Privacy Policy

Last Updated: October 28, 2025

This Privacy Policy (“Policy”) describes the data practices of Twenty-Nine Palms Enterprises Corporation, operating as Spotlight 29 Casino and Tortoise Rock Casino. Twenty-Nine Palms Enterprises Corporation (“we,” “our,” “us”) is owned and operated by the Twenty-Nine Palms Band of Mission Indians, a federally recognized Indian tribe located in Southern California.

The Policy explains how we process your personal data when you interact with us online or offline (collectively, the “Services”).

California Notice. This Policy includes disclosures and rights for California residents under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”).

Type of Information We Collect

We may collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and services when you participate in activities on the Services, or otherwise when you contact us. The personal information we collect may include:

Personal Data

Name
Date of Birth
Sex/Gender
Age
Height
Weight
Eye Color
Hair Color
Email address
Phone number
Mailing/Shipping Address
Driver’s License Information (i.e., license type, driver’s license number, issue date, and expiration date)
Imaging of Driver’s License (i.e., full image of front of driver’s license, image of signature, and image of photo on the driver’s license)
Social security number (i.e., in whole or last four digits)
Passport numbers (i.e., passport number, issue date, expiration date, country code, place of issue, and place of birth)
Financial information (i.e., ACH information)

Mobile Application Data

If you choose to use our mobile application, the following personal information that may be collected includes:

Geo-Location Information: We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application, to provide location-based services. If you wish to change our access or permissions, you may do so in your device’s settings.
Mobile Device Access: We may request access or permission to certain features from your mobile device, including your mobile device’s Bluetooth, calendar, camera, reminders, sensors, SMS messages, social media accounts, storage, and other features. If you wish to change our access or permissions, you may do so in your device’s settings.
Mobile Device Data: We may collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information, and IP address.
Push Notifications: We may request to send you push notifications regarding your account or the application. If you wish to opt-out from receiving these types of communications, you may turn them off in your device’s settings.

How We Collect Information

We may collect personal information from various sources, including:

When you voluntarily provide it to us
When you sign up and create an account
When you register and enroll for a 29 Rewards Royalty Club card
When you sign up to receive emails, special promotions, offers, event information, the newsletters, or other communications (e.g., social media sites)
When you sign up for our Services through our mobile app
From third parties for our business purposes
When you make purchases
When you communicate with us
When you submit a request for an IRS Form W-2G or Form 1099
When you consent to receive text messages, we collect your mobile telephone number in order to send you the text messages; you will also have the option to stop receiving text messages
When you contact us offline or submit information to us offline
When you apply for a job with us
When you use our Kiosks
When you provide your personal information through our websites
When you provide your personal information through our mobile apps
When you subscribe to our mailing list
When you respond to a survey
In connection with your use of the Services (e.g., via our websites and devices you connect to the Services)
From our service providers, partners, and third parties, such as those discussed in the “How We Use Your Information” and “How We Share Your Information” sections below
From other platforms that you may use to engage with us
Automatically from devices that you use to connect to our websites and mobile apps
In public areas, through our use of safety and security technologies that we may use when you visit our locations

From time to time, we may use or augment the personal data we have about you with information obtained from other sources, such as public databases, social media platforms, and other third parties, including to perform obligations required under applicable law and/or for the safety and security of our guests and our business.  We may also use such third-party information to confirm contact information or to better understand your interests by associating demographic information with the information you have provided.

