Privacy Policy

LAST UPDATED: 4-30-25

Churchill Downs Incorporated and its subsidiary companies (“CDI,” “we,” “us,” or “our”) have adopted this Privacy Policy to explain how we collect, use, disclose, and otherwise process personal information in connection with our Services.

Our Services: When we use the term “Services,” we are referring to:

  • Websites owned or operated by CDI (the “websites”)
  • Digital applications made available by us (the “apps”)
  • Our social media pages that we control (our “social media pages”)
  • HTML-formatted e-mail messages that we send to you (our “emails”)
  • Our interactions with you, including, but not limited to, at our gaming, racing and hotel establishments, as part of our loyalty programs and through any communications with you (our “interactions”).

This Privacy Policy does not cover or address personal information and privacy practices relating to job applicants, employees and other personnel.

I. What Is Personal Information

When we use the term “personal information” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer or household.  It does not include aggregated or deidentified information that is maintained in a form that is not reasonably capable of being associated with or linked to you.

Privacy laws sometimes differentiate between “controllers” and “processors” of personal information. A “controller” determines the purposes and means (the why and how) of processing personal information. A “processor,” which is sometimes referred to as a “service provider,” processes personal information on behalf of a controller subject to the controller’s instructions.

This Privacy Policy describes our privacy practices where we are acting as the controller of personal information, which is most of the time. However, this Privacy Policy does not cover the limited circumstances in which we are acting as a processor on behalf of our business-to-business customers, typically gaming companies, in providing our Services. In such cases we only process personal information in accordance with the controller’s instructions. As a result, we recommend referring to the privacy policies of the business-to-business customer with which you have a relationship for information on how they engage processors to process personal information on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal information we process on behalf of our business-to-business customers, so we recommend directing any requests to the relevant business-to-business customer.

II. What Information We Collect

We collect personal information in several ways.  Sometimes we collect personal information directly from you and sometimes we collect the personal information automatically when you interact with our Services.  At times, we may collect personal information about you from other sources and third parties and combine that information with other information we collect from you.

A. Personal Information You Provide To Us

We collect the following personal information you provide in connection with our Services.

  • Registration, Account Funding and Wagering. You may register or open an account with CDI on any of our Services if you are at least eighteen (18) years old, or older in some jurisdictions for account wagering.  Similarly, you may enter our casino floors and other wagering venues and place wagers if you are over twenty-one (21) years old.  If you do, we may collect your:
    • Name, address (including billing and shipping addresses), date of birth, gender, citizenship, phone number and email address
    • Social Security Number
    • Bank account and routing information and payment card information
    • Picture for profile avatar and ID verification
    • Social media account information
    • Loyalty or rewards program account number
    • Driver’s license, passport or other government ID
    • Gaming or wagering activity, such as deposit and withdrawal amounts and the details of the wagers you make
  • Communications. If you communicate with us through any paper or electronic form, including through our online live and automated chat sessions on our websites and in our mobile apps, we may collect your name, email address, mailing address, phone number, date of birth, information about your inquiry, comments and feedback, and any other personal information you choose to provide to us.  If you register for our newsletters or updates, we will communicate with you using your email, phone number and by using in-app or push notifications from our websites and apps.
  • Surveys, Forms and Events. If you choose to participate in any surveys or events, or complete any forms on our websites, including entering into any sweepstakes, we will collect your name, contact information, payment information (where applicable) and any other information you choose to provide to us.
  • Transactions. If you inquire about purchasing or purchase tickets or packages directly through us for any of our live events, or donate to any of our charity fundraisers, we will collect your name, email address, mailing address, phone number, date of birth, payment information, and demographic information.  In some cases, such as when you purchase sponsorships either in an individual capacity or as a representative of a company or group, we will collect your Social Security Number and information about your employment.
  • Hotel Information. If you stay at one of our hotels, make a reservation for a stay or another service, or purchase a service at a hotel, we will collect information about your visit, including information about your prior stays or interactions, goods and services that you purchased (e.g., room service, restaurant purchases, spa bookings, etc.), special service and amenity requests, activity data, or employer details (for business-related bookings).

B. Information We Collect About You Automatically

When you use our Services, visit our locations, read our emails, through your interactions or when you otherwise engage with us through a computer or mobile device, we and our third-party partners automatically collect information about you and your device.  We use this information to enhance and personalize your user experience, to monitor and improve our websites and Services, and for other internal purposes.

We and our service providers typically collect this information through a variety of tracking technologies, including cookies, web beacons, embedded scripts, mobile SDKs, location-identifying technologies, and similar technology (collectively, “data collection technologies”) and we may use third-party partners or technologies to collect this information.

Information we collect automatically about you may be combined with other personal information we collect directly.

