5. Transfers outside the EEA

Where transfers occur, we rely on adequacy decisions or on the 2021 Standard Contractual Clauses, supplemented by a transfer impact assessment and technical measures. UK transfers additionally use the UK International Data Transfer Addendum.

Part B — CCPA and CPRA notice for California residents

B1. Categories collected in the past 12 months

• Identifiers — name, postal address, email, telephone, IP address, government identification number where legally required.
• Personal information under Cal. Civ. Code §1798.80 — signature, financial account information, transaction records.
• Characteristics of protected classifications — age and, where volunteered, disability information for accessibility.
• Commercial information — bookings, purchases, and services considered or received.
• Internet activity — browsing on this site, interaction with our emails.
• Geolocation — approximate location derived from IP address.
• Audio and visual information — recorded calls and CCTV footage on the property.
• Sensitive personal information — government identifiers and, where you provide it, precise financial account information, used only for permitted business purposes.
• Inferences — service preferences drawn from your interactions with us.

B2. Sources, purposes and disclosures

Sources and purposes are as set out in our Privacy Policy. In the past twelve months we have disclosed personal information for business purposes to service providers in hosting, payments, identity verification, ticketing, email delivery and customer support, each bound by a written contract restricting their use of it.

B3. No sale, no sharing for cross-context behavioural advertising

We do not sell personal information, and we have not sold it in the preceding twelve months. We do not share personal information for cross-context behavioural advertising, and we do not knowingly collect or sell the personal information of consumers under 16 years of age.

B4. Your California rights

• The right to know what personal information we collect, use, disclose and retain, and to receive a copy.
• The right to delete personal information, subject to statutory exemptions including record-keeping under gaming and financial law.
• The right to correct inaccurate personal information.
• The right to limit the use and disclosure of sensitive personal information.
• The right to opt out of sale or sharing — although, as stated, we do neither.
• The right to non-discrimination for exercising any of these rights. We will not deny service, charge a different price or provide a lower quality of service because you exercised a right.

B5. How to submit a request

Email support@superiuusi.com with “California privacy request” in the subject line, or call +358 9 4245 8800. We verify requests by matching at least two data points you have previously given us; for deletion requests involving sensitive records we may ask for a signed declaration. An authorised agent may act for you with written permission and proof of identity. We confirm receipt within 10 business days and respond within 45 calendar days, extendable once by a further 45 days with notice.

Part C — Cookies and similar technologies

C1. What we use

This website uses a small number of first-party cookies and equivalent storage technologies. No advertising or cross-site tracking cookies are set at any time, on any page.

C2. Managing your choices

Non-essential cookies are set only after you accept them in the banner shown on your first visit. You can change or withdraw your choice at any time through the cookie settings link in the footer, and rejecting non-essential cookies is exactly as easy as accepting them — one click, on the same screen, with equally prominent buttons. You can also block or delete cookies in your browser settings; strictly necessary cookies are required for the site to function and blocking them may break booking forms.

C3. Do Not Track and Global Privacy Control

We honour the Global Privacy Control signal as a valid opt-out request from California residents and treat it as a withdrawal of consent to analytics cookies for all visitors. Because there is no agreed standard for Do Not Track headers, we treat a DNT signal in the same way.

C4. Server logs

Independently of cookies, our servers keep access logs containing truncated IP address, timestamp, requested resource and user agent, for security and troubleshooting. These are deleted after 30 days.

1. Agreement to these terms

By accessing superiuusi.com, submitting an enquiry, making a booking or entering the property at Kaskirannankatu 14, 00570 Helsinki, you agree to these Terms of Use. If you do not agree, please do not use the website or the services. These terms operate alongside our Privacy Policy, our GDPR, CCPA & Cookies Policy and our Responsible Gambling commitments, all of which form part of this agreement.

2. Eligibility and age

You must be at least 18 years old to use the gaming services, to hold a membership, or to enter a gaming area. Photo identification is required at every entry to a gaming area, without exception and regardless of apparent age. Presenting false or altered identification is a criminal offence and will be reported. Persons registered on the national self-exclusion register, or excluded by us, may not enter a gaming area and any winnings arising from a breach of an exclusion will be withheld and, where required, remitted to the authority or to a designated charity.

3. Website use

3.1 Permitted use

You may browse this website, print pages and share links for personal, non-commercial purposes. You may not scrape, mirror, frame or systematically extract content; introduce malicious code; attempt to gain unauthorised access to any system; interfere with availability; or use automated tools to submit forms.

