Privacy Policy
PENN Entertainment, Inc. (“PENN Entertainment”, “Us” or “We”) Privacy Policy outlines the collection, use, processing and disclosure of your personal information. This Privacy Policy applies to this website and all of the products, services, websites, mobile applications, social media services, and the properties and services owned, managed or operated by us, our subsidiaries, or our partners on our behalf in the United States that link to this Privacy Policy (the “Services”), unless otherwise indicated. Where additional information is required to explain our privacy practices, we post supplementary privacy notices.
LIST OF TOPICS COVERED
Categories of Personal Information Collected and Processed
Sources of Personal Information
Sensitive Personal Information
Legal Basis and Purposes for Processing Your Information
Disclosures of Personal Information
Cookies and Similar Technologies Policy
Consumers Under 16 Years of Age
Consent
By accessing and using the Services, including when you visit our websites, make reservations, make online purchases, request information from us, download or launch our mobile applications, or when the application is running on your device in the background, you expressly consent to the collection, use, processing, disclosure, and retention of your personal information and sensitive personal information that you and other parties provide to us as a result of such use in accordance with this Privacy Policy, the terms of use for the specific part of the Services you are accessing and using (each and collectively “Terms of Use”), and as permitted by applicable law. You may withdraw your consent at any time by contacting us at [email protected] at any time, or if you disagree with the Terms of Use or this Privacy Policy, you should immediately discontinue use of the Services.
Please note that the Services may be hosted in countries other than yours. By accessing the Services, you expressly consent to the transfer of your information outside of your home country, which may provide for different data protection laws than in your country.
To provide you with all of the requested Services, we collect and process the following categories of personal information:
- Identifiers, such as first and last name, home or other physical address, which includes the name of a street and the name of a city or town, date of birth, gender identity, age, photograph, job status, employment information, unique personal identifiers or other similar identifiers.
- Messages, Comments, and other User-Generated Content that you choose to provide to us voluntarily, including comments, messages, and other content you post to the Services.
- Unique Personal Identifiers, such as social security number, driver’s license number, passport number, license plate number, telephone number, email address, Internet Protocol address, device identifiers and advertising identifiers, Cookies, beacons, pixel tags, or similar technology, player ID, or loyalty program ID.
- Player Information, such as play activity, depending on how you use the Services, which could include system-generated player identifiers.
- Commercial Information, including records of products or services purchased, obtained, or considered.
- Transaction Information, such as bank information (e.g. bank statement, void cheque), reservation information, and purchase history.
- Geolocation Data obtained and derived from your mobile device when you access the Services by or through such mobile device;
- The applicable laws of the jurisdiction in which you reside may require that we verify your physical location when engaging in placing wagers through the Services. You can only place wagers through the Services from within certain jurisdictions’ boundaries. Accordingly, we collect your Geolocation Data and verify your physical location using geolocation technology and geo-verification service providers. If you do not permit your geolocation to be known (i.e. disable GPS, Wi-Fi and/or Bluetooth), we will not be able to provide such wagering services to you. We may store a record confirming your geolocation within a jurisdiction for up to ten (10) years as required by applicable laws and regulations.
- Certain features within the Services will make use of your Geolocation Data, including geolocation verification provided by GeoComply or other similar geolocation verification service providers. Your use of the Services will require you to, and you hereby consent to us transmitting, collecting, maintaining, processing and using your Geolocation Data as described in this Privacy Policy. You may turn off the location services within your device’s settings at any time or by notifying us in writing that you would like to withdraw such consent. Turning off location services on your device will prohibit you from using certain core features and functionalities of the Service including but not limiting to wagering services.
- Internet or Other Electronic Network Activity and Other Information that are automatically obtained from the devices and/or browsers that you use to access our Services, such as your device type; IP address; device and advertising identifiers, probabilistic identifiers, and other unique online identifiers; time zone setting and location; browser type and version; browser plug in types and versions; operating system and platform information; Internet service provider; pages that you visit before and after using the Services, browsing history, and search history; the date and time of your visit; information about the links you click, pages you view, and advertising you interact with, within the Services and other information about how you interact with our Services or other services you use to connect with us, such as Facebook and Twitter information; the technology on the devices you use to access these Services; audio, electronic, visual, thermal, olfactory, or similar information; or if your device experiences an error with our Services, we collect information about the error (e.g. the time the error occurred, the feature being used, the state of the application when the error occurred, and any communications or content provided at the time the error occurred).