How We Use Your Information

We may use the personal information we collect to operate our Services including:

To personalize user experience;
To facilitate purchases and transactions;
To facilitate reservations;
To verify your eligibility for a 29 Rewards Loyalty Club membership;
To improve our websites;
To communicate with you about our Services;
To conduct or administer surveys and other market research for our business purposes;
To enable our targeted advertising to you through the use of cookies and similar technologies, as discussed below in our “Cookies and Similar Technologies” section;
To respond to requests, questions and comments;
To provide you with our newsletters, articles, announcements, invitations, and other information about our Services;
To share your personal information with third parties, as discussed below in our “How We Share Your Information” section;
Based on your consent to receive e-mails, messages, notifications, or phone calls, we will send you communications about our Services, including providing you with personalized advertisements that identify products, services, games, or events that we think may be of interest to you based on your purchasing and gaming habits when you visit our websites;
To enable you to connect with third parties or use third party sharing functionality such as third-party social media widgets, tools, and buttons;
To validate your ability to access or use our Services;
To comply with legal requirements, judicial processes, and our policies (e.g., to verify users’ identities in connection with access or correction requests);
If you apply for a job, we may also use the information to assess qualifications and personal experience to determine if it meets specific job requirements; and help us inform candidates of future openings;
To protect the safety and security of our guests, personnel, locations, and the general public.

We may also aggregate or deidentify any personal data that we collect in connection with our Services, such that the data is no longer personally identifiable or attributable to you. We may use such aggregated or de-identified data for our own legitimate business purposes without restriction.

How We Share Your Information

We may share your personal information:

Within our family of companies (including sharing between Spotlight 29 Casino, Tortoise Rock Casino, Red Falcon Dispensary & Lounge, and Shelee’s Travel Center), our branded subsidiaries, joint ventures, and other companies in the United States under our common control (collectively, “Affiliates”);
With your consent and at your direction;
When you voluntarily provide content for the purpose of it being shared with other users, such as on social media;
To verify your eligibility for a credit card or other services; and
To protect payment transactions against fraud or identify theft

Third Parties

We may also share personal information we collect with third parties that perform services for us or on our behalf, including, but not limited to, for the purposes of operating our website and apps, assisting us to perform business functions and operations, fulfilling requests by you, and for marketing purposes. More information about the personal information we collect and share with third parties is shown in our CPRA Data Tables.

We reserve the right to transfer the data we maintain in the event we sell or transfer all or a portion of our business or assets.  If we engage in such a sale or transfer, we will make reasonable efforts to direct the recipient to use your personal data in a manner that is consistent with this Policy.  After such a sale or transfer, you may contact the recipient with any inquiries concerning the recipient’s privacy practices.

What Happens If You Do Not Provide Your Personal Information To Us?

If you choose not to share the personal information we request or require for our Services, business processes, and activities, it might limit our ability to deliver those Services to you.  It could also hinder our response to your inquiries or complaints and restrict the support we can offer.  Additionally, without this information, we may be unable to keep you informed about products and services that might interest you.

“Do-Not-Sell” Status

We do not sell, trade, or otherwise transfer your personal information to third parties. This does not include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential.

However, we may disclose personal information to assist with or otherwise enable our compliance with a legal or regulatory obligation, protect and defend our rights or property, and protect the safety of our users or the public.

Right to Decline Marketing Communications

If you do not wish to receive marketing communications from Spotlight 29 Casino and Tortoise Rock Casino you may unsubscribe from receiving electronic marketing communications or other commercial emails from us by following the instructions included in the email, text message, or by completing the Marketing Modification Web Form located in the “Contact Us” section. You may also make that request any time while you are on property at Spotlight 29 Casino and Tortoise Rock Casino by visiting our 29 Rewards desk. You will always have the ability to accept or decline any form of marketing communication from Spotlight 29 Casino and Tortoise Rock Casino. We will work to comply with your request as soon as we can.

However, even if you opt out of receiving such communications, we retain the right to send you non-marketing communications (such as information about changes to our Privacy Policy or Terms of Use).

Text Messaging and SMS

You may elect to sign up to receive promotional text messages from us.  The terms of each promotion will be made available to you at that time.  Upon election:

We will clearly and conspicuously disclose the intent to send marketing and advertising text messages to your designated telephone number using an automated dialing system, including the frequency and quantity of messages and their nature;
You will need to provide your signature (which can be electronic); 
Message and data rates may apply; 
You will receive instructions on how to opt-out and how to get help (typically, STOP to quit and HELP for help);
Your carrier may have limitations or restrictions on availability that may apply; 
Opting-in is not a condition of purchase; and 
We will share a link with you to our Policy

Cookies and Similar Technologies

We, our service providers, and our business partners may collect certain information about the use of our websites and apps by automated means, such as cookies, web beacons, HTML5 local storage, and other technologies. We may also collect information about online activities over time and across third-party websites.