3.2 Accuracy of information

Information about the property is published in good faith during construction and pre-opening. Opening dates, facilities, table limits, restaurant menus, room counts, prices, programming and services are indicative and may change. Nothing on this website is an offer capable of acceptance; a booking exists only when we confirm it in writing and, where applicable, take payment.

4. Intellectual property

All content on this website — text, design, layout, code, graphics, marks and the name Superiuusi — is protected by copyright, trade mark and other intellectual property rights and is either owned by us or used under licence. No licence is granted except the limited permission in clause 3.1. You retain the rights in material you submit to us, but grant us a non-exclusive, royalty-free licence to use it for the purpose of responding to your enquiry and operating our services.

5. Bookings, prices and cancellation

Room, restaurant, theatre and event bookings are governed by the specific terms shown at the time of booking, which prevail over this clause where they conflict. Prices include Finnish value added tax unless stated otherwise. Flexible rates may be cancelled up to 48 hours before arrival without charge; advance-purchase rates are non-refundable. Theatre tickets are non-refundable except where a performance is cancelled or materially altered, in which case the face value is refunded. We may take a pre-authorisation on your card against incidental charges.

6. House rules on the property

• Gaming is governed by the house rules for each game, published at the table and at the cash desk. Where a dispute arises, the house rules and the decision of the duty floor manager apply, subject to the complaints procedure in clause 10.
• Malfunction voids all plays and pays. Where a machine or table displays a result inconsistent with its rules or paytable, the correct result under the rules applies.
• Card counting, collusion, past posting, device use, chip manipulation and any other advantage or fraudulent technique are prohibited. We may decline any wager, close a table, refuse service, void a wager and remove any person, without giving reasons.
• We do not extend credit for gaming under any circumstances. Front money may be deposited in advance and is refundable on request.
• Photography and filming are not permitted in gaming areas. The property is monitored by CCTV throughout, as described in the Privacy Policy.
• Smoking is permitted only in designated exterior areas. Guests who are visibly intoxicated will not be served alcohol and will not be permitted to gamble.
• Dress is smart-casual after 18:00. The private salons ask for jacket or equivalent.
• We may refuse entry to, or remove, any person whose conduct threatens the safety, comfort or enjoyment of others, or the integrity of the games.

7. Payments, winnings and anti-money-laundering

Chips are valid only on the premises, have no value off the property and may not be transferred between persons as payment. Winnings above statutory thresholds are paid by bank transfer to an account in the winner's own name following identity verification. We are obliged to verify identity, screen against sanctions and politically exposed person lists, monitor transactions and report suspicious activity to the authorities, and we may be prohibited by law from telling you that a report has been made. We may decline a transaction or suspend an account pending source-of-funds evidence.

8. Membership

Membership is personal, non-transferable and granted at our discretion. Benefits may be varied on 30 days' notice. Membership may be suspended or terminated for breach of these terms, for conduct on the property, or where continued membership would be inconsistent with our player-protection duties. A self-exclusion automatically terminates membership and any accrued benefits are frozen rather than forfeited, and may be redeemed after the exclusion ends if you choose to return.

9. Liability

Nothing in these terms excludes or limits liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot lawfully be excluded — including the statutory rights of consumers under Finnish and EU law, which are not affected by these terms.

Subject to that, we are not liable for indirect or consequential loss; for loss of profit, opportunity or goodwill; for losses incurred through gambling itself; for interruption of the website; or for the acts of independent third parties such as transport operators and ticketing partners. Our total liability arising from a booking is limited to the amount paid for that booking. Property brought onto the premises is your responsibility; safes are provided in every room and deposit boxes at reception.

10. Complaints and disputes

Raise any complaint first with the duty manager, or afterwards in writing to support@superiuusi.com. We acknowledge within one business day and aim to resolve within 14 days. If you remain dissatisfied, you may refer a consumer dispute to the Finnish Consumer Disputes Board or, if you live elsewhere in the EU, use the European Commission's online dispute resolution platform. Gaming-specific disputes may additionally be referred to the Finnish gaming supervisory authority, whose determination we will accept.

11. Governing law and jurisdiction

These terms and any non-contractual obligations arising from them are governed by the laws of Finland. Disputes are subject to the non-exclusive jurisdiction of the courts of Helsinki. If you are a consumer resident in another EU or EEA state, you keep the protection of the mandatory rules of your own country and may bring proceedings there.

12. Changes, severability and contact

We may amend these terms; the version in force is the one published here on the date of your use or booking, and material changes to booking terms will not be applied retrospectively to confirmed bookings. If a provision is held unenforceable, the remainder continues in effect. Questions about these terms: support@superiuusi.com, +358 9 4245 8800, or Kaskirannankatu 14, 00570 Helsinki, Finland.