  • Web Logs. Like many websites, apps and email communications, we automatically collect certain information about your device automatically and store it in log files.  This information may include device identifiers, IP addresses, browser type, internet service provider, referring/exit pages, operating system, date/time stamp and/or clickstream data.
  • Information about how you use the Services, for example, the pages you visit, the links you click, the ads you view and click on, videos you watch, purchase information and your checkout process, your location when you access or interact with our Services, and other similar actions. We may also use third-party tools to collect information you provide to us or information about how you use the Services and may record your mouse movements, web session, scrolling, clicks and keystroke activity on the Services and other browsing, search or purchasing behavior. These tools may also record and monitor information you enter when you interact with our Services or engage in chat features through our Services.
  • Geolocation Information. When you download our app or use some of our online Services, you will be prompted to give permission for CDI to access your device’s precise geolocation.  Giving permission is voluntary, although the denial of permission to access geolocation information may result in your inability to take full advantage of CDI’s Services.  For more information on how to withdraw your permission, please see the Online Privacy Choices section below (Section VI).
  • Data Collection Technologies. We and our service providers use data collection technologies to manage the Services and to collect information about you and your use of the Services.  We may use third-party partners or technologies to collect this information. These technologies help us to recognize you, customize or personalize your experience, advertise products or Services to you and analyze the use of our Services to make them more useful to you.  These technologies may also allow us to collect demographic and statistical data and provide this information to our service providers to help deliver their services.  Most internet browsers allow you to remove or manage cookie functions and adjust your privacy and security preferences.  For information on how to do this, access the “help” menu on your internet browser, or access https://allaboutcookies.org/how-to-manage-cookies.  Please note, however, that disabling our cookies may mean that you will not be able to take full advantage of our Services.

All of the information collected automatically through data collection technologies allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our Services, and to improve the effectiveness of our Services, offers, advertising, communications features such as live and automated chat, and customer service functionality. We, or the third-party partners we use, may use the data collected through tracking technologies to:  (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify and contact you across multiple devices; (d) provide and monitor the effectiveness of our Services; (e) perform analytics and detect usage patterns on our Services; (f) diagnose or fix technology problems; (g) detect or prevent fraud or other harmful activities, and (h) otherwise to plan for and enhance our Services.

For more information on your choices and controls on tracking technologies, and to learn more about how we and our third-party partners use information for online advertising purposes, please see the Third-Party Data Collection and Online Advertising section below (Section V).

C. Information We Collect About You From Third Parties

We may receive personal information about you from other users or our business partners and service providers and combine this information with other information we have.

  • Ticketing and Online Purchases. If you purchase tickets or products through our online store, you are interacting with our third-party partners.  You may also book our hotel rooms through third-party partners.  When you submit information through these third parties, we receive the name, email and information about your payment methods and the transaction from these third-party partners.  If you make purchases on behalf of your company or organization, we will receive the information about your employer that you provide to the third-party partners.  Our third-party partners may also estimate demographic information about our customers, such as age, education level and marital status, and send this information to us with information about each purchase.  To learn more about the data collection practices of these third parties, please visit each site’s privacy policy.
  • Other Users. We may obtain information about you from other users who think you may be interested in the Services or who wish to take part in bet sharing.  If so, we will collect your name and contact information, which we will use to reach out to you with information about our Services.
  • Service Providers and Public Databases. We obtain information about users from our service providers in some contexts, such as from our payment processors when you deposit money, or from background check providers where we are legally obligated to do so.  We may also obtain information from public databases to validate and verify the information you have provided us to prevent potential fraud.
  • Social Media Providers. If you choose to connect to our Services through a social network such as Facebook or X (formerly known as Twitter), we will collect your profile information.  Additionally, if you interact with our social media pages, we will collect information about your profile and the relevant content from your interaction.

III. How We Use Your Information

  • To fulfill the purpose for which you provide it to us and improve our Services and customer support. This includes but is not limited to, feature usage, verifying the information you have provided us, facilitating your wagering activity and processing purchases made on our Services.
  • To fund your account and place and settle your wager and to ensure that wagering activity and gaming meets various state and federal laws and other statutory requirements.
  • To contact you regarding promotions and marketing offers that we believe may be of interest to you, including through email, direct mail, phone, text message, online chat, in-app messages and push messages.
  • To communicate with you via online live or automated chat, email, phone, text message, direct mail, in-app or push message or social media.
  • To respond to your inquiries and fulfill your requests and subscriptions, such as to send you newsletters and our magazine.
  • To send administrative information to you, for example, information regarding the Services and changes to our terms, conditions, and policies, or information regarding your wagering and gaming activity and player loyalty/reward account.
  • To complete and fulfill your purchase, for example, to process your payments, confirm your reservation, communicate with you regarding a reservation or purchase and provide you with related customer service.
  • To personalize your experience with us by presenting products and offers tailored to you, and to recognize you and remember your information when you return to our Services.
  • To allow you to participate in sweepstakes, contests and similar promotions and events, such as our philanthropic or promotional events, and to administer these activities. Some of these activities have additional rules, terms, and conditions, which could contain additional information about how we use and disclose your personal information.  Read these rules carefully.
  • To allow you to send messages to a friend through the Services. By using this functionality, you are telling us that you are entitled to use and provide us with your friend’s name and email address.
  • For our business purposes, such as data analysis, audits, security, crime and fraud monitoring and prevention (including identity verification), developing new products, conducting research regarding our Services for the purposes of enhancing, improving, or modifying our Services, enhancing our marketing efforts, identifying usage trends, determining the effectiveness of our promotional campaigns, increasing business efficiencies, and operating, managing and expanding our operations and business activities.
  • As we believe to be necessary or appropriate: (a) under applicable law, including laws outside your country of residence; (b) to comply with legal process; (c) to respond to requests from public and governmental authorities; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of our affiliates (including through surveillance); (f) to protect our rights, privacy, safety or property, and that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

