Information We Collect
We collect only what we need to run a licensed gambling account, and each category exists for a stated reason.
Personal information. At registration we collect your full name, date of birth, residential address, email address, phone number, country of residence and chosen account currency. Date of birth and address establish that you meet the legal gambling age in your province and that you are not resident in a restricted territory. During verification we collect copies of government-issued photo identification, proof of address issued within the last three months, and in some cases a selfie or short video for liveness confirmation. These are licence obligations, not marketing conveniences.
Technical data. Our systems record your IP address, approximate location derived from it, device type, operating system, browser version, screen resolution, language settings, referring URL, session timestamps, pages viewed and games launched. Cookies and similar identifiers are covered separately below. This data protects the platform: an unfamiliar device or an IP address resolving to a restricted jurisdiction is the earliest signal of account takeover or geographic circumvention.
Communications. Live chat transcripts, emails and support tickets are retained so that a dispute can be reviewed against a record rather than a recollection.
We do not collect biometric data beyond optional device-level fingerprint or Face ID unlocking, which is processed by your own device and never transmitted to us. We do not purchase personal information from data brokers.
How We Use Player Data
Every use below is tied to a specific purpose. We do not repurpose data collected for one reason to serve another without asking you first.
Account creation and login. Your identity details create and secure the account, authenticate each Casinacho Casino login, enable two-factor authentication and password recovery, and flag access from an unrecognised device or location.
Payment processing. Financial information processes deposits and withdrawals, confirms that a payout is routed to a method belonging to the account holder, reconciles disputed transactions and satisfies the record-keeping obligations attached to our licence.
Security and fraud prevention. Technical and behavioural data detects duplicate accounts, bonus abuse, collusion, payment fraud and unauthorised access. Automated checks may flag a transaction for manual review; a human makes any decision that materially affects your account.
Legal and regulatory compliance. Identity and transaction data supports anti-money-laundering monitoring, age verification and the reporting duties our licensing authority imposes.
Marketing and personalised promotions. With your consent, we use gameplay and preference data to send offers relevant to what you actually play, rather than a single promotion to everyone. Consent is optional, never a condition of holding an account, and withdrawable at any time through account settings or the unsubscribe link in any message. Withdrawing it stops marketing but not service messages such as withdrawal confirmations or security alerts.
Responsible gaming monitoring. We analyse deposit frequency, session length, stake escalation and time-of-day patterns to identify play that may be becoming harmful. This may result in a limit prompt, a support conversation or, in serious cases, an intervention on the account. We consider this among the most important uses of player data we make, and it operates regardless of marketing preferences.
Data Sharing Policy
We do not sell player data. Ever, to anyone, for any purpose. No marketing list, no data broker, no affiliate arrangement includes your personal information.
We share data only in three defined circumstances.
Service providers. Payment processors, banks and cryptocurrency payment gateways receive what is required to move money. Game providers receive session identifiers so gameplay functions, but not your identity documents. Identity verification specialists, fraud screening tools, cloud hosting providers, email and live chat platforms, and analytics services each receive the minimum data their function requires. All are bound by contract to process information only on our instructions, to apply appropriate safeguards, and to delete or return it when the relationship ends.
Legal authorities. We disclose information to regulators, law enforcement, tax authorities or courts where a valid legal obligation requires it — including anti-money-laundering reporting and lawful requests from our licensing authority. Where we are legally permitted to inform you of such a request, we will.
Corporate transactions. If the business is sold or restructured, player data may transfer to the acquiring entity, which remains bound by this policy or one offering equivalent protection. You would be notified before any such transfer takes effect.
Affiliates who refer players receive aggregate performance figures only — registrations and deposit volumes — never names, contact details or gameplay records.
Data Protection and Security
Our duty to protect personal information is structural rather than a line in a policy, and the measures below are the ones a player can reasonably ask us to demonstrate.
Encryption. All traffic between your device and our servers runs over TLS with modern cipher suites, so data encryption on our platform covers registration, login, the cashier and document uploads alike. Sensitive data at rest — identity documents, payment identifiers — is encrypted in storage. Passwords are stored as salted hashes and are never recoverable in readable form, which is why our support team can reset a password but can never tell you what your existing one is. Anyone contacting you claiming otherwise is not from this casino.
Secure servers and restricted access. Player data is held on servers in access-controlled facilities with network segmentation between the public platform and systems holding identity and payment records. Internal access follows least privilege: a support agent sees what is needed to answer a query and no more, and access to verification documents is limited to the compliance team. Administrative access requires multi-factor authentication, and all access to player records is logged and reviewed.
Incident response. We maintain a documented breach response procedure. Where a breach creates a real risk of significant harm, we will notify affected players and the relevant privacy authorities without undue delay, as PIPEDA requires, and tell you plainly what happened and what to do.
No system is invulnerable, and any operator claiming otherwise is overselling. Your own habits matter: a unique password, two-factor authentication enabled, and care on shared devices close the gaps we cannot reach.
Cookies and Tracking Technologies
Cookies are small text files stored by your browser that let a website recognise a returning visit. Our cookie policy covers four categories.
Strictly necessary cookies keep you logged in as you move between pages, hold the contents of your cashier session, enforce security controls and remember your language and currency. The platform cannot function without them, and they cannot be disabled while you use the site.
Performance and analytics cookies tell us which pages load slowly, where players abandon registration and which games are opened most. The insight is aggregate — we are studying patterns, not individuals.
Functional cookies remember preferences such as your game filters, layout choices and whether you have dismissed a notice.
Marketing cookies measure which campaigns bring players to the site and allow relevant advertising elsewhere. These run only with your consent.
