Data Collection and Privacy Standards
Data Handling, Cookies, and Compliance
What Specific Information Do We Collect?
Compliance with PIPEDA is subject to independent federal oversight rather than self-certification. The Office of the Privacy Commissioner of Canada (OPC) is the federal authority responsible for enforcing PIPEDA and for investigating complaints from individuals who believe an organization has mishandled their personal information. A user who submits a formal privacy request to our designated Data Protection Officer and remains unsatisfied with the response retains the right to file a complaint directly with the OPC.
Where a service provider processes data outside Canada, contractual safeguards equivalent to Canadian standards are required before any transfer takes place, consistent with the guidance the OPC publishes on cross-border data flows. These safeguards apply to identity verification vendors, payment processors, and fraud detection providers referenced elsewhere on this page, and do not extend blanket access to any additional party not listed in that section.
Questions regarding a specific data request, a correction to an existing record, or the scope of a prior disclosure can be directed to the designated Data Protection Officer through the contact information published on the about and contact information page.
What Categories of Cookies Do You Use?
Account registration and wagering activity generate distinct categories of records, each retained for a different purpose. Identity and KYC documentation is retained to satisfy anti-money laundering obligations under FINTRAC and provincial licensing requirements. Transaction logs, including deposits, withdrawals, and settled wager history, are retained to support dispute resolution, fraud investigation, and regulatory audit. Marketing preferences and communication opt-ins are retained separately and can be withdrawn at any time without affecting the retention of identity or transaction records, which remain subject to the statutory minimum described elsewhere on this page.
Where a player has activated self-exclusion through the tools described in the responsible gambling guide, records confirming that exclusion status are retained specifically to prevent inadvertent re-registration, separate from and in addition to standard transaction retention.
Who Do You Share My Data With?
Automated processing plays a limited, defined role in how accounts are managed. Deposit and withdrawal requests pass through automated risk-scoring checks designed to flag irregular transaction patterns, such as a sudden jump in wager size or a rapid sequence of deposits from different payment sources, for manual review rather than automatic rejection. These checks support fraud prevention and anti-money laundering compliance and do not extend to profiling unrelated to account security or regulatory obligations.
Wagering pattern data is also used internally to support responsible gambling monitoring, including flagging account activity consistent with the warning signs described in the responsible gambling guide for potential proactive outreach. This internal use is separate from any marketing purpose and does not involve sharing wagering pattern data with advertisers or unaffiliated third parties.