IV. How Personal Information May Be Shared Or Disclosed

Your personal information may be used and disclosed:

  • Within CDI and our Affiliates. We may share personal information internally within our company and with other affiliates or subsidiaries in the Churchill Downs Incorporated family of companies (i.e., any organization we own or control).
  • Travel and Ticketing Partners. We may share personal information with third-party travel partners and ticketing providers to facilitate your travel and event experience, including helping you book our hotel rooms or event passes.
  • Service Providers. We engage a number of third-party service providers and independent contractors that process personal information for us or on our behalf and as needed to perform business or operational services needed to provide the Services, such as website hosting, infrastructure provisioning, IT services, customer service, email and text message delivery services, analytics, ticketing, merchandising, marketing and advertising services, facilitating chat functions, security providers, payment processors, background check providers, credit check services, facilitating wagers and other similar services.
  • Third-Party Users and Partners. We may disclose your personal information to third parties based on your use of the Services.  For example, we will share your personal information with other users to whom you send messages to through the Services or invite on to our apps.  We may share your personal information with third parties with whom we partner to provide sweepstakes, contests, surveys, joint promotion activities or co-branded or co-sponsored Services or events to allow them to send you marketing communications and fulfill your related requests.
  • Ad Networks and Advertising Partners. We work with third-party ad networks and advertising partners to deliver advertising and personalized content to you on our Services, on other sites and services you may use, and across other devices you may use.  These parties may collect information directly from your browser or device when you visit the Services through cookies or other tracking technologies.  This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics and market research.
  • Publicly. Where you post information and materials on message boards, chat, profile pages, blogs and other services, including, without limitation, our social media pages, your personal information is available to other users.  Please note that information you post in a chat room, a message board, a forum or another public posting area on our websites or social media can be viewed by anyone with internet access.  Use extreme caution prior to disclosing your personal information, or any other information, in these areas.
  • Social Networks. By connecting your social media account to the Services, you authorize us to share information with your social media account provider, and you understand that the use of the information we share will be governed by the social media sites’ privacy policies.  If you don’t want this information shared, do not connect your social media account to the Services.
  • Third Parties Based on Context. Consistent with expectations set on the Services or at your direction, we may share your personal information with other third parties in order to facilitate the general operations of our Services.
  • Regulatory or Legal Requirements, Safety and Terms Enforcement. We may disclose personal information to governmental regulatory authorities as required by law, including for tax or accounting purposes, in response to their requests for such information or to assist in investigations.  We may also disclose personal information to third parties in connection with claims, disputes or litigation, when otherwise required by law, or if we determine its disclosure is necessary to protect the health and safety of you or any other person, to protect against fraud or credit risk, or to enforce our legal rights and the contractual commitments that you have made, and to pursue available remedies and limit the damages that we may sustain.
  • Third Parties in the Context of a Corporate Transaction. We may disclose personal information as reasonably necessary to evaluate, negotiate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all CDI’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by CDI about consumers is among the assets transferred or is otherwise relevant to the evaluation, negotiation or conduct of the transaction.

V. Third-Party Data Collection and Online Advertising

Interest-Based Advertising

We may participate in interest-based advertising and use third-party advertising companies to serve you targeted advertisements based on your browsing history.  We permit third-party online advertising networks, social media companies and other third-party services, to collect information about your use of our online services over time so that they may play or display ads on our Services, on other websites or services you may use, and on other devices you may use.  Typically, though not always, the information used for interest-based advertising is collected through tracking technologies which recognize the device you are using and collect information, including click stream information, browser type, time and date you visited the Sites, AdID, precise geolocation and other information about how you engage with our Services, such as information you provide, items you search for, items you click, videos you watch and similar browsing or usage activity.  We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help identify you across devices.  We and our third-party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research.  We may also use services provided by third parties (such as social media platforms) to serve targeted ads to you and others on such platforms.  We may do this by providing a hashed version of your email address or other information to the platform provider.

User Experience Information

On some of our Services, we use third-party tools and technologies to monitor user experience information. These tools automatically collect usage information, including mouse clicks and movements, page scrolling and any text keyed into website forms and other browsing, search or purchasing behavior. These tools may also record information you enter when you interact with our Services or engage in chat features through our Services. The information collected does not include passwords, payment details, or other sensitive information. We use this information for site analytics, optimization and to improve website usability. We do not permit this information to be shared with or used by third parties for their own purposes.

