1. Introduction and Scope

This Policy applies to personal information we process about Canada-resident players who interact with Elements Casino through our website, mobile applications, and customer support channels. By creating an account or using our services, you accept the practices described here. This Policy should be read alongside our Terms and Conditions and Cookies Policy, which together set out the rules for using the platform and the way we use cookies and similar technologies.

• The Policy covers our consumer-facing online casino and sportsbook services.
• Where a service is provided by a third party, that party's own privacy notice may also apply.
• Where provincial law gives you stronger rights than PIPEDA, those provincial rights apply in addition.

2. Data Controller Information

The legal entity responsible for your personal information is Elements Gaming Canada Ltd., with registered office at 100 King Street West, Suite 5700, Toronto, Ontario M5X 1C7, Canada. We are licensed by the Alcohol and Gaming Commission of Ontario (AGCO), operating pursuant to an agreement with iGaming Ontario (iGO) under licence reference iGO-OP-0421. Our Data Protection Officer (DPO) can be reached at [email protected] for any privacy-related questions, requests, or complaints.

3. Personal Information We Collect

We collect only the personal information needed to register your account, comply with our regulatory obligations, run the platform, and improve the service. The categories below describe what we typically hold; the exact data points depend on how you use Elements.

3.1 Identification Data

Information that confirms who you are, used for KYC and ongoing fraud prevention:

• Full legal name, date of birth, and place of birth.
• Government-issued photo identification (passport, driver's licence, provincial ID card).
• Selfie or short video taken during the verification step, where applicable.
• Proof-of-address documents such as a recent utility bill or bank statement.

We do not collect your Social Insurance Number (SIN) unless we are required to by law — for example, where specific tax-reporting rules apply to a withdrawal.

3.2 Contact Data

Email address, mobile or landline phone number, postal address, and your preferred language for service communications.

3.3 Financial and Transactional Data

Records that let us move money in and out of your account safely:

• Deposit and withdrawal history, with method, amount, and timestamp.
• Payment-method tokens supplied by our payment service providers; we do not store full card numbers on our servers — those are handled by Payment Card Industry Data Security Standard (PCI DSS) compliant processors.
• Bank-account or e-wallet identifiers used for payouts.
• Where a higher-risk transaction is detected, source-of-funds documentation supplied at our request.

3.4 Gameplay and Behavioural Data

Information that describes how you use the platform: bets and stakes, game preferences, session length, in-play statistics, and the responsible-gaming tools you have enabled. We use this data to deliver the games, settle bets, and look for early signs of gambling-related harm.

3.5 Technical Data

Data captured automatically by our systems: IP address, device identifier, browser, operating system, screen size, and approximate (province-level) geolocation. We use this to keep accounts secure, comply with regional licensing rules, and troubleshoot the platform. See our Cookies Policy for the technologies involved.

3.6 Marketing Preferences

Your opt-in or opt-out status for marketing communications, the channels you have agreed to (email, SMS, push), and whether you have engaged with previous campaigns.

4. How We Collect Your Information

Personal information reaches us through three main routes:

• Directly from you — for example, when you register, complete identity verification, deposit or withdraw funds, contact our support team, or update your account preferences.
• Automatically — through cookies, server logs, application telemetry, and similar technologies, when you visit our website or open our app.
• From third parties — including identity-verification providers, payment processors, fraud-screening services, regulators, and law enforcement where lawful disclosure has been ordered.

5. Legal Basis for Processing

Under Canadian privacy law we rely on consent as the default basis for processing personal information, with limited exceptions where the law allows us to process without consent. The table below maps the main activities to the basis that applies.

Quebec residents have additional rights under Law 25, including the right to be informed before automated decisions are made and a stricter requirement of express consent for certain types of processing.

6. How We Use Your Information

We use personal information for the following purposes, grouped by purpose category:

• Account administration: creating your account, authenticating logins, managing your preferences, processing closures and self-exclusions.
• KYC and AML: verifying your identity, screening for politically exposed persons (PEPs), monitoring transactions for suspicious patterns, reporting to FINTRAC where required.
• Gameplay and settlement: running the games, recording bets, calculating returns, applying bonuses, and resolving disputes.
• Payment processing: handling deposits, withdrawals, refunds, chargebacks, and reconciliation.
• Fraud prevention and security: detecting unauthorised access, multi-accounting, collusion, and bonus abuse.
• Marketing (with consent): sending updates about products, offers, and events through the channels you have opted into. You can withdraw consent at any time.
• Regulatory reporting: producing audit trails and reports required by our regulator and Canadian law.
• Service improvement: reviewing aggregated usage data to fix bugs, improve performance, and design new features.
• Responsible gaming: identifying patterns that may indicate gambling-related harm and offering relevant tools.

7. Data Sharing and Third Parties

We share personal information only where it is needed to deliver the service, meet a legal duty, or protect the integrity of our platform. The recipients fall into the categories below.

We do not sell your personal information to third parties for their independent marketing purposes.

8. International Data Transfers

Your personal information is hosted primarily in Canada (primary: Toronto, Ontario; secondary: Montreal, Quebec). Some of our service providers operate in other jurisdictions, which means that personal information may be processed outside Canada. Where that happens, we put appropriate safeguards in place, including written contractual terms requiring providers to maintain protection comparable to PIPEDA, encryption in transit and at rest, and assessments of the receiving country's privacy regime.

