Privacy & Biometric
Information Policy

Introduction

Go Gaming's commitment, and the two laws this policy is built around.

1. Go Gaming is committed to protecting your privacy and handling your personal and biometric information in accordance with the:
   1. Privacy Act 2020 (Act); and
   2. Biometric Processing Privacy Code 2025 (BPPC).
2. This policy explains how we collect, use, disclose, store, and protect your information.

Scope and definitions

What this policy covers, and what counts as biometric information under the BPPC.

1. Go Gaming provides the EZYSWEEP facial-recognition service to licensed New Zealand gaming societies to support their obligations to minimise gambling harm. For the biometric (facial recognition) information described in this policy, Go Gaming acts as the societies' service provider and handles that information on their behalf and on their instructions, for the harm-minimisation purposes set out in this policy and not for its own purpose. Go Gaming does not use other modalities (e.g. fingerprint, iris, voice, gait) and does not undertake biometric categorisation.
2. The policy applies to both:
   1. personal information that we collect through our services, websites, apps, systems, and physical sites relating to patrons, website users and business contacts; and
   2. biometric information collected by Go Gaming's facial recognition technologies and products.
3. Personal information is defined in the Act and means any information about an identifiable individual.
4. Biometric information is defined in the BPPC and means information about a biometric characteristic that is used for the purpose of biometric processing by a biometric system. A biometric characteristic includes:
   1. a person's physical features (e.g. their face);
   2. the way a person typically moves or acts with their body (e.g. the distinctive way a person walks, writes, types, or keystroke patterns); and
   3. a combination of physical features and how a person typically moves parts of their body (e.g. how a person sounds when they speak).
5. Biometric information also includes:
   1. a biometric sample, which is a (digital or non-digital) record of an individual's biometric characteristic (e.g. a photo of a face). These records are biometric information if they are used, or intended to be used, for biometric processing by a biometric system.
   2. a biometric template, which is a representation of information extracted from a biometric sample (e.g. how an algorithm recognises and analyses the information in a biometric sample).
6. Go Gaming's biometric processing involves facial features only and is used for biometric identification (for example: comparing a person's facial information against exclusion lists and player monitoring sweeps). Go Gaming does not use other biometric characteristics (such as fingerprints, iris, voice, or gait) and does not carry out biometric categorisation.
7. Biometric processing means comparing or analysing biometric information, using a biometric system (i.e. a technological system used for biometric processing) to either verify, identify, or categorise a person.
8. Go Gaming's biometric processing involves facial features only and is used for biometric identification (i.e. recognising a person by comparing their facial information against records held in the system). It is used to:
   1. identify people who are excluded from gambling (by comparing against exclusion lists);
   2. recognise the same person across the mandatory player-monitoring sweeps so staff can monitor length of play and signs of harm; and
   3. create the harm-minimisation interaction records that gambling law requires (which include a patron photograph).
9. Biometric identification is the automated recognition of a person's biometric characteristic (e.g. face) to identify them by comparing their biometric information against the biometric information of multiple people held in the system. Go Gaming does not use other biometric characteristics (such as fingerprints, iris, voice, or gait) and does not carry out biometric categorisation.

Collection of information

Why we collect information, what we collect, and how.

Purpose

1. Personal information will only be collected for a lawful purpose connected with the function or activities of Go Gaming, and where the information is necessary for that purpose.
2. Biometric information will only be collected for a lawful purpose connected with the function or activities of Go Gaming, and where the information is necessary for that purpose, and:
   1. privacy safeguards have been adopted and implemented; and
   2. it is believed, on reasonable grounds, that the biometric processing is proportionate to the likely impact on people (including Māori).
3. Go Gaming will ensure appropriate privacy safeguards are adopted and implemented including, but not limited to:
   1. adequate testing of the biometric system;
   2. high match thresholds;
   3. mandatory in-person staff confirmation of every possible exclusion match;
   4. bias and accuracy monitoring, including impact on Māori;
   5. a completed and up-to-date Privacy Impact Assessment;
   6. access controls and audit logging;
   7. strict retention with automated deletion, and cropped face image capture;
   8. gaming-room only camera scope, and ATM camera where applicable;
   9. additional automated secondary face-matching verification of every possible exclusion match to improve accuracy before it is confirmed by staff; and
   10. appropriate staff system training.