Cross-Device Linking 

We, or our third-party partners, may link your various devices so that content you see on one device can result in relevant advertising on another device. We do this by collecting information about each device you use when you are logged in to our Services. We may also work with third-party partners who employ tracking technologies, or the application of statistical modeling tools, to determine if two or more devices are linked to a single user or household.  We may share a common account identifier (such as an email address or user ID) with third-party advertising partners to help recognize you across devices.  Our partners may combine this information with information they collect directly or receive from other partners, both online and offline, so that they may recognize your device across different channels and platforms, including computers, mobile devices, and smart TVs.  We, and our partners, can use this cross-device linkage to serve interest-based advertising and other personalized content to you across your devices and advertising channels, to perform analytics and to measure the performance of our advertising campaigns.

Social Media Widgets and Advertising

Our Services may include social media features, such as the “Like” button or other widgets, associated with Facebook, Pinterest, Instagram, X (formerly known as Twitter), Snapchat, or other social media platforms.  These social media companies may recognize you and collect information about your visit to our Services, and they may set a cookie or employ other tracking technologies.  Your interactions with those features are governed by the privacy policies of those companies.

We may display targeted advertising to you through social media platforms, such as Facebook, Pinterest, Instagram, X (formerly known as Twitter), Snapchat, or other social media platforms.  These companies have interest-based advertising programs that allow us to direct advertisements to users who have shown interest in our services while those users are on the social media platform, or to groups of other users who share similar traits, such as likely commercial interests and demographics.  We may share a unique identifier, such as a user ID or hashed email address, with these platform providers or they may collect information from our website visitors through a first-party pixel, in order to direct targeted advertising to you or to a custom audience on the social media platform.  These advertisements are governed by the privacy policies of those social media companies that provide them.  If you do not want to receive targeted ads on your social networks, you may be able to adjust your advertising preferences through your settings on those networks.

Third-Party Partners 

The following is a sample of the third-party service partners we work with to provide analytics, cross-device linking and/or advertising services. We will strive to update this list if or when we work with new partners which offer you a choices about the collection of your information, but as partners change and new technologies become available, this list is likely to change over time.

  • Adobe’s Analytics Service. We use Adobe Analytics to collect information about your use of the Services, which uses cookies and web beacons to help us understand more about the effectiveness of our advertising campaigns.  To learn more, please visit the Adobe Analytics Opt-Out page.
  • Google Analytics. We use Google Analytics to recognize you and link the devices you use when you visit our Services on your browser or mobile device, log in to your account on our Services, or otherwise engage with us.  We share a unique identifier, like a user ID or hashed email address, with Google to facilitate the service.  Google Analytics allows us to better understand how our users interact with our Services and to tailor our advertisements and content to you.  For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google’s website, “How Google uses information from sites or apps that use our services” located at https://google.com/policies/privacy/partners/.  You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Ad-On here:  https://tools.google.com/dlpage/gaoptout/.

We may also utilize certain forms of display advertising and other advanced features through Google Analytics.  These features enable us to use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick advertising cookie) or other third-party cookies together to inform, optimize, and display ads based on your past visits to the Services.  You may control your advertising preferences or opt out of certain Google advertising products by visiting the Google Ads Preferences Manager, currently available at https://myadcenter.google.com/home, or by visiting NAI’s online resources at https:// optout.networkadvertising.org.

Your Choices and Control Over Cookies, Tracking and Interest-Based Advertising Preferences

  • Cookies. Most browsers allow you to adjust your browser settings to: (i) notify you when you receive a cookie, which lets you choose whether or not to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject cookies. Depending on website configuration, some of our websites also allow you to adjust your cookie settings and accept or reject categories of cookies through a cookie banner, by clicking a link titled “Cookie Preferences” or similar in the website footer, or by clicking on the visible cookie icon to access such preferences. Blocking or deleting cookies may negatively impact your experience using the Services, as some features and services on our Services may not work properly. Deleting cookies does not delete Local Storage Objects (LSOs) such as Flash objects and HTML5.
  • Interest-based advertising and targeting cookies. We support the self-regulatory principles of the Digital Advertising Alliance (“DAA”). We work with advertisers, advertising networks, advertising servers, and analytics companies (“Ad Partners”) that use data collection technologies to understand how our Services are being used and to analyze your browsing history in order to deliver advertising relevant to your interests, as well as to provide advertising-related insights.  These advertisements may appear on other websites or services, including through social media networks.  These Ad Partners may be able to associate devices across third-party websites or services over time and link various devices used by the same individual. For more information about how Ad Partners use the information collected by these technologies and your options for restricting cookies placed by some of these Ad Partners, please visit the DAA’s opt-out page.  The DAA’s opt-outs are device- and browser-specific and may not work on all devices.  If you choose to opt-out through the DAA’s tools it does not mean you will cease to see advertising.  Rather, the ads you see will be based on the website or app you are visiting and not your interests.
  • Cross-device linking. Please note that opting-out of receiving interest-based advertising through the NAI’s and DAA’s online resources will only opt out a user from receiving interest-based ads on that specific browser or device, but the user may still receive interest-based ads on their other devices. You must perform the opt-out on each browser or device you use.
  • Mobile advertising. You may also be able to limit interest-based advertising through the settings on your mobile device by selecting “limit ad tracking” (iOS) or “opt out of interest-based ads” (Android).  You may also be able to opt out of some – but not all – interest-based ads served by mobile ad networks by visiting https://youradchoices.com/appchoices and downloading the mobile AppChoices app.
  • Some of these opt-outs may not be effective unless your browser is set to accept cookies. If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you may need to opt out again.