- Inferences, which may be drawn from any of the categories of personal information described above to create profile(s) reflecting your preferences, characteristics, predispositions, interests, and behavior.
Out of Scope
This Privacy Policy does not apply to the following information:
- Aggregated, pseudonymized, and/or de-identified data, derived from information described above and that we do not attempt to reidentify or link back to you, may be used for research, evaluation, and/or other analytical purposes by us or third parties.
Sources of Personal Information
In addition to collecting information directly from you, we may also receive the above noted categories of personal information from other sources, including affiliates, other users of the Services, identity verification services and databases, advertising partners, internet service providers, data analytics providers, operating system providers, publicly available sources, government entities, social networks, and other entities as required by and in compliance with applicable privacy laws.
Sensitive Personal Information
Subject to your place of residency, we may collect personal information that is deemed to be sensitive personal information under applicable privacy laws. We may collect the following sensitive personal information for the purposes listed below:
- Precise Geolocation Information of Your Device consistent with your device’s permission settings, to provide you with Services available at your location, including personalized marketing. Where use of this information is for marketing purposes, you may withdraw your consent at any time, subject to applicable privacy laws.
- Biometric Information via Facial Recognition Technology or Other Technology to identify you, for the limited purpose of ensuring the security and confidentiality of our Services, physical locations, and assets, fulfill legal and regulatory obligations, and as otherwise permitted by, and consistent with, applicable laws. Our third-party service provider, Jumio, collects biometric information via facial recognition or similar technology from an image (e.g., a selfie) or video (including audio) and from an image of your face as it appears on an identification document that you provide. Jumio may share such data with its service providers to perform I.D. check services and/or with PENN Entertainment for limited purposes where necessitated. Jumio may collect, process, re-collect, otherwise obtain, and store such data for this process or to improve its services, and for the long-term proof of inspection of your provided form of identification. Jumio will destroy such biometric information in its possession one year after the deactivation or termination of your account with us.
- Racial & Ethnic Origins to provide you with personalized advertisement and marketing material for and/or in the Services.
- Driver’s License and Social Security Numbers to provide you with Services, to comply with our legal obligations, including without limitation, relevant gaming regulatory requirements.
We may use the personal information we collect for the following business purposes:
- Provide you with access and use of the Services you requested, including uniquely identifying and authenticating patrons, maintaining and servicing accounts, process payments/transactions, and ensure other features of the Services are properly administered;
- Provide customer service, facilitate communication to respond to patron requests and concerns;
- Administer responsible gaming exclusion, loyalty and other similar programs;
- Deliver marketing, promotional, and advertising materials for, and/or within, the Services, including personalized advertising for the patron;
- Analyze and improve the Services for operational effectiveness and viability of current and prospective services, personalize offers, measure traffic and usage trends, and provide and analyze online surveys;
- Ensure security and integrity of the Services, including troubleshooting, debugging to identify and repair errors that impair existing functionality;
- Comply with applicable laws and regulatory obligations, including risk mitigation; and
- Any other purposes disclosed to you at the time we collect your information with your consent.
We may disclose the personal information we collect to the following parties, who may be located outside the United States, for business purposes including but not limited to:
- Affiliates, Subsidiaries and Other Business Partners: management and analytics, providing you with the Services, website and data hosting, customer service, providing your account, security and performance monitoring, and related activities.
- Service Providers & Contractors: providing you with products and service, payment processing, website and data hosting, customer service, advertising and marketing (including counting ad impressions, ensuring compliance with industry standards, personalization, and analytics), analytics services, security and performance monitoring, maintaining and servicing accounts, fulfilling orders and transactions, verifying customer identity, research, verifying customer information, and auditing.
- Those With Whom You Share Content: any information or content that you voluntarily post, submit, or otherwise disclose to the Service, becomes available to the public, except as limited by any privacy settings you select. Subject to your privacy settings, any content that you voluntarily make public may be searchable by others. If you remove information or content that you posted to the Services, copies may remain viewable in cached and archived pages of the Services, or if other users have copied or saved that information or content. Please note that such removal does not ensure complete or comprehensive removal of the content or information posted (for example, your content or information may remain visible because it was copied and posted or reposted by a third party).
