1. Who controls your data
The data controller for the personal information you share with us is PowerUp Casino, the offshore-licensed operator of powerup-casino-ca.org. That means we decide what data is collected, why it is processed, how it is stored, and when it is deleted. Even though our operating entity is registered offshore, we apply Canadian PIPEDA-aligned processing standards to every record of every Canadian Player — consent as the primary basis, purpose limitation, retention limits, breach notification, and full access rights on request.
Our Data Protection Officer is reachable at privacy@powerup-casino-ca.org. Use "Data Protection Officer" or "DPO" in the subject line to route your message directly.
2. What information we gather
The dataset breaks into four buckets. We only collect what we need to run your PowerUp Account, satisfy FINTRAC and KYC duties, and give you a working gaming experience.
2.1 Identifying information (required)
- First and last name exactly as printed on your provincial photo ID.
- Date of birth.
- Full residential address, plus supporting proof of address (utility bill, bank statement).
- Mobile phone number.
- Email address.
- Provincial photo ID scan (passport, provincial driver's licence, provincial ID card, or PR card) — we do not accept or store SIN.
- Selfie taken alongside the ID document for our KYC vendor to match live-person to document.
2.2 Financial information
- Payment method details relevant to the rail you use — masked bank account number (Interac / iDebit / Instadebit), last four digits of your card (Visa Debit, Mastercard), MuchBetter phone token, or crypto wallet address.
- Full transaction history — every deposit, wager, win, loss and withdrawal, timestamped.
- Details of the cashout account when it differs from the deposit account (in the closed-loop rule scenario).
2.3 Activity information
- Bets placed, games played, session duration and frequency.
- Win / loss position by game and by session.
- Bonus opt-ins, wagering progress and free-spin usage.
- Live-chat transcripts with our support team.
- Device fingerprint (browser + OS + screen + fonts hash) used for fraud detection.
- Responsible-gambling risk score computed by our internal model on session patterns.
2.4 Technical information
- IP address at every login.
- Approximate geolocation derived from IP (province-level accuracy).
- Browser type and version, operating system, device model, screen resolution.
- Cookies (see Section 7).
- Referring URL when you arrive from an external site.
3. On what legal grounds we process it
PIPEDA is a consent-based framework, and consent is the primary ground on which we process your data. That said, PIPEDA also recognises other grounds where consent is implied or exceptions apply, and we rely on those where appropriate:
- Consent (express or implied) — the primary ground. When you register you provide express consent to the specific processing described in this notice. Continuing to use the Site implies ongoing consent for the same activities.
- Contract necessity — running your PowerUp Account, taking deposits, settling wagers and paying out winnings is impossible without your data.
- Legal obligation — KYC checks, FINTRAC Large Cash / Large Virtual Currency Transaction Reports, Suspicious Transaction Reports, and responses to court orders or provincial regulator requests.
- Legitimate interest — fraud detection, bonus abuse prevention, account security, dispute investigation, and audit logging. PIPEDA allows processing without consent where it is reasonable and directly related to a service you asked for.
- CASL consent (opt-in) — marketing emails, SMS and push notifications require your positive opt-in per the Canadian Anti-Spam Legislation. You can revoke marketing consent at any moment under Account > Preferences or by clicking "unsubscribe" in any promotional email.
4. What we do with the data
- Run your PowerUp Account — log-in, deposits, wagers, bonuses, withdrawals, live-chat support.
- Complete KYC and ongoing AML monitoring before your first withdrawal and periodically thereafter.
- Detect and prevent fraud — duplicate accounts, stolen cards, bonus abuse, chargeback fraud.
- Personalise the lobby — slot recommendations based on the categories you already play.
- Send you marketing communications only where you have opted in under CASL. Every message contains an unsubscribe link.
- Satisfy regulatory reporting duties — FINTRAC filings on qualifying transactions, provincial regulator disclosures on request, court orders.
- Handle enquiries and complaints via support@ and legal@ channels.
- Compute a responsible-gambling risk score so we can proactively surface deposit-limit prompts and cooling-off suggestions to Players whose pattern is drifting.