VI. Online Privacy Choices

You have some choices regarding how we use your personal information, including the following:

  • How to Control Promotional Email Communications Preferences. You can stop receiving promotional email communications from us by clicking on the “unsubscribe link” provided in the email.  You can also email us at [email protected] and ask to be unsubscribed from our marketing emails.  You may still receive Service-related communications (e.g., account verification, transactional communications, changes/updates to features of the websites and apps, technical and security notices).
  • How to Control Your SMS Text Messaging Preferences. If you no longer want to receive marketing SMS/text messages at a telephone number that you have provided to us for purposes of receiving such offers, text the word “STOP” to the short code provided in the marketing text messages from the phone number you want to have removed from any future marketing alerts or offers.
  • Modifying Your Device Settings. You can restrict our websites and apps from accessing certain device information, such as precise geolocation, by changing your permissions in your mobile device’s settings menu.  Please note that the withdrawal of permission to access some device information may result in an inability to take full advantage of our Services.
  • How to Control Your Affiliates Marketing Preferences. If you would prefer that we do not share your personal information on a going-forward basis with our affiliates for their direct marketing purposes, you may opt out of this sharing by contacting us at [email protected] and specifying that you want to opt out of affiliate sharing.
  • How to Control Your Tracking Technologies Preferences. For information on how to control your tracking technologies preferences, please see the Your Choices and Control Over Cookies, Tracking and Interest-Based Advertising Preferences section above.
  • Modifying or Deleting Your Information. If you have questions about reviewing, changing, or deleting your information, you can contact us directly at [email protected], or in person by visiting any CDI casino and other wagering venues and speaking to a customer service representative.  In your request, please identify the specific CDI entity with which you have interacted and provided your personal information, and please make clear what personal information you would like to have changed or updated.  For your protection, we may need to verify your identity before implementing your request.  Subject to applicable laws, including but not limited to our obligations regarding anti-money laundering laws, we may not be able to change or delete your information in all circumstances, and in some cases, you may be directed to the CDI entity you have a direct relationship with or to the context in which you normally interact with us (e.g., through an app).

VII. Region-Specific Notices

We may provide different or additional privacy policies relating to the processing of personal information about residents of certain countries, regions or states.  Please refer below for notices that may be applicable to you:

  • Residents of the United States. If you are a resident of the U.S., please scroll to the end of this Privacy Policy for a Supplemental U.S. Privacy Notice.

VIII. Use Of Services By Individuals Under Appropriate Age

A. Legal Gaming Age.

Any offer made or contests we conduct, unless otherwise noted, are not open to persons younger than the legal wagering or gaming age in the application jurisdiction (usually 18 or 21 years of age depending on the jurisdiction). Persons younger than this legal age are not allowed to use our Services, accept offers or win contests, and we do not knowingly collect information from such persons for gaming related offers.  We reserve the right to verify age at any time for any reason and may decline to provide products, Services or access rights to any person who does not have valid age identification.  Please note that for some of our properties, users may access limited aspects of the Services in compliance with applicable local laws.

B. Use of Services by Individuals Under 13.

None of the Services are directed towards children under the age of thirteen (13) and we will not knowingly collect or use any information from any person identified as being under the age of thirteen (13).

IX. Third-Party Websites

Our Services may include links to third-party websites, plug-ins and applications.  Except where we post, link to or expressly adopt or refer to this Privacy Policy, this Privacy Policy does not apply to, and we are not responsible for, any personal information practices of third-party websites and online services or the practices of other third parties.  To learn about the personal information practices of third parties, please visit their respective privacy policies.

X. Contacting Us

If you have any questions about this Privacy Policy, you may contact:

Webmaster
Churchill Downs Incorporated
600 N. Hurstbourne Parkway, Suite 400
Louisville, KY 40222
Telephone: 1 (502) 636-4400, or toll free: 1 (800) 283‑3729
Email:  [email protected]

XI. Changes/Updates To This Privacy Policy

We may change this Privacy Policy from time to time.  When we make changes to this Privacy Policy, we will change the “Last Updated” date at the top of this page.  Any changes will become effective when we post the revised Privacy Policy on the Services.  Your use of the Services following these changes means that you accept the revised Privacy Policy.

CHURCHILL DOWNS INCORPORATED U.S. STATE PRIVACY NOTICE SUPPLEMENT

Last Updated: April 25, 2025

This U.S. State Privacy Notice Supplement (the “U.S. State Privacy Notice”) supplements the information contained in our Privacy Policy by providing additional information about our personal information processing practices relating to residents of the U.S where certain state privacy laws apply.  For a detailed description of how we collect, use, disclose, and otherwise process personal information in connection with our Services, please visit our Privacy Policy.

Unless otherwise expressly stated, all terms in this U.S. State Privacy Notice have the same meaning as defined in our Privacy Policy above.

This U.S. State Privacy Notice does not apply to our processing of personal information relating to our job applicants, employees, contractors and other CDI personnel or other individuals other than residents of the states with comprehensive state privacy laws.