- Third Parties in Compliance with Applicable Law: to respond to subpoenas, court orders, legal process, government and law enforcement requests; to fulfill regulatory or administrative authorities’ requirements; to establish, protect and/or exercise our rights to defend against legal claims; to investigate, prevent and take action against suspected illegal activities and suspected fraud; to protect the rights, reputation, safety and security of our Services, employees, users of our Services, and/or the public; and to prevent, investigate and take action against any violation of the Terms of Use, our policies or agreements, or as otherwise required by law.
- Other Corporate Entities: in the event of a corporate transaction like business merger, consolidation, acquisition, sale of assets, joint venture, or in the unlikely event of bankruptcy.
Subject to your consent, we may disclose your personal information for purposes not identified above.
Parties acting on our behalf are authorized to collect, use, disclose, and/or store personal information only to the extent described in this Privacy Policy, subject to applicable laws.
Cookies: A "Cookie" is a small text file placed on a device when a user visits a website (including our Services). Cookies can be sessional or persistent and are not programs that download on a user's system and damage files (such as, viruses or worms) or send information to third parties about websites visited (such as, spyware). A persistent Cookie remains on your device after you close your browser. Persistent Cookies may be used by your browser on subsequent visits to the Service. Persistent Cookies can be removed by following your browser's directions. A sessional Cookie is temporary and disappears after you close your browser. You can set your browser to refuse certain Cookies or to indicate when a Cookie is being sent. However, some features of the Service may not function properly if the ability to accept Cookies is limited or disabled.
We may send one or more Cookies to your device that uniquely identifies your browser and enables us to recognize repeat visitors, facilitate a visitor's ongoing access to and use of the website, track your usage of the Services over time and compile data that can allow content and speed of access improvements and targeted offers (e.g., the pages you view, the links you click and other actions you take on the Services), and enhance your navigation through the Services. Information (i.e., domain names and IP addresses) and data may be automatically collected through the standard operation of our internet servers at our discretion using Cookies.
You can opt-out of the installation of Cookies or delete Cookies previously installed by updating your settings in the internet browser you use to visit our Services. However, visitors should note that Cookies may be necessary for optimal functionality of our websites.
Other Internet Technologies: We may also use other standard internet technologies, such as flash technologies, web beacons, or pixel tags, and other similar technologies, to deliver or communicate with Cookies and track your use of our websites. For example, we may include web beacons in e-mail messages or newsletters to determine whether messages have been opened and acted upon. The information obtained with such technology enables us to customize the Services offered and measure the overall effectiveness of our online content, advertising campaigns, and our Services.
By using our Services, you consent to the installation and use of Cookies and similar technologies by or on behalf of us as described above.
Retention
Your personal information will be retained for so long as reasonably necessary and proportionate for the purposes outlined above in this Privacy Policy based on criteria such as duration required to provide services to you, including for backup, archival, fraud prevention or detection, audit, or as otherwise required by law. After the retention period has elapsed, your information will be securely deleted or removed. We may use remote backup features that will send information from your device and/or browser to be stored on servers operated by or on behalf of us and our affiliates. Except to the extent specifically prohibited by applicable law, we have no responsibility for any data transmitted to and from your device and/or computer and we recommend that you make regular back-ups of all information and data on your device and/or computer.
Security
We care about the security of your personal information and take reasonable physical, technological and administrative measures in an attempt to protect and safeguard your personal information against loss, theft, and unauthorized access, use, disclosure or modification. However, we cannot ensure or warrant the security of any information you provide to us as no system is perfect, nor can we guarantee that unauthorized access or theft of data will not occur. User discretion is advised when submitting personal information to the Services.
For features on our websites that require a login or password, you are responsible to protect against unauthorized access by signing off when finished using a shared computer or device and to safeguard the confidentiality of your username and password. We strongly encourage that you do not share this information with anyone.
Links to External Websites
We may have links to external websites in our Services. By accessing an external website from our Services, you hereby release us from any and all liability for your use of such link and third-party website. We have no control over the content of external websites, and therefore are not responsible for the security and privacy policies protocols or content that appears on these external websites. Your visit and use of such external websites is voluntary and may be subject to such third-party’s rules and policies, which you are encouraged to review. If you choose to interact third party social networking service, we may receive information about you that you have made available to the third party social networking service. Also, the third party social networking service may receive information about you from us.