5. When we share data with other organisations
We never sell your data. Information leaves our systems only in the following situations, and each recipient is bound by a written data-processing agreement:
- Game providers (Games Global, Pragmatic Play, Evolution, Big Time Gaming, IGT, ELK Studios, Play'n GO, and similar studios) — so their titles can run in our lobby. They see your session ID and stake amount, not your name, address or ID document.
- Payment processors (Interac, iDebit, Instadebit, Visa, Mastercard, MuchBetter, crypto payment gateways) and your bank — to move C$ in and out. Only the minimum required data is transmitted (name, amount, transaction reference).
- KYC providers (Onfido, Jumio and similar independent identity-verification vendors) — to check your ID document and selfie against document databases. They act as processors on our behalf under strict contractual controls.
- FINTRAC — regulatory reports on qualifying transactions (C$10,000+ or suspicious activity) under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.
- Provincial gambling regulators and privacy commissioners — only on lawful request or subpoena.
- Courts, law enforcement and tax authorities — only where a valid Canadian order or a mutual legal assistance treaty compels us.
- Auditors and legal counsel — bound by professional confidentiality obligations.
6. Sending data abroad
Because we operate offshore and use game providers and processors headquartered outside Canada, some of your data will cross the border. PIPEDA does not prohibit this, but it does require us to make sure the receiving party provides a comparable level of protection to what your data would have inside Canada. We meet that requirement through:
- Contractual data-processing agreements with every recipient, imposing PIPEDA-equivalent obligations on data use, retention and security.
- Vendor selection weighted toward suppliers in jurisdictions with adequacy recognition or robust domestic privacy law (EU GDPR-adequate countries, UK, Ireland, Malta and similar).
- Encryption in transit (TLS 1.3) on every cross-border data flow.
- Data minimisation — we send providers only the minimum fields they need to perform the task.
Quebec residents: transfers of your personal information outside Quebec are subject to the assessment obligations added by Bill 25. We complete those assessments before we share Quebec Player data with any new recipient outside the province.
7. Cookies and related tracking
Cookies are small text files stored by your browser. We use four categories, and you can accept or refuse each one via the cookie banner on your first visit and later via your browser settings:
- Strictly necessary (technical) — session cookies that keep you logged in, remember your bet slip, and preserve your language choice (EN / FR). The Site does not work without these; there is no opt-out.
- Functional — preferences like your favourite slots, sort order, dark-mode preference. You can decline these — the Site still works, but you lose personalisation.
- Analytics — aggregate, pseudonymised metrics through Google Analytics (IP truncated) to understand which pages need improvement. You can decline.
- Advertising — we run very limited retargeting cookies (Meta pixel, Google Ads) only if you consent, and only to show relevant PowerUp ads on external sites. You can decline.
To wipe existing cookies you can clear browser storage under your browser's privacy settings at any time. Ontario iGO's cookie preference standard has no formal equivalent for offshore operators, but we apply the same "clear opt-in for non-essential categories" principle.
8. For how long we keep the data
Retention is driven by whichever regulatory clock runs the longest for a given data type:
- Live account records — for the full life of your PowerUp Account plus 10 years after closure. This matches the FINTRAC record-keeping standard and the PIPEDA "no longer than necessary" rule for account-related processing.
- Transaction and wagering history — 7 years from the date of the transaction, aligned with the CRA general document-retention window.
- KYC document set (ID, selfie, proof of address) — 5 years after account closure, per FINTRAC.
- Session logs and IP records — 90 days for security investigation, then aggregated and pseudonymised.
- Marketing consent records — until you revoke consent, plus 3 years to evidence the consent trail as required under CASL.
- Self-exclusion records — 10 years so we can block re-registration attempts under a self-excluded email or ID document.
- Live-chat transcripts — 2 years for quality review and dispute investigation.
Once a retention clock expires we either delete the record or, where technical constraints prevent full deletion, pseudonymise it so it can no longer be linked back to you.