For a list of our controller entities, please click here.

       I. Collection of Personal Information

We have collected the following categories of personal information from individuals:

  • Identifiers, such as name email address, billing address, shipping address, zip code, telephone number, email address, date of birth, account name and password, or other similar identifiers;
  • Customer Records, such as driver’s license number, bank account information, credit or debit card information, or any other financial information;
  • Protected Classification Characteristics, such as Social Security number and age;
  • Commercial Information, such as your wagering activity, purchasing history and ordering behavior;
  • Internet/Network Information, such as IP address, device information, log and analytics data;
  • Geolocation Data, such as information about your physical location collected from geolocation features on your device, including your IP address and GPS (e.g., latitude and/or longitude);
  • Sensory information, such as pictures of you for your profile and recordings of phone calls between you and us, where permitted by law;
  • Professional/Employment Information, such as current occupation and income, job history and experience;
  • Other Personal Information, such as survey information, and information post on our applications or on social media pages, including pictures or videos of you, or other information you submit to us, We also collect information from the profile you create, such as your profile picture and loyalty program account number;
  • Inferences, including information generated from your profile, as well as any of the information above and your use of our Services.

The following personal information elements we collect may be classified as “sensitive” under certain privacy laws (“sensitive information”):

  • Your account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
  • Social security, driver’s license, state identification card, or passport number; and facial verification image;
  • Information about your citizenship or immigration status; and
  • Precise geolocation information.

CDI only uses or discloses sensitive information for the following purposes, where such use or disclosure is necessary and proportionate for those purposes:  for performing services you have requested, to comply with our legal and regulatory obligations, for detecting security incidents, fraud and other illegal actions, for identity verification purposes, to ensure the physical safety of natural persons, to perform services on behalf of the business, or for solely internal purposes, consistent with our Privacy Policy and any other expectations we’ve set with you.  CDI does not collect or process sensitive information for the purpose of inferring characteristics about a consumer.

We do not sell sensitive information, and we do not process or otherwise share sensitive information for the purpose of targeted advertising.  However, depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of sensitive information (as described below in Section III).

Deidentified Information.  We may at times receive, or process personal information to create, deidentified data that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household.  Where we maintain deidentified data, we will maintain and use the data in deidentified form and not attempt to reidentify the data except as required or permitted by law.

    II.  Sale and Sharing of Personal Information

As described in How Personal Information May Be Shared and Disclosed (Section IV) of our Privacy Policy, we may sell or share your personal information to third parties for targeted advertising purposes, subject to your right to opt out of those “Sales” (see The Right to Opt Out of Personal Information Sales below in Section III). 

In the previous 12 months, we have “sold” the following categories of personal information to third parties, subject to your settings and preferences and your Right to Opt Out:

  • Identifiers
  • Commercial Information
  • Internet / Network Information
  • Non-Precise Geolocation Data
  • Inferences

The categories of third parties to whom we sold your personal information include: travel and ticketing partners; third-party users and partners; ad networks and advertising partners; and social networks. 

Please see the How Personal Information May Be Shared Or Disclosed section of our Privacy Policy for additional information regarding categories of third parties to whom we disclose personal information for a business purpose or sell personal information.

   III. Your Privacy Choices

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

The Right to KnowThe right to confirm whether we are processing personal information about you and, under California law only, to obtain certain personalized details about the personal information we have collected about you, including:The categories of personal information collected;The categories of sources of the personal information;The purposes for which the personal information were collected;The categories of personal information disclosed to third parties (if any); The categories of recipients to whom the personal information were disclosed;The categories of personal information shared for cross-context behavioral advertising purposes (if any), and the categories of recipients to whom the personal information were disclosed for those purposes; andThe categories of personal information sold (if any), and the categories of third parties to whom the personal information were sold.
The Right to Access & PortabilityThe right to obtain access to the personal information we have collected about you and, where required by law, the right to obtain a copy of the personal information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.
The Right to CorrectionThe right to correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information.
The Right to Control Over Sensitive InformationThe right to exercise control over our collection and processing of certain sensitive information.
The Right to DeletionThe right to have us delete the personal information we maintain about you.
The Right to Opt Out of Sales or Sharing of Personal InformationThe right to direct us not to “sell” your personal information to third parties for monetary or other valuable consideration, or “share” your personal information to third parties for cross-context behavioral advertising and targeted advertising purposes.
The Right to Control Over Automated Decision-Making / ProfilingThe right to direct us not to use automated decision-making or profiling for certain purposes.Depending on your state of residency, you may also question the result of any profiling, be informed of the reason resulting in the decision, review the personal information used for profiling (if inaccurate have the decision reevaluated), and, if feasible, be informed about actions you may take to secure a different decision in the future if your personal information is profiled in furtherance of decisions that produce legal or similarly significant effects.
Right to AppealIf we decline to take action on a request exercising one of your rights set forth above, you have the right to appeal our decision.

Non-Discrimination / Non-Retaliation.  Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights.  However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

How to Exercise Your Consumer Rights.  When you submit a request to us, please identify the specific CDI entity with which you have interacted and provided your personal information and enough information for us to identify you and fulfill your request.