Sale
Sale is defined as selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or third party for monetary or other valuable consideration.
By the definition above, we do not sell personal information of our users.
Our Services are intended for consumers over the age of 21, subject to exceptions where age of majority is 18. We do not intentionally collect the personal information of consumers under the age of 16, nor do we intentionally share or sell the personal information of such consumers. If you have reasons to believe that we may have accidentally received personal information of an individual under the age of 16, please contact us immediately at [email protected]
Consumer Rights
Subject to your place of residence, you may be entitled to exercise certain rights with respect to your personal information, as described below:
- Right to Access and Confirm Processing: You may request access and or confirm processing of your personal information once in a calendar year. You may have the right to know what personal information the business has collected about you, including the categories of personal information, the categories of sources from which it is collected, the business or commercial purposes for collecting, selling, or sharing it, and the categories of third parties to whom we disclose it.
- Portability: Subject to exceptions, you may obtain a copy of your personal information we collected during the preceding twelve (12) months of your request, in a readily useable format where processing is done via automated means.
- Deletion: Subject to certain exceptions, you may request deletion of your personal information in our control.
- Correct Inaccuracies in your Personal Information: You can also update or correct your account information and electronic message preferences at any time by logging in to your account and changing your profile settings.
- Opt-out of Sale and Sharing for Targeted Advertising: We do not sell your personal information for monetary or other valuable consideration. However, you may request opt-out of having your personal information processed for purposes of targeted advertising by visiting the NAI Opt-Out Page: http://www.networkadvertising.org/choices. Please note that even if you choose to remove your information (opt-out), you will still see advertisements while you are browsing online. However, the advertisements you see may be less relevant to you and your interests. Additionally, many network advertising programs allow you to view and manage the interest categories they have compiled from your online browsing activities. These interest categories help determine the types of targeted advertisements you may receive. The NAI Opt-Out Page provides a tool that identifies its member companies that have Cookies on your browser and provides links to those companies.
- Universal Opt-Out Mechanism (California, Connecticut and Colorado Residents Only): This mechanism, also known as “Global Privacy Control” (GPC) signals, affords consumers the ability to communicate a request to opt-out of the processing of their personal information, for the purposes of sale or sharing for targeted advertisement, across multiple websites at once by your browser sending a signal to websites you visit, rather than having to make individual opt-out requests through different websites. Currently our systems are unable to receive and honor these signals. If you prefer to not receive targeted advertising, please follow the above-noted steps.
- Limit Use and Disclosure of Sensitive Personal Information (California and Utah Residents Only): Subject to exceptions, you may limit the use and disclosure of your sensitive personal information for purposes necessary to provide you with the Services you requested by clicking the “Limit the Use and Disclosure of My Sensitive Personal Information” link. Similarly, you may withdraw your consent to have your sensitive personal information be used, processed, or shared at any time unless required for business purposes.
- Designate Authorized Agent: You may be entitled, in accordance with applicable law, to submit a request through an authorized agent.
- Shine the Light (California Residents Only): California residents who provide certain personal information in connection with obtaining products or services for personal, family or household use are entitled to request and obtain from us once a calendar year information about the customer information we shared, if any, with other businesses for their own direct marketing uses. If applicable, this information would include the categories of customer information and the names and addresses of those businesses with which we shared customer information for the immediately prior calendar year.
We reserve the right to amend this Privacy Policy at any time. We advise you to periodically review this policy for any updates, which will be accompanied by a new “effective date” indicated above.
To submit a request to exercise your rights, designate an authorized agent to exercise your rights on your behalf, and/or for any questions, you may contact us by calling 1 (866) 978-5118, by emailing our Privacy Compliance Officer at [email protected], and/or by mail at:
Privacy Compliance Officer
PENN Entertainment, Inc.
825 Berkshire Blvd.
Wyomissing, PA 19610
We will process your request upon receipt after verifying your identity. You also may be entitled, in accordance with applicable law, to appeal our refusal to take action on your request by contacting our Privacy Compliance Officer.