9. Data Retention Periods

We keep personal information for as long as we need it for the purposes described in this Policy and to satisfy our legal duties. After that, we delete or anonymise it. The table below summarises the standard periods; specific records may be kept longer where law requires it or shorter where the data is no longer needed.

10. Data Security Measures

Protecting personal information requires a layered approach. Our security programme is built around recognised standards and is reviewed regularly by independent assessors.

• Encryption of data in transit using current Transport Layer Security (TLS) protocols.
• Encryption of personal information at rest in our primary databases.
• Strict role-based access controls and the principle of least privilege for staff.
• Multi-factor authentication for administrative access.
• Continuous monitoring, intrusion detection, and 24/7 incident response.
• Regular vulnerability scanning and independent penetration testing.
• Mandatory privacy and security training for all staff.
• PCI DSS compliance for payment-card processing and alignment with ISO/IEC 27001 information-security practices.

No system is completely free of risk. We implement reasonable safeguards proportionate to the sensitivity of the data, and we will notify affected individuals and the relevant authorities of any breach that creates a real risk of significant harm, in line with PIPEDA and provincial breach-notification rules.

11. Cookies and Similar Technologies

We use cookies, pixels, and software development kits (SDKs) for authentication, fraud prevention, performance analytics, and — with your consent — marketing. You can manage your preferences through our consent banner or your browser. Full details are in our Cookies Policy.

12. Your Rights under PIPEDA

PIPEDA is built on ten fair information principles. Each one shapes how we handle your data, and several translate directly into rights you can exercise.

1. Accountability — we are responsible for the personal information under our control and have appointed a DPO.
2. Identifying Purposes — we tell you why information is being collected at or before the time of collection.
3. Consent — your knowledge and consent are required for collection, use, and disclosure, except where the law allows otherwise.
4. Limiting Collection — we collect only what is needed for the identified purposes.
5. Limiting Use, Disclosure, and Retention — we use and retain personal information only for the purposes identified, and for as long as necessary.
6. Accuracy — we keep personal information accurate, complete, and up to date for the purposes for which it is used.
7. Safeguards — we protect personal information with safeguards appropriate to its sensitivity.
8. Openness — our policies and practices are made available to you on request.
9. Individual Access — on request, we tell you what personal information we hold about you, how it is used, and to whom it has been disclosed.
10. Challenging Compliance — you can raise a concern about our handling of personal information with our DPO and, if needed, escalate to a regulator.

12.1 Quebec residents (Law 25 / Loi 25)

If you live in Quebec, you have additional rights under the Act respecting the protection of personal information in the private sector:

• The right to data portability — receiving certain personal information in a commonly used technical format.
• The right to be forgotten in qualifying circumstances, including where information is no longer needed.
• The right to be informed when an automated decision is made about you, and to seek human review.
• An express-consent standard for sensitive processing and for use of biometric data.
• Mandatory reporting of confidentiality incidents that pose a risk of serious injury.

Quebec residents may complain to the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca.

12.2 British Columbia and Alberta residents (PIPA)

Residents of British Columbia and Alberta benefit from the provincial Personal Information Protection Acts (PIPA BC and PIPA AB). The rights under provincial PIPA largely mirror PIPEDA, including the right to access and correct personal information. Provincial commissioners can be reached through their official websites.

13. How to Exercise Your Rights

To make a privacy request, email our DPO at [email protected]. Please include enough detail for us to identify you and understand what you are asking for. We respond to most requests within 30 days, in line with PIPEDA practice.

• We may ask you to verify your identity before disclosing personal information, to protect against unauthorised access.
• In limited cases — for example, large or complex access requests — we may charge a reasonable cost-recovery fee, and we will tell you the fee in advance.
• If we cannot fulfil a request (for example, because the data is needed to comply with PCMLTFA retention rules), we will explain why and how to escalate.

14. Children's Privacy

Elements Casino is not intended for anyone under the legal gambling age in their province (19 in most provinces and territories; 18 in Alberta, Manitoba, and Quebec). We do not knowingly collect personal information from minors. If we discover that a minor has registered, we close the account, return stakes, forfeit any winnings, and delete personal information except to the extent that the law requires us to retain it.

15. Changes to This Policy

We may update this Policy to reflect changes in our practices, in technology, or in the law. The version date at the top of the page shows when it was last revised. Where a change is material, we will let you know by email or through an in-account banner before it takes effect.

16. Contact Us and How to Complain

If you have a privacy question or want to make a complaint, email our DPO at [email protected] or write to us at 100 King Street West, Suite 5700, Toronto, Ontario M5X 1C7, Canada. We take complaints seriously and aim to resolve them quickly. If you are not satisfied with our response, you can escalate to:

• Office of the Privacy Commissioner of Canada — priv.gc.ca — for PIPEDA matters.
• Commission d'accès à l'information du Québec — cai.gouv.qc.ca — for Quebec residents.
• Office of the Information and Privacy Commissioner for British Columbia — for BC residents.
• Office of the Information and Privacy Commissioner of Alberta — for Alberta residents.

You can also reach our broader support teams through our Contacts page.