9. Your data-subject rights under PIPEDA + provincial law
PIPEDA (federal), BC PIPA, Alberta PIPA and Quebec's Bill 25 give you the same core rights over your personal information, exercisable free of charge:
- Right of access — we send you a structured copy of every piece of personal data we hold about you, together with an explanation of how it is used and to whom it has been disclosed.
- Right of correction — if any record is inaccurate or out of date, we amend it and notify any third party that received the wrong version.
- Right to withdraw consent — you can revoke your consent to marketing, personalisation cookies and other non-essential processing at any moment. Revocation does not affect the lawfulness of processing before revocation.
- Right of deletion — you can ask us to erase your data after the applicable regulatory retention window closes. During the retention window we cannot delete FINTRAC-mandated records but we can restrict processing.
- Right to portability (Quebec Bill 25 & PIPEDA extended) — receive a structured machine-readable export of your data and hand it to another operator.
- Right to lodge a complaint — with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca. If you live in a province with its own commissioner (BC, Alberta, Quebec), you can also file with them: OIPC BC, OIPC Alberta, CAI Québec.
To invoke any of these rights, email privacy@powerup-casino-ca.org from the email address on your PowerUp Account. We acknowledge within 2 business days and complete the response within 30 calendar days as required under PIPEDA. If a request needs longer we tell you why and set a firm date.
10. How we protect the data
Security is a layered problem, so we run layered controls:
- TLS 1.3 on every connection between your browser and our servers — no HTTP endpoints, and HSTS enforced.
- AES-256 at rest on the database columns that hold KYC data, payment tokens and personally-identifying fields.
- Password hashing with bcrypt (work factor 12). We do not store plain-text passwords and cannot recover them — only reset.
- PCI-DSS compliance on the card processing path; card numbers never touch our servers — they go straight to the tokenising processor.
- ISO 27001-aligned access controls internally: role-based permissions, least privilege, MFA on every admin login, audit logs on every privileged action.
- No SIN storage — we do not collect it and it cannot be requested by our support team.
- 24/7 monitoring for anomalous access attempts, plus quarterly penetration testing.
- Encrypted off-site backups held for 90 days, geographically separated.
- Breach notification — if a real risk of significant harm arises from an incident we notify affected Players and the OPC (and provincial commissioners where required) as soon as feasible, per PIPEDA's mandatory breach-notification rules.
11. Under-19s (under-18s in AB/MB/QC)
The service is strictly for adults. If you are under 19 (or under 18 in Alberta, Manitoba or Quebec) you may not register, deposit or wager on PowerUp. If we discover that a minor has registered by supplying false information:
- We terminate the account immediately.
- We refund the original deposits to the funding source. Any winnings are voided and not paid out.
- We delete the minor's personal data other than the minimum audit record we must keep for FINTRAC and to block re-registration.
- Where the fake registration used a parent's or guardian's payment method, we notify the payment provider and, where warranted, the RCMP or provincial police.
12. Revising this notice
Regulatory landscapes move — PIPEDA reforms, Quebec Bill 25 phased rollout, provincial privacy law updates and industry code changes all trigger revisions to this notice. Whenever we make a material change we email you at the address on your PowerUp Account before the new version takes effect, and we require you to click "I accept the updated Privacy Notice" the next time you log in. Non-material changes (typos, formatting, contact-address updates) are posted with an updated "Last updated" date but do not require re-acceptance.
13. Complaints and OPC referral
If something we did with your data does not sit right, take it up with us first — email privacy@powerup-casino-ca.org with "Privacy Complaint" in the subject line. We acknowledge within 2 business days and give you a written response within 30 calendar days.
If our response does not resolve the matter, you can escalate to:
- Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca. The federal privacy watchdog handles PIPEDA complaints against businesses regardless of where they operate.
- Office of the Information and Privacy Commissioner (OIPC) for British Columbia if you are a BC resident.
- Office of the Information and Privacy Commissioner (OIPC) of Alberta if you are an Alberta resident.
- Commission d'accès à l'information (CAI) du Québec if you are a Quebec resident — the primary regulator under Bill 25 / Loi 25.
Different messages go to different desks:
P