You control all non-essential categories through the consent banner shown on your first visit and can change your choices at any time through the cookie settings link in the site footer. Browser-level controls also let you block or delete cookies entirely, though doing so will log you out and may break the cashier. Our analytics and advertising partners set their own cookies under their own policies, which we encourage you to read.
Player Rights Under PIPEDA and Provincial Law
Canadian privacy law gives you meaningful, enforceable privacy rights for players, and we honour them without charge. Our approach is fair and transparent by design: you should never have to argue for access to your own information. Where GDPR compliance applies in parallel for EEA residents, we extend the equivalent rights.
Right to access. You may request confirmation of whether we hold personal information about you, a copy of it, and an account of how it has been used and to whom it has been disclosed. We respond within 30 days, extending only where the request is complex and telling you if we do.
Right to correct inaccuracies. If information we hold is wrong or incomplete, you may require us to correct it. Most profile details can be amended directly in your account; name and date of birth changes require supporting documentation, because these underpin age verification.
Right to request deletion. You may ask us to delete your personal information, and we will do so where no legal obligation requires us to keep it. Identity and transaction records attached to a closed gambling account are generally subject to mandatory retention under anti-money-laundering rules, so deletion typically applies to marketing profiles, preferences and non-mandatory records, with the regulated core removed at the end of the retention period.
Right to restrict or object to processing. You may object to specific processing, most commonly marketing and profiling for promotional purposes, and we will stop. Processing required for security, legal compliance or responsible gaming monitoring continues, since these are obligations rather than choices.
Right to withdraw consent. Where processing rests on consent, you may withdraw it at any time. Withdrawing marketing consent takes effect immediately. Withdrawing consent to processing that the account depends on will mean closing the account, and we will tell you clearly before that happens.
Right to data portability and to complain. You may request your data in a structured, machine-readable format. If you believe we have mishandled your information, contact our Privacy Officer first — but you may complain to the Office of the Privacy Commissioner of Canada or your provincial regulator at any time, whether or not you have raised it with us.
Requests are submitted to the contact address below and verified against your account before we act, since releasing data to an impostor would be its own breach.
Data Retention Policy
We keep personal information only as long as there is a reason to, and the reason differs by category.
Account, identity and transaction records are retained for the life of the account and for a minimum of five years after closure, as the anti-money-laundering obligations attached to our licence require. This period is not something we can shorten at a player's request.
Marketing preferences and profiles are deleted promptly once consent is withdrawn. Live chat transcripts and support tickets are kept for two years for dispute resolution and quality review. Technical logs are retained for twelve months for security investigation. Records connected to a self-exclusion are kept for the duration of the exclusion and afterwards, because the purpose is defeated if the record disappears.
Once a retention period expires, data is securely deleted or irreversibly anonymised so it can no longer identify you. Anonymised statistics may be retained indefinitely for reporting and product work, as they are no longer personal information.
Underage Users and Data Protection
Online gambling is strictly for adults. The minimum legal age for our services is 19 in most Canadian provinces and territories, and 18 in Alberta, Manitoba and Quebec, and we apply the higher figure wherever a player's province is unclear.
We do not knowingly collect personal information from anyone under the legal age, and our services are never marketed to minors. Age is declared at registration and independently verified against identity documents before any withdrawal is released, which closes the gap left by a self-declaration alone.
If we discover that an account belongs to someone under the legal age, we close it immediately, void any winnings, return deposited funds to their source and delete the personal information collected except what we must retain as evidence of the closure. Parents or guardians who believe a minor has created an account should contact us at once.
We also recommend filtering software such as GamBan or Net Nanny on shared family devices, and we support any parent taking that step.
International Data Transfers
We are an internationally operated business, and your data does not stay in one country. Personal information may be stored or processed in the Comoros, the European Union, the United Kingdom and other jurisdictions where our service providers operate. Some of these countries have privacy frameworks that differ from Canada's.
Wherever data goes, our obligations follow it. Under PIPEDA, an organisation transferring personal information for processing remains accountable for its protection, and we meet that through contractual safeguards with every processor — standard contractual clauses where the transfer involves the EEA, confidentiality and security commitments, restrictions on onward transfer, and audit rights.
You should know that information held in another country may be accessible to that country's courts and law enforcement under local law. This is true of essentially every online service and is not specific to us, but you are entitled to know it before you register.
Changes to This Privacy Policy
We may update this Privacy Policy as our services, our service providers or the law change. The version published on this page is always the current one, and the effective date appears at the foot of the page.
Minor clarifications take effect on publication. Where a change materially affects how we handle your personal information — a new processing purpose, a new category of recipient, a longer retention period — we will notify registered players by email and through an in-account notice at least 14 days before it takes effect, so there is time to review it, adjust preferences or close the account.
Continuing to use your account after a change takes effect indicates acceptance of the revised policy. Where a change requires fresh consent under Canadian law, we will ask for it explicitly rather than treating silence as agreement.
Contact Information
Questions about this policy, requests to exercise your rights, and complaints all go to our Privacy Officer, who is responsible for compliance with this policy and with Canadian privacy law.
Privacy Officer, EVENTA DIGITAL LIMITADA
General account questions are usually faster through 24/7 live chat, but formal privacy requests should be made in writing so they are logged and tracked. Please include the email address registered to your account and enough detail to identify the request; we will verify your identity before releasing or deleting anything.
We acknowledge privacy requests within five business days and respond substantively within 30 days. If a response will take longer, we will tell you why and when to expect it.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or your provincial privacy regulator where one has jurisdiction — the Commission d'accès à l'information in Quebec, or the Offices of the Information and Privacy Commissioner in Alberta and British Columbia.