Privacy Policy

We are the General Commercial Gaming Regulatory Authority ("GCGRA", "we" or "us").

The GCGRA is the federal authority for the regulation, supervision and enforcement of commercial gaming in the United Arab Emirates (“UAE”).

In order to carry out our regulatory functions and meet our legal responsibilities, we need to collect certain personal information.

We are committed to protecting the privacy of the individuals and businesses we regulate and want to provide a safe and secure service where we deal with your personal information. This means information that identifies you personally such as your name, photo or contact details or data that can be linked with such information in order to identify you. This Privacy Policy describes how we collect and use your personal information, who we share your personal information with and your rights in respect of your personal information.

How we collect your personal information and what personal information may we collect about you?

There are several ways in which we may collect your personal information.

Information you may give to us:

Name
Email address
Residential address
Phone number(s)
Identification information such as Emirates ID / Passport number
Professional qualifications and experience
Employment history
Financial information such as credit or debit card details, bank account details or other payment-related information
Any other information relating to you which you may provide to us

Information we collect automatically:

Technical information such as your IP Address, browsing history, browser and device used.

How do we use your personal information and on what basis do we process your personal information?

For a legitimate purpose

Where it is relevant and necessary for our legitimate interests, including:

maintaining the security of our website;
detecting unauthorised, inappropriate or excessive use of our website;
preventing loss and misuse of our proprietary materials; or
ensuring compliance with applicable laws.

Where processing is necessary for the performance of a contract, such as to provide certain services to you, providing any information requested by you or any e-services via our website such as considering license applications.

Where we have your consent

With your consent for a specific purpose, including responding to a query you have raised. You may withdraw your consent at any time, as detailed in the sections of this Privacy Policy.

Where we have a legal obligation

In order to comply with our legal and regulatory obligations including our legal obligation to regulate, supervise and enforce compliant commercial gaming (including the lottery) in the United Arab Emirates and responding to requests from supervisory or regulatory authorities and law enforcement agencies.

How long do we keep your personal information for?

We keep your information for such periods as necessary to fulfil our regulatory functions and for the purposes set out in this Privacy Policy, or for longer periods in accordance with applicable data protection laws, taking into account legal and regulatory requirements relating to retention of your information.

Whom do we share your personal information with?

We may share your personal information with trusted third parties where we have retained them to provide services that you have requested, such as third party payment processors, UAE public authorities, gaming operators, sports governing bodies, other regulators and law enforcement agencies (both in the UAE and overseas).

We may share your personal information with third parties who perform functions on our behalf and who also provide services to us, such as professional advisors, IT and other service providers research and mailing houses and function co-ordinators. These third parties are under a duty of confidentiality with us.

We may share your personal information with our other group and affiliated entities and institutions for internal reasons, primarily for business and operational purposes.

Where required, we share your personal information with third parties:

to comply with our legal or regulatory requirements and obligations;
at the request of supervisory or regulatory authorities, courts, tribunals, government agencies and law enforcement agencies;
to detect and protect against fraud, or any technical or security vulnerabilities; to respond to an emergency; or otherwise to protect the rights, property, safety, or security of third parties, visitors to the our website, our business or the public

Where permitted by the applicable data protection laws, we may share your personal information without your consent.

How we protect your personal information?

We use a range of technical and organisational measures designed to protect your personal information from unauthorised use, access, disclosure, destruction and alteration.

What happens if you do not provide us with the information we request or ask that we stop processing your information?

If you do not provide the personal information necessary, or withdraw your consent at any time for the processing of your personal information, we may be unable to provide services or information to you, or you may not be able to make use of the services and information offered by us.

Your withdrawal of consent does not mean that anything we have done with your personal information prior to your withdrawal is unlawful and we may be able to continue to process your personal information to the extent required or permitted by law, including in order to comply with our legal or regulatory obligations.

Do we make automated decisions concerning you?

No, we do not carry out automated decision making when processing your personal information.

Do we use cookies to collect personal data on you?

See our cookie policy for more details:

Do we transfer your personal information outside of the Abu Dhabi Global Market?

In order to provide our services and fulfil our obligations, we may share your personal information with third parties located outside of the Abu Dhabi Global Market. Where the Abu Dhabi Global Market Commissioner of Data Protection has not issued an adequacy decision in relation to a jurisdiction where your personal information is processed, we will implement appropriate measures to protect your personal information in accordance with the applicable data protection laws, including, where necessary, the implementation of standard contractual clauses adopted by the Abu Dhabi Global Market Commissioner of Data Protection in any agreement with such third parties.

What are your rights?

By law, you have a number of rights when it comes to your personal information.

Rights	What does this mean?
The right to object to processing	You have the right to object to certain types of processing, including processing for direct marketing (i.e. if you no longer want to be contacted with potential opportunities).
The right to be informed	You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this Privacy Policy.
The right of access	You have the right to obtain access to your information (if we’re processing it), and certain other information (similar to that provided in this Privacy Policy).This is so you’re aware and can check that we’re using your information in accordance with data protection law.
The right to rectification	You are entitled to have your information corrected if it’s inaccurate or incomplete.
The right to erasure	This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there’s no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.
The right to restrict processing	You have rights to ‘block’ or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future
The right to data portability	You have rights to obtain and reuse your personal information for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your information easily between our IT systems and theirs safely and securely, without affecting its usability
The right to lodge a complaint	You have the right to lodge a complaint about the way we handle or process your personal information with your national data protection regulator
The right to withdraw consent	If you have given your consent to anything we do with your personal information, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal information with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal information for marketing purposes

We usually act on requests and provide information free of charge, but may charge a reasonable fee to cover our administrative costs of providing the information in respect of:

unreasonable or excessive/repeated requests
further copies of the same information

Alternatively, we may be entitled to refuse to act on the request.

Please consider your request responsibly before submitting it. We’ll respond as soon as we can. Generally, this will be within one month from when we receive your request but, if the request is going to take longer to deal with, we’ll come back to you and let you know.

Changes to our Privacy Policy

We will update this Privacy Policy from time to time to reflect changes to our regulatory requirements, business needs and how we use your personal information.

How will we contact you?

We may contact you by phone, email or social media, based on the information you have provided.

How can you contact us?

If you have any enquires our contact details can be found on the website under the Contact Us page.

We have appointed a Data Protection Officers who oversees our data privacy and data protection compliance. You can contact our Data Protection Officer via the Contact Us section on our website.

Privacy Policy review and effective date: 21 February 2024