We will need to verify your identity before processing your request.  In order to verify your identity, we will generally either require the successful login to your account or the matching of sufficient information about you to the information we maintain about you in our systems.  Although we try to limit the personal information collected in connection with requests, certain requests may require us to obtain additional personal information from you for added certainty, including, but not limited to, your email address, mailing address, and/or date of last interaction with customer service.  In certain circumstances, we may decline a request to exercise the right to know and delete, particularly where we are unable to verify your identity.

How to Exercise Your Rights.  To submit a request under your rights, you may choose from the following options:

  • Emailing [email protected] with the subject line “Consumer Rights Request” and sufficient information in the content of the message to identify you in our records.
  • Calling us at 1 (800) 283‑3729, or if you are a Twinspires customer, calling us at 1 (877) 774‑7371.

How to Exercise Your Right to Opt Out of “Sales” or “Sharing” of Personal Information.  As is common practice among companies that operate online, we do allow certain advertising networks, social media companies and other third-party businesses to collect and disclose your personal information directly from your browser or device through cookies and related technologies when you visit or interact with our websites and otherwise engage with us online.  For example, they may collect Internet/Network information, such as a cookie or device ID, browsing history and website usage, geolocation data, and Inferences generated from your browsing history and interactions with our service as well as other sites and services.

These third parties use this personal information to serve relevant ads on our site, on other websites or mobile apps, or on other devices you may use, or to personalize content and perform other advertising-related services such as reporting, attribution, analytics and market research.  These third-party businesses may use such information for their own purposes in accordance with their own privacy statements, which may include reselling this information to additional third parties, including other advertising networks.  Please see the Third-Party Data Collection and Online Advertising section of our Privacy Policy for more information about how third parties use cookies and related technologies to collect information automatically on our websites and other online services, and the choices you may have in relation to those practices.

To opt out of the “sales” or “sharing” of your personal information for the purposes of targeted advertising, or any potential future “sales” or “sharing” of your personal information, please complete the following steps.

  • Website. To opt out of advertising cookies on the website:
    • Navigate to your browser’s settings and clear your cache and delete all cookies stored on your browser. Then, please visit here, where you can opt out of the use of your personal information for advertising by businesses that participate in the opt-out tool.  Please note that this opt-out is device- and browser-specific and will not be effective on your visits to the services from other devices, browsers or through the app.  Please note that deleting and opting out of some cookies may result in an inability to take full advantage of the services.
    • You may also click the “Do Not Sell or Share My Personal Information” link in the website footer to adjust your cookie preferences. Most browsers allow you to adjust your browser settings to: (i) notify you when you receive a cookie, which lets you choose whether or not to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject cookies. Depending on website configuration, some of our websites also allow you to adjust your cookie settings and accept or reject categories of cookies through a cookie banner, by clicking a link titled “Cookie Preferences” or similar in the website footer, or by clicking on the visible cookie icon to access such preferences. Blocking or deleting cookies may negatively impact your experience using the Services, as some features and services on our Services may not work properly. Deleting cookies does not delete Local Storage Objects (LSOs) such as Flash objects and HTML5. Please note that this opt-out is specific to your browser or mobile device. You must perform the opt-out on each browser or device that you use.
  • App. To opt out of advertising related trackers on the app,
    • You may download the DAA’s CCPA App-based Opt-Out Tool, which opts out of data processing by third parties enrolled in the DAA’s program. Please note that this opt-out is device-specific and will not be effective on your visits to the services from other devices or through the website.
    • You may also click the “Do Not Sell or Share My Personal Information” link in the “About” section to adjust your preferences. Please note that this opt-out is specific to your mobile device. You must perform the opt-out on each device that you use.
  • Other Potential Future “Sales” and Sharing. If you are a registered user, you may request to opt out of other potential future “sales” and “sharing” and to be added to our suppression list by:
    • Emailing us at [email protected] with the subject line “Consumer Opt-Out Request” and sufficient information in the content of the message to identify you in our records.
    • Calling us at 1 (800) 283‑3729, or if you are a Twinspires customer, calling us at 1 (877) 774‑7371.
    • Submitting a request via our online form:
      • For Calder Casino, click here.
      • For Churchill Downs Racetrack, click here.
      • For Colonial Downs Racetrack and Rosie’s Gaming Emporium, click here.
      • For del Lago Resort Casino, click here. 
      • For Derby City Gaming, click here.
      • For Derby City Gaming Downtown, click here.
      • For Ellis Park and Owensboro Racing & Gaming, click here.
      • For Fair Grounds Racecourse & Slots, click here.
      • For Hard Rock Hotel & Casino Sioux City, click here.
      • For Harlow’s Casino Resort & Spa, click here.
      • For Newport Racing & Gaming, click here.
      • For Oak Grove Racing, Gaming & Hotel, click here.
      • For Ocean Downs Casino, click here.
      • For Oxford Casino Hotel, click here.
      • For Presque Isle Downs & Casino, click here.
      • For Riverwalk Casino Hotel, click here.
      • For Terre Haute Casino Resort, click here.
      • For The Rose Gaming Resort, click here.
      • For Turfway Park Racing and Gaming, click here.
      • For TwinSpires.com, click here.
      • For BetAmerica.com, click here.

