In short: Casino Marina Harare is a licensed data controller registered with POTRAZ, the Data Protection Authority under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]. We collect personal information to run our casino, restaurant, bar and events business, to look after your safety and security, and because Zimbabwe's anti-money laundering laws require us to identify our gaming customers, screen them against sanctions lists and report certain transactions to the Financial Intelligence Unit (FIU). We do not sell your information. You can contact our certified Data Protection Officer at any time at dpo@casinomarina.co.zw.
This website and the services described in this policy are operated by Rank Casino Management (Private) Limited, trading as Casino Marina Harare ("Casino Marina", "we", "us", "our"), Cnr Samora Machel Avenue and Mutley Bend, Longcheng Plaza, Belvedere, Harare, Zimbabwe.
For the purposes of the Cyber and Data Protection Act [Chapter 12:07] ("CDPA"), Casino Marina is the data controller of the personal information described in this policy. We hold a data controller licence issued by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Data Protection Authority, under the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, Statutory Instrument 155 of 2024.
| POTRAZ data controller licence no. | CM001223 |
|---|---|
| Data Protection Officer | John Chikwekwete — certified Data Protection Officer, having completed POTRAZ-approved data protection training at the Harare Institute of Technology |
| DPO contact | Email: dpo@casinomarina.co.zw Phone: +263 71 496 5297 Post / in person: Attention: Data Protection Officer, Casino Marina, Longcheng Plaza, Belvedere, Harare |
| AML/CFT Compliance Officer | compliance@casinomarina.co.zw |
This policy explains how we handle personal information about:
Our employees' information is covered by a separate staff privacy notice available from HR.
Under sections 7, 9 and 13 of the CDPA we collect only what we need for a stated purpose, keep it accurate, and keep it in identifiable form for no longer than necessary. The table below sets out each category.
| Who / what | Information | Why we use it | Legal ground | How long we keep it |
|---|---|---|---|---|
| Website visitors | IP address, browser and device type, pages requested, date and time, referring page (server log files); essential session cookies | Running and securing the website, preventing abuse and attacks | Our legitimate interest in a secure website | Server logs: up to 90 days, unless needed to investigate a security incident |
| Gaming customers — registration and customer due diligence (KYC) | Full name, date of birth, nationality, national ID or passport number and a copy of the document, photograph, residential address, phone, occupation, source of funds, membership number, PEP and sanctions self-declarations | Identifying and verifying customers, assessing money-laundering risk, enhanced due diligence where required | Legal obligation — MLPC Act ss. 15–24 and FIU/LGB Guidance | Customer profiles that have been inactive for more than 18 months are locked, so they can no longer be used or changed without Compliance review. Records are kept for at least 5 years after the end of the business relationship or the last transaction, as required by the MLPC Act; then deleted or anonymised unless the FIU, Lotteries and Gaming Board, a court or law enforcement requires longer, or an investigation is ongoing |
| Gaming transactions | Buy-ins, cash-outs, chip purchases and redemptions, amounts, currency, dates, gaming area, staff handling the transaction | Operating the casino, financial control, detecting suspicious activity, Cash Transaction Reports (CTRs) | Legal obligation (MLPC Act ss. 24, 30); our licence conditions | At least 5 years after the transaction |
| Sanctions and PEP screening | Name, date of birth, nationality and ID details compared against the United Nations Security Council Consolidated List and other competent sanctions lists; public information about political roles and adverse media | Complying with targeted financial sanctions and identifying politically exposed persons (PEPs) | Legal obligation (MLPC Act; targeted financial sanctions regulations) | At least 5 years after the screening or end of relationship |
| Suspicious transaction reports | Information about you and your transactions, and our internal notes | Reporting to the FIU through goAML | Legal obligation (MLPC Act s. 30) | At least 5 years after the report |
| CCTV and security | Video images on the gaming floor, cash desks, entrances, parking and public areas; incident reports | Safety and security of guests and staff, gaming integrity, preventing and investigating crime, AML enhanced monitoring | Legal obligation (gaming licence conditions); our legitimate interest in safety and security | 30 days, unless footage is needed for an incident, dispute, regulatory or law-enforcement request |
| Loyalty members | Name, membership number, contact details, visit and play history, points | Running the loyalty programme, rewards and member service | Contract (membership terms) | For the life of the membership, then in line with the KYC period above |
| Marketing | Name, email, phone / WhatsApp number, preferences | Sending news of events, promotions and offers | Your consent, which you can withdraw at any time | Until you withdraw consent or unsubscribe |
| Marina Cares (feedback and complaints) | Name, loyalty card number, phone / WhatsApp, email, details of the compliment, suggestion or complaint, names of staff involved, how you'd like us to contact you | Investigating and responding to your feedback, improving service, managing staff conduct | Your consent (given on the form); our legitimate interest in handling complaints | 24 months after the matter is closed |
| Events & Conferencing enquiries | Name, phone, email, type of event, estimated number of guests, how you heard about us, comments | Responding to your enquiry and preparing quotes. Enquiries are currently stored in Google Sheets (Google LLC, USA) | Your consent; steps before entering into a contract | 12 months after the last contact if no booking is made |
If you do not provide information that the MLPC Act requires (for example, identification at registration), we are legally unable to let you take part in gaming. Information on our online forms is voluntary; fields marked as required are needed for us to respond to you.