Types of information collected

1. Go Gaming may collect personal information about you:
   1. when you provide personal information to us, including via our website and any related service, through any registration process, submitting an enquiry, and/or through any contact with Go Gaming, including by phone or email. Go Gaming's website is an information-only website. It does not use cookies or web-analytics tools to track visitors and does not collect personal information from people browsing the site;
   2. indirectly via third parties where this has been authorised and is in accordance with Privacy Principle 3A, such as from:
      1. a national exclusion register that holds both single-venue and multi-venue exclusions;
      2. other third-party systems that may hold and share exclusion data; and
      3. gaming societies and venues (including information such as identity, contact details, and reference photo for excluded persons);
   3. where the information is publicly available; or
   4. directly from you.
2. Go Gaming may collect biometric information about you via its EZYSWEEP cameras, a facial-recognition system used to support gambling harm minimisation and the enforcement of gambling exclusions for licensed gaming societies. Biometric information may be collected by the following process:
   1. When you enter a participating gaming room, a camera captures a cropped face image. Biometric cameras are used in the gaming room (at its entrance, within it, and at its exit) and, at some venues, at the venue's ATM. They are not used at the venue entrance and do not scan everyone in the wider venue.
   2. The EZYSWEEP system creates a face template from that image and checks it against exclusion lists and player monitoring sweeps.
   3. Venue, operator and society staff are enrolled so that the system recognises those individuals and excludes them from patron monitoring.
   4. Some venues also have a camera at the ATM. Where one is used, a face is captured only when a person is standing directly at the ATM — it does not capture people passing by or elsewhere in the venue. The system records each ATM use so that staff can be prompted to check on a person who uses the ATM more than once in a day.

Manner of collection

1. Go Gaming will only collect personal or biometric information by a lawful means, which is fair in the circumstances, and does not unreasonably intrude on the personal affairs of the individual concerned.
2. Biometric samples will only be collected directly from the person whose biometric information it is, unless exceptions provided for in the BPPC apply — such as where exclusion reference photos from the national register are provided to Go Gaming.
3. Where biometric information is collected, certain information will be shared with the individual in a clear and obvious manner before, or at the time, their biometric information is collected. Information includes, but is not limited to:
   1. the fact the information is being collected;
   2. why the information is being collected;
   3. the name and address of the organisation that is collecting the information;
   4. the intended recipients of the information;
   5. if the collection, use or disclosure of the information is authorised or required by law;
   6. the right of access to, and correction of, information;
   7. details of Go Gaming's retention period for biometric information; and
   8. details of how to make a complaint.

Use of information

What we do — and don't do — with your information once collected.

1. Go Gaming may use your personal information:
   1. to verify your identity;
   2. to advertise and/or provide services and products to you;
   3. to improve the services we provide to you;
   4. to respond to communications from you, including a complaint;
   5. to protect and/or enforce Go Gaming's legal rights and interests, including defending any legal claim; and
   6. for any other purpose authorised by you and/or the Privacy Act 2020.
2. Go Gaming may use your biometric information only for gambling harm-minimisation purposes connected with its functions under the Gambling Act 2003, namely:
   1. to identify people who are excluded from gambling (by self-exclusion, venue exclusion, or a multi-venue exclusion), so that venue staff can give effect to the exclusion;
   2. to help venue staff monitor for signs that may indicate a person is experiencing gambling harm, so that staff can respond; and
   3. to create and hold the records that gambling law requires where there is a harm-minimisation interaction.
3. A staff member confirms any possible exclusion match in person before any action is taken. The EZYSWEEP system does not make decisions about a person on its own. Go Gaming does not use biometric information for marketing, to build a profile of you, or to infer or categorise your age, gender, ethnicity, emotions or any other characteristic.

Disclosing your information

Who we may share information with, and the safeguards that apply.