Minors.  We do not sell or share for targeted advertising purposes the personal information of consumers we know to be less than 16 years of age.  If we wish to do so in the future, we will first seek affirmative authorization from either the minor who is between 13 and 16 years of age, or the parent or guardian of a minor less than 13 years of age.  Please contact us at [email protected] to inform us if you, or your minor child, would like to opt-in to sales.

If you are under the age of 18 and you want to remove your name or comments from our website or publicly displayed content, please contact us directly at [email protected].  We may not be able to modify or delete your information in all circumstances.

Authorized Agents.  In certain circumstances, you may permit an authorized agent to submit requests on your behalf.  The authorized agent must provide a letter signed by you confirming the agent has permission to submit a request on your behalf, or must provide sufficient evidence to show that the authorized agent has been lawfully vested with power of attorney.

For security purposes, we may need to verify your identity and confirm directly with you that you have provided the authorized agent permission to submit the request, and it may take additional time to fulfil agent-submitted requests.  We may deny a request in the event we are not able to verify the authorized agent’s authority to act on your behalf.  Please note that for privacy and security reasons, we will direct future communications to the data subject on whose behalf the request was made.

If you wish to submit a request to access, modify or delete information on behalf of your minor child in accordance with applicable jurisdictional laws, you must provide sufficient information to allow us to reasonably verify your child is the person about whom we collected personal information and you are authorized to submit the request on your child’s behalf (i.e., that you are the child’s legal guardian or authorized representative).

IV. Retention of Personal Information

We retain personal information only for as long as is reasonably necessary to fulfil the purpose for which it was collected.  However, if necessary, we may retain personal information for longer periods of time, until set retention periods and deadlines expire, for instance where we are required to do so in accordance with legal, tax and accounting requirements set by a legislature, regulator, or other government authority.

To determine the appropriate duration of the retention of personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting and other applicable obligations.

Therefore, we retain personal information for as long as the individual continues to use our services for the purposes explained in How We Use Your Information (Section III) of our Privacy Policy.  When an individual discontinues the use of our services, we will retain their personal information for as long as necessary to comply with our legal obligations, to resolve disputes and defend claims, as well as, for any additional purpose based on the choices they have made, such as to receive marketing communications.  In particular, we will retain personal information supplied when joining our services, including complaints, claims and any other personal information supplied during the duration of an individual’s contract with us for the services until the statutory limitation periods have expired, when this is necessary for the establishment, exercise or defense of legal claims.

Once retention of the personal information is no longer necessary for the purposes outlined above, we will either delete or deidentify the personal information or, if this is not possible (for example, because personal information has been stored in backup archives), then we will securely store the personal information and isolate it from further processing until deletion or deidentification is possible.

  V. Notice of Financial Incentive

We offer various financial incentives to consumers who allow us to collect and retain personal information.  For example, the financial incentives we may provide include:

  • Periodic promotions and special offers, including deposit and gaming offers.
  • Registration and referral bonuses.
  • Communications channel offers, such rewards for signing up for a newsletter.
  • Loyalty programs, where you earn rewards based upon your past deposits or wagers with us.

When you sign up for our email list, create an account, refer a friend or otherwise sign-up for a promotion or special offer, you opt-in to participate in a financial incentive program.  Participation in any financial incentive program is entirely optional and participants may withdraw from the program at any time.  To opt out of the program and forgo any ongoing incentives, you may unsubscribe from our emails (for email-based incentives), close your account (for loyalty and reward program incentives) contact player services using the contact information below, or submit a request to delete your information.

The financial incentives we offer to consumers are reasonably related to the value of the consumer’s data to our business, based on our good-faith, reasonable but sole determination.  We estimate the value of consumers’ personal information by considering the expense incurred by the business related to the collection, storage and retention of consumers’ personal information in the context of the financial incentive program and the expenses related to the provision of the financial incentive.  From time to time, we may provide additional terms that apply to a particular financial incentive, which will be presented to you at the time you sign up for the financial incentive.

For Twinspires customers:  For more information about our TSC Rewards loyalty program, please visit:  https://www.twinspires.com/tsc-rewards.

  VI. Updates to This U.S. State Privacy Notice

We will update this U.S. State Privacy Notice from time to time.  When we make changes to this U.S. State Privacy Notice, we will change the “Last Updated” date at the beginning of this U.S. State Privacy Notice.  If we make material changes to this Supplemental U.S. Privacy Notice, we will notify you by email to your registered email address, by prominently posting on our online Services, or through other communication channels.  All changes shall be effective from the date of publication unless otherwise provided in the notification.

Contact Us

If you have any questions or requests in connection with this U.S. State Privacy Notice or other privacy-related matters, please send an email to [email protected].  Alternatively, inquiries may be addressed to:

Webmaster
Churchill Downs Incorporated
600 N. Hurstbourne Parkway, Suite 400
Louisville, KY 40222
Telephone: 1 (502) 636-4400 or toll-free: 1 (800) 283‑3729