Some information we handle is treated with extra care under sections 11 and 12 of the CDPA:
We use a secure internal system to screen customers against the UN Consolidated List and to help identify politically exposed persons and adverse media. Verifying whether a customer is a PEP is required by the MLPC Act and the FIU/LGB Guidance for the Casino Sector. To do this thoroughly, part of the PEP check uses an AI-assisted web search service (Google Gemini, operated by Google LLC in the United States) that searches public sources using only the customer's name, date of birth and nationality. ID numbers, ID document images, photographs, contact details and transaction details are not sent.
In line with section 25 of the CDPA, no decision that has legal or similarly significant effects on you is made solely by automated means. Every potential match is reviewed by a trained member of our Compliance team, who makes the final decision. You may ask for a human review of any decision about you.
We do not sell, rent or trade your personal information. We share it only with:
Some of our service providers store or process information outside Zimbabwe, including in the United States, the European Union and other countries (for example Google, Meta and Telegram). Under sections 28 and 29 of the CDPA we transfer personal information abroad only where the recipient country or the provider offers an adequate level of protection, where the transfer is needed for a contract with you or for important public interest reasons, where you have consented, or as otherwise permitted by the Act. We keep the information sent abroad to the minimum needed and choose providers that use strong security and contractual safeguards.
As required by section 18 of the CDPA, we use appropriate technical and organisational measures, including:
No system connected to the internet can be guaranteed completely secure, but we review our safeguards regularly under the supervision of our Data Protection Officer.
If a security breach affects personal information we hold, we will notify POTRAZ within 24 hours of becoming aware of it, as required by section 19 of the CDPA. Where the breach is likely to put your rights and freedoms at high risk, we will also tell you without undue delay (and in any event within the time required by the regulations), explaining what happened and what you can do to protect yourself.
Under the CDPA you have the right to:
How to make a request: email dpo@casinomarina.co.zw, or ask at Reception or the Cash Desk for a data request form. We will verify your identity before releasing or changing any information, and we will respond within 14 days. Requests are free of charge.
Limits set by anti-money laundering law: because of the MLPC Act, we cannot delete customer due diligence and transaction records before the end of the legal retention period, and we cannot stop processing that the law requires. The law also makes it a criminal offence to tell anyone that a suspicious transaction report has been or may be made (the "tipping-off" offence in section 31 of the MLPC Act). For that reason we may not be able to confirm or disclose certain compliance records. Where we refuse a request, we will tell you so, unless the law prevents us from doing that, and you may complain to POTRAZ.
Gaming at Casino Marina is strictly for persons aged 18 and over. We do not knowingly collect personal information from anyone under 18 through our gaming services or online forms, and we will delete it if we find that we have. Information from self-exclusion or responsible-gambling requests is used only to honour that request and is shared with gaming staff only to the extent needed. Support is available at responsiblegambling.co.zw.
If you are unhappy with how we have handled your information, please contact our Data Protection Officer first at dpo@casinomarina.co.zw so we can try to put it right. You may also lodge a complaint with the Data Protection Authority:
Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) — Data Protection Authority
1008 Performance Close, Mount Pleasant Business Park, Harare
www.potraz.gov.zw
Essential cookies. This website and our online forms use only cookies that are needed for them to work, such as session cookies that keep a form or login working and protect against misuse. These are deleted when you close your browser or shortly afterwards. You can block cookies in your browser settings, but some forms may then not work.
Analytics. We do not currently use analytics or advertising cookies. If we introduce them, we will ask for your consent first and update this policy.
Google Maps. Our contact section shows a map provided by Google LLC (USA). When the map loads, your browser connects to Google's servers and Google receives your IP address. See Google's privacy policy.
Google Fonts and Facebook. Some of our forms load fonts from Google, which also receives your IP address. Our Facebook page link takes you to Facebook, where Meta's own privacy policy applies.
We will send promotional messages by email, SMS or WhatsApp only if you have agreed to receive them. Every message tells you how to opt out, and you can also opt out by contacting us. We never share your contact details with other companies for their marketing.
We review this policy at least once a year and whenever our processing or the law changes. The current version is always published at casinomarina.co.zw/privacy, with its effective date at the top. Where a change materially affects you, we will tell you before it takes effect.