1. Go Gaming may disclose your personal information to:
   1. a business that supports our services, including any person that hosts, or maintains any supporting IT system or data function, including cloud-based software, storage and/or systems which are associated with Go Gaming's functions and/or activities;
   2. any other person authorised by you (e.g. a legal representative);
   3. a business that supports our services and products which may be located outside New Zealand. For example, some of the service providers that support Go Gaming's systems are located outside New Zealand. This means some personal information is handled overseas. Where this occurs, Go Gaming only permits disclosure under agreements that require the provider to protect the information to standards comparable to those required in New Zealand.
2. Go Gaming will not disclose biometric information unless there are reasonable grounds to believe one of the permitted exceptions applies. Exceptions include, but are not limited to:
   1. the disclosure of the biometric information is one of the purposes for which it was collected;
   2. the disclosure is authorised by the person whose biometric information it is;
   3. the disclosure is to avoid prejudice to the maintenance of the law or to lessen a serious threat to life or health.
3. Go Gaming will only disclose biometric information outside New Zealand where it is in accordance with the BPPC, under agreements that require the overseas provider to protect the information to standards comparable to those required under the BPPC.

Storage and security of your information

How long we keep information, and how it's kept safe.

1. Go Gaming will take reasonable steps to keep your personal and biometric information safe from loss, unauthorised activity/disclosure, or other misuse.
2. Go Gaming will not retain your personal or biometric information for longer than is required for the purposes for which the information may be lawfully used, following which time it will be securely destroyed. In some circumstances, there will be a legislative requirement for certain information to be held for a specified period of time.
3. In particular, for biometric information the following retention timeframes apply:

   Information type	Retention period
   Facial images not linked to an exclusion or a harm-minimisation interaction	72 hours, then automatically deleted
   Face templates not linked to an exclusion or a harm-minimisation interaction	28 days, then automatically deleted
   Information relating to an excluded person	Only while the exclusion remains in force, then automatically deleted
   Records of a harm-minimisation interaction (may include a facial image and face template)	3 years, as required by relevant gambling regulations

Accessing and correcting your information

Your rights over the information we hold about you.

1. Subject to certain grounds for refusal set out in the Act, you have the right to access your personal information held by Go Gaming and to request a correction to your personal information. Before you exercise these rights under the Act, Go Gaming may require evidence to confirm that you are the individual to whom the personal information relates.
2. If Go Gaming considers the correction is reasonable, and is reasonably able to change your personal information, it may make that correction. If Go Gaming does not make the correction, it will take reasonable steps to note on the relevant personal information that you requested the correction.
3. With respect to biometric information, you have the right to receive, on request:
   1. confirmation of whether Go Gaming holds any biometric information about you;
   2. confirmation of the type of biometric information Go Gaming holds about you (if any); and
   3. access to your biometric information.
4. You have the right to request that Go Gaming correct any biometric information it holds about you. This includes the right to request deletion. Go Gaming does not have to correct information in the way requested, but you have the right to give a 'statement of correction' that states you want your information to be corrected. Go Gaming will take steps to ensure the statement of correction is attached to the biometric information so that it is always read with the information, and will advise any other party that it has disclosed the information to about the statement of correction.
5. Go Gaming will take all reasonable steps to ensure that biometric information used or disclosed is accurate, up to date, complete, relevant, and not misleading.
6. While generally free, Go Gaming reserves the right to charge you reasonable costs for providing you copies of your personal information, or correcting that information, and will notify you of any charges before processing your request.
7. If you wish to exercise any of these rights, or have any privacy query, you can contact Go Gaming's Privacy Officer at privacy@gogaming.nz. Your request should include evidence of your identity and set out the details of the information or correction you are requesting.

Privacy incidents

What happens if something goes wrong.

1. A possible privacy breach may occur where information is subject to unauthorised or accidental access, disclosure, alteration, loss or destruction, or where access to the information is prevented.
2. Go Gaming will respond to and manage any potential privacy breach in accordance with its responsibilities under Part 6 of the Act.

Policy amendments

1. This policy will be reviewed every two years.
2. Go Gaming is entitled to amend and vary its policies from time to time at its sole discretion.