The information that may be collected by automated means includes:

URLs that refer users to our website
Search terms used to reach our website
Details about the devices that are used to access our website (such as IP address, browser type, operating system information, geolocation, and mobile device information)
Details about users’ interaction with our website (such as the date, time, frequency, and length of visits, and specific pages accessed during the visits)

Web browsers may offer users of our website the ability to disable receiving certain types of cookies; however, if cookies are disabled, some features or functionality of our website may not function correctly. To support and enhance our Services, we may serve advertisements through our Services. These advertisements are sometimes targeted and served to particular users and may come from third party companies called “ad networks.” Ad networks include third party ad servers, ad agencies, ad technology vendors, and research firms. We are not responsible for the privacy practices of these ad networks and other parties. Advertisements served through the Services may be targeted to users who fit a certain general profile category, which may be inferred from information you provide to us, based on your Services usage patterns, or based on your online activities. We do not provide personal information to any ad networks for use other than in connection with our Services.

You can make decisions about your privacy and the ads you receive. You can control whether companies serve you on-line behavioral advertising by visiting the Digital Advertising Alliance website and using its opt-out: https://optout.aboutads.info/. The DAA opt-out requires that cookies not be blocked in your browser. To learn more about ad networks and to adjust your preferences you may also visit the Network Advertising Initiative: https://thenai.org/about-online-advertising/.

Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, we do not respond to web browser-based DNT signals at this time.

Please note that not all tracking will stop even if you delete cookies.

Links to Other Websites and Third-Party Content

We may provide links to other websites, services, and applications that are not operated or controlled by us (the “Third Party Services”). This Policy does not apply to Third-Party Services.  While we attempt to facilitate access only to those Third-Party Services that share our respect for your privacy, we cannot take responsibility for the content, privacy policies, or practices of those Third-Party Services.  We encourage you to review and understand the privacy practices of any Third-Party Services before providing any information to or through them.  Your interactions with these features are governed by the privacy policy of the Third-Party Service that provides the feature.

Collection, Storage, and Use in the United States

Our website and mobile app services are operated from within the United States, and by submitting your personal information to us, either through our websites, mobile apps, or by other means, you consent to the transfer, collection, usage, storage, and processing of your personal information in the United States as outlined in this Policy.

Please note that your personal information may be used by us in the jurisdiction where it was collected, as well as in the United States, where laws regarding the use of personal information may be less strict than the jurisdiction in which you reside.

How We Protect Information

We implement a variety of security measures to maintain the safety of your sensitive personal information when you place an order or access your personal information.

We implement reasonable and appropriate safeguards, including TLS 1.2+ in transit, encryption at rest, role-based access, MFA, least-privilege, logging/monitoring, data loss prevention, and third-party risk management. Payment card data is tokenized and processed by PCIDSS compliant providers; we do not store full card numbers or security codes. We continuously assess and improve our controls.

More information about the categories of sensitive personal information we collect and use is shown in the CPRA Data Tables page.

Content Submitted by You

Some features of the Services allow you to post content on our website, app or social media pages, such as photos. Content that you provide may be shared publicly or with other users or third parties.

Data Retention

We retain personal information by category for certain periods of time or as required by law (e.g., gaming, tax, fraud prevention), after which we delete or deidentify it. If we place data under legal hold or require it for security or compliance, we will retain only what is necessary for that purpose and for no longer than required.

More information about how long we retain personal information is shown in the CRPA Data Tables page.

