Privacy Policy

OBSERVE: Purposes align to service, safety, and law. EXPAND: We avoid incompatible secondary uses. REFLECT: New purposes will be notified and, where required, consent obtained.

Disclosure & Sharing

• Payment partners: Banks, card schemes, payment processors, and anti-fraud vendors to process transactions and prevent abuse.
• Verification/KYC providers: Identity validation, sanctions/PEP screening, address and age verification, document authentication.
• Technology/service providers: Hosting, security, email/SMS delivery, analytics, customer support tools, content providers, game studios.
• Affiliates and group companies: For consolidated reporting, compliance operations, and support; marketing only with your consent.
• Regulators and law enforcement: Where legally required (e.g., AML/CTF, court orders) or to protect rights, safety, and integrity of the platform.
• Advertising networks (with consent): Ad tech partners for measurement and personalized marketing; cookie controls apply.
• Business transactions: In a merger, acquisition, or corporate reorganization, subject to safeguards and continued protections.

OBSERVE: Disclosures are functionally necessary or legally mandated. EXPAND: Contracts bind processors to confidentiality and security. REFLECT: We do not sell personal information.

International Transfers

Your information may be processed in Malta, the EU/EEA, the United Kingdom, the United States, Canada, and other locations where our service providers operate.

• From Canada: We use contractual, organizational, and technical safeguards to ensure comparable protection. You may contact us to learn about offshore processing locations.
• From the EEA: We rely on European Commission Standard Contractual Clauses (SCCs) and supplementary measures.
• From the UK: We use the UK IDTA/Addendum with SCCs where appropriate.
• To US vendors: We use SCCs and, where relevant to EEA-origin data, partners certified under the EU-U.S. Data Privacy Framework.

OBSERVE: Cross-border processing is inherent to global gaming operations. EXPAND: We implement layered safeguards and conduct transfer risk assessments where required. REFLECT: We will provide copy-of-clauses information upon request, subject to redactions.

Data Retention

• Account and identity data: For the life of the account and 5 years after closure, or longer where necessary for legal claims or regulatory obligations.
• KYC/AML documentation: 5 years after account closure or last transaction, unless law requires a longer period.
• Transactions and financial records: 7 years for accounting/audit and fraud prevention.
• Behavioral and logs (security/operations): 12-24 months, unless needed for investigation or legal defense.
• Marketing data: Until you opt out or after 24 months of inactivity, whichever occurs first.
• Cookies: Session cookies (end of session); persistent cookies typically 6-24 months (see Cookies section).
• Complaints/disputes: Case file retention 2-7 years depending on matter.

Deletion occurs upon expiry of retention periods, successful erasure requests, or when purposes end, subject to legal holds. OBSERVE: Gambling and AML rules require minimum retention. EXPAND: We segregate and minimize data. REFLECT: We apply secure deletion and backup purging protocols.

Your Rights

• Canada (PIPEDA and applicable provincial laws): Access your data; request corrections; withdraw marketing consent; challenge compliance; learn about cross-border processing. We respond within 30 days, free of charge (reasonable fees may apply for unusual requests as allowed by law).
• EU/UK (GDPR/UK GDPR, if applicable): Rights of access, rectification, erasure, restriction, objection (including to profiling/marketing), data portability, and withdrawal of consent; lodge a complaint with a supervisory authority.
• Mexico (where applicable): ARCO rights (Access, Rectification, Cancellation, Opposition) under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

How to exercise your rights

1. Submit request: Email [email protected] from your registered email or write to our postal address. Specify the right you wish to exercise and include your account ID and jurisdiction.
2. Verify identity: We may request additional information to confirm your identity.
3. Response timeline: We aim to respond within 30 days. If we need more time, we will notify you with reasons and a new date.
4. Outcomes: If we cannot fulfill a request (e.g., due to legal obligations or others' rights), we will explain the reasons and your options to escalate.

OBSERVE: Rights vary by jurisdiction. EXPAND: We provide a single channel and clear verification steps. REFLECT: We do not discriminate for exercising privacy rights.

Cookies & Tracking Technologies

Types and purposes

• Strictly necessary (session/persistent): Core functionality, security, login, load balancing.
• Functional (persistent): Preferences, language, remembering settings.
• Analytics (first/third-party): Usage metrics, performance, diagnostics, A/B testing.
• Advertising/marketing (third-party): Measurement, frequency capping, personalization (only with consent).

Controls

• Browser settings: Block or delete cookies. Blocking may impact functionality.
• Site controls: Our cookie banner/preferences center lets you manage non-essential cookies.
• Do Not Track: We currently do not respond to DNT signals; use our preference tools instead.

OBSERVE: Cookies support performance and compliance. EXPAND: We default to minimal non-essential tracking. REFLECT: Consent choices can be changed at any time.

Data Security

• Encryption: TLS 1.2+ for data in transit; strong encryption (e.g., AES-256) at rest for sensitive fields.
• Access controls: Role-based access, MFA, least-privilege, segregation of duties, just-in-time access for production systems.
• Monitoring and testing: Vulnerability management, regular penetration testing, code reviews, logging and anomaly detection.
• Organizational measures: Security and privacy training, background checks where lawful, vendor due diligence, incident response plan, data protection impact assessments where required.
• Standards: Our security program aligns with recognized frameworks (e.g., ISO/IEC 27001). Selected vendors maintain SOC 2 or equivalent certifications.
• Breach response: If a breach poses a real risk of significant harm to Canadians, we notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible and keep records for 24 months. For GDPR-covered data, we notify supervisory authorities within 72 hours where required.