Privacy Policy

We use your personal information only for the purposes for which it was collected or for directly related purposes. These include: (a) creating and managing your player account; (b) verifying your identity and age as required by our Kahnawake Gaming Commission licence (KGC/2024-07823) and Canadian AML/KYC regulations; (c) processing deposits and withdrawals; (d) detecting and preventing fraud, money laundering, and other prohibited activities; (e) providing customer support; (f) sending you account-related communications (transaction confirmations, security alerts, required notices); (g) sending promotional communications — only if you have explicitly opted in; (h) complying with our legal obligations under federal and provincial law.

We do not use your personal information for automated decision-making that has significant legal or similarly significant effects on you without providing human review. Our fraud detection systems may flag accounts for review based on data patterns, but account closure or fund restriction decisions are reviewed by a human compliance officer before action is taken.

If we want to use your information for a new purpose not covered by this policy, we will notify you and, where required by PIPEDA, obtain your consent before proceeding. You always have the right to withdraw consent for optional uses (such as marketing) at any time through your account settings or by contacting us at [email protected].

PIPEDA requires that we adhere to 10 fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. We have appointed a Privacy Officer responsible for our compliance with these principles. If you have a privacy concern, contact us first — our Privacy Officer will respond within 5 business days.

Under PIPEDA's mandatory breach reporting requirements (in force since November 2018), we are required to report to the Office of the Privacy Commissioner of Canada any data breach that poses a real risk of significant harm to individuals. We are also required to notify affected individuals. We maintain a breach register and have documented incident response procedures that our security team follows.

We conduct privacy impact assessments when implementing new services or systems that involve personal information. We review and update our privacy practices annually, and more frequently when we become aware of significant changes in the regulatory environment or in our business operations.

We use cookies and similar tracking technologies on our platform. Cookies are small text files stored on your device that help us deliver and improve our services. We use the following categories: (a) Essential cookies — required for the platform to function (session management, login state, security tokens); (b) Functional cookies — remember your preferences (language, display settings); (c) Analytics cookies — help us understand how players use our platform so we can improve it; (d) Marketing cookies — used only with your consent to deliver relevant promotional content.

Essential cookies are necessary for the platform to operate and cannot be disabled. For all other cookie categories, you can manage your preferences through our cookie consent tool (available in the footer of every page) or through your browser settings. Disabling analytics or marketing cookies does not affect your ability to play or withdraw. We do not use cookies to fingerprint your device across different websites or sell cookie data to data brokers.

Third-party cookies may be set by our analytics provider (currently Google Analytics 4, data processed on EU servers under Standard Contractual Clauses) and by our payment processors. We do not control third-party cookies — their policies apply. You can opt out of Google Analytics data collection at any time using the Google Analytics opt-out browser add-on.

We do not sell, rent, or trade your personal information to third parties for their own commercial purposes. We share data only in the following circumstances: (a) Service providers — payment processors, identity verification providers, and analytics providers who require limited data to deliver services on our behalf, subject to data processing agreements that bind them to our privacy standards; (b) Regulatory compliance — where required by law, court order, or regulatory request from the Kahnawake Gaming Commission, FINTRAC (Canada's financial intelligence unit), or other lawful authority; (c) Business transfers — in the event of a merger or acquisition, your data would transfer to the successor entity, subject to equivalent privacy protections and with notice to you.

Some of our service providers may be located outside Canada. Where personal information is transferred internationally, we ensure it is protected by appropriate safeguards — typically contractual clauses that are equivalent in effect to Canadian privacy law standards. We do not transfer data to jurisdictions without adequate privacy protections without your explicit consent or a recognized legal mechanism.

We retain personal information only as long as necessary for the purposes described in this policy or as required by law. Account data is retained for the duration of your active account. After account closure, we retain transaction records and KYC documents for a minimum of 5 years to comply with our AML obligations under Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Technical logs are retained for 12 months. Marketing preference data is deleted within 30 days of unsubscription.

When data is no longer needed and the retention period has passed, we destroy it securely — physical documents are shredded, and digital data is overwritten or cryptographically erased. We maintain a data retention schedule reviewed annually by our Privacy Officer. If you request deletion of your account data and there is no legal obligation to retain it, we process deletion within 30 days.

We use industry-standard technical and organizational measures to protect your personal information against unauthorized access, loss, or disclosure. These include: TLS 1.3 encryption for all data in transit; AES-256 encryption for data at rest (financial data and KYC documents); two-factor authentication options for player accounts; role-based access controls limiting staff access to personal data on a need-to-know basis; regular penetration testing by independent security firms; and 24/7 monitoring of our systems for suspicious activity.

No online system is 100% secure. If you suspect your account has been compromised, contact us immediately. We will investigate and, if a breach is confirmed, notify you and the OPC in accordance with PIPEDA's mandatory breach notification requirements. Our current platform at Crown Coins Casino Canada uses infrastructure that meets or exceeds the security standards required by our Kahnawake Gaming Commission operating licence.