Notice of Financial Incentive

Spotlight 29 Casino and Tortoise Rock Casino provide you with discounts on eligible products and services and the opportunity to earn rewards that provide credits towards and discounts on participating items and services. Your use of Spotlight 29 Casino and Tortoise Rock Casino’s 29 Reward Loyalty Club card enables us to select and personalize coupons, promotions, and other discounts or offers, based on your use of the card. The 29 Rewards program is subject to termination at any time at our sole discretion. You may also withdraw from the 29 Rewards program at any time by visiting the 29 Rewards Desk.

Persons Under Ages 18

You must be eighteen (18) years or older to access or use our websites and mobile apps. If you are under 18, you are not permitted to access or use our websites or mobile apps for any reason.

We do not knowingly collect personal information from children under thirteen (13) online. We do not knowingly sell or share personal information of consumers under sixteen (16). If we learn we collected such information, we will delete it.

If you believe we have inadvertently collected personal information about a person under 18, please notify us using the contact information provided in the “Contact Us” section below.

Changes to Our Privacy Policy

We may update our Policy periodically.  If we do make changes, we will post those changes on this page and indicate at the top of this page the date this Policy was last revised.  Any changes will be effective only after the effective date of the change.

Your Privacy Rights

You may have certain rights and choices regarding our processing of your personal information.  Depending on your jurisdiction, applicable law may entitle you to additional consumer rights, including the right (with certain limitations and exceptions) to:

Right to Know: You may access personal information we retain about you using the methods provided below. If we grant your request, we will provide you with a copy of the personal information we retain about you in the ordinary course of business. This may include what personal information we collect, use, or share about you. We may not fulfill some or all of your request(s) to access personal information as permitted by applicable law.
Right to Correct Information: You may request that we correct your personal information. Depending on the scope of the request we may refrain from granting your request, as permitted by applicable law. Upon receiving the request, we may ask that you provide evidence that any of your personal information retained by our enterprise is inaccurate.
Deletion of Personal Information: You may request that we delete your personal information. Depending on the scope of your request, we may refrain from granting your request, as permitted by applicable law. For example, we may be legally required to retain your information in our business records. You may submit a deletion request using the methods provided below.
Opt-out of Sale or Sharing of Personal Information: You have a right to opt-out sale or sharing of your personal information with third parties. In order for you to exercise this right, please visit our “Do Not Sell or Share My Personal Information” page.
Right to Limit the Use of Sensitive Personal Information: If we process sensitive personal information, you have a right to limit our use of your sensitive personal information. If we grant your request, we will stop processing your sensitive personal information, but we may continue to process it for other purposes necessary to our business operations, including to meet legal, regulatory and security requirements or provide a product or service you requested. In order for you to exercise this right, please visit our “Limit the Use of My Sensitive Personal Information” page. Note that sensitive personal information that is collected or processed for purposes other than inferring characteristics about an individual is not subject to this right.
Freedom from Retaliation and Discrimination: We will not retaliate against you for exercising your privacy rights, including when you are job applicant, employee, or independent contractor. We will not discriminate against you, in terms of price or Services that we offer, if you submit one of the requests listed above.

If you choose to exercise any of these rights, we are required to verify your identity to prevent unauthorized access of your personal information. This may require us to ask you certain questions to confirm your identity or require you to provide state-issued identification.  Requests to exercise these rights may be granted in whole, in part, or not at all, depending on the scope and nature of the request and applicable law.  Where required by applicable law, we will notify you if we reject your request and notify you of the reason(s) we are unable to honor your request.

To Exercise Rights (other than Opt Out of Sale)

To exercise your privacy rights described above, please contact us using the Privacy Rights Web Form located in the “Contact Us” section. If you have any questions or concerns regarding your privacy rights, you may contact us using the contact information provided below.

Contact Us
If you have any questions, requests or complaints regarding this Privacy Policy or about how we process your personal information, please contact us using the contact details below.

To submit an online marketing request related to opting out of marketing, please complete our  Marketing Modification Web Form.

To submit an online Privacy Request to access, modify, or delete data we hold about you, please complete our  Privacy Rights Web Form.

For all other matters, please use the information below: