Please read these Conditions carefully as they form the basis of a legal agreement between us with respect to our website at ggpoker.ca (the “Website”) and the poker, casino and live dealer products (the “Games”) that we make available on the Website.  We ask that you confirm that you have read, understood and accept the terms of the Policies by ticking this box [ ]. The policy shall be made available to customers from the website and mobile and app and would be easily accessible to all customers. 

POLICY STATEMENT

The Website, GGPoker.ca game client and the GGPoker.ca mobile app (collectively referred to as “applications”), are operated by NSUS Limited (hereinafter referred to as ““we”, “us” or “our” or “Company”) under the brand name of GGPoker.ca and we are committed to protecting the personal information entrusted to us by our players. We protect your personal information in accordance with all applicable law, including Personal Information Protection and Electronic Documents Act (“PIPEDA”), Ontario’s Freedom of Information and Protection of Privacy Act (“FIPPA”), Canada’s Anti-Spam Legislation and other applicable laws (collectively the “Acts”).

This Privacy and Cookie Policy (hereafter, the “Policy”) is a supplementary policy to the Player Terms and Conditions (the “Terms and Conditions”) that specifically deals with the policies for handling and treatment of player data. 

This Policy governs the collection, use, disclosure, retention and other processing of personal information by the Company, including through our products and services, on GGPoker website and via mobile application. It explains what types of personal information is collected from our customers, how it may be used, and how you can ask us questions about our privacy practices. 

STATUTORY AUTHORITY

This website and other online applications operate under and pursuant to the Operating Agreement are being offered by the Company under the brand name “GGPoker.ca” as part of the open and regulated iGaming market conducted and managed by iGaming Ontario (http://www.igamingontario.ca/en). In the course of providing the services (i) the Company collects, uses and discloses personal information on behalf of and as agent to iGaming Ontario; (ii) the Company collects personal information in accordance with FIPPA and other applicable privacy laws, and under the authority of Ontario Regulation 722/21 made under the Alcohol and Gaming Commission, and the operating agreement entered into between the Company and iGaming Ontario.

SCOPE

This Policy governs our practices with respect to personal information we collect from individuals through our products, services, and offerings, including through the website and online applications.

REGARDING CHILDREN AND MINORS

Our website, applications and the services offered on our website and applications are not directed to individuals under the age of 19. We will not knowingly collect personal information about individuals under the age of 19. We do not allow individuals under the age of 19 to create accounts, make purchases or enter contests or promotions. If a parent or guardian becomes aware that his or her child under the age of 19, has provided us with personal information, the parent or guardian may contact us at the details set out below in the “Contacting the Company” section to have such personal information deleted. 

WHAT IS PERSONAL INFORMATION?

 “Personal information” means information about an identifiable individual. In general, the Company collects the following types of personal information:

• Identity information (such as your full name, or government issued photo identification for identity verification);
• Demographic information (such as your age or gender);
• Contact information (such as your email address or phone number);
• Location information (such as your address or the location of a device you use to access our website or applications) to ensure compliance with legal and regulatory requirements;
• Professional information (such as your occupation or industry of employment);
• Banking or financial information (such as payment or withdrawal account information); and
• Transaction information (such as play or payment history, customer service history, or other information related to transactions between you and the Company);
• Existence of any dispute between the Company and the customer 

WHY DOES THE COMPANY COLLECT PERSONAL INFORMATION?

The Company uses the personal information it collects for a variety of purposes. When we collect personal information from patrons, we provide a ‘“Notice of  Collection” which explains the specific purposes of collection for a given program, service, or offering. In general, the most common purposes for collection of personal information by the Company can be organized into three main categories:

1. For program, service, or product administration – in order to provide you with service you have requested or to administer your participation in a particular program, we may use personal information. That may include using personal information for the following purposes:

• Uniquely identifying and authenticating patrons to provide them access to their account and to be sure prizes, payments, or other features of a service are properly administered;
• To deliver marketing and promotional communications, including offerings (in accordance with the Acts) tailored to the recipient. You can unsubscribe at any time by clicking the “unsubscribe” link included at the bottom of each email. You may also withdraw your consent from marketing communications at any time by using the unsubscribe link provided in any message or by logging in and navigating to My Page > My Account >  My Info. Alternatively, you can opt-out of receiving email marketing communications by contacting us at the contact information provided in the “Contact Us” section below. Please note that you may continue to receive transactional or account-related communications from us;
• To administer loyalty or responsible gambling programs;
• To provide customer service, facilitate payments and awarding prizes, and otherwise respond to patron requests, inquiries, comments, and concerns;
• To customize the presentation of our products, services, webpages, and applications to individual users; and
• As otherwise described in a Notice of Collection and/or permitted under the Acts.

1. To analyze and improve upon our products, services, programs, offerings, and processes – in addition to day-to-day administration of the services you engage with, we may also use personal information to assist us in evaluating and improving our products, services, programs, offerings, and processes. That may include using personal information for purposes such as:

• To research the operational effectiveness and business viability of current and prospective products, programs, campaigns, and services;
• To better understand the interests of current and prospective customers;
• To tailor or personalize offers and information (in accordance with the Acts) to receiving patrons; and
• To engage in responsible gambling research.

1. To help the Company comply with applicable law and to maintain the integrity of operations – in certain circumstances, the Company may be permitted or required to collect, use or disclose personal information so that it can comply with applicable law, or to maintain the integrity of its business. That could include using personal information for purposes such as:

• Ensuring that players are eligible to participate in Poker, Casino and live dealer games, related schemes or to claim a prize;
• Collecting, organizing, and assessing patron information and transaction data to meet record keeping, patron monitoring, risk mitigation and reporting requirements under applicable law, including the Proceeds of Crime (Money Laundering) and Terrorist Financing Act; and
• As otherwise required or permitted under applicable law or regulation or as detailed in a Notice of Collection.

DISCLOSURE AND SHARING OF PERSONAL INFORMATION?

From time to time, the Company may share personal information with service providers or vendors acting on its behalf to enable them to perform specific types of processing and other specialized services. 

For example, the Company may partner with third parties to offer contest entrants a prize, and those third parties may require personal information in order to deliver that prize to the rightful contest winners. Service providers and vendors may collect, use, and disclose personal information on the Company’s behalf as described in this policy. Service providers and vendors who process personal information on behalf of the Company are contractually obliged to protect the privacy of the Company customers and to only process personal information for the specific purpose(s) for which the Company provides instruction or permission. 

Our service providers may be located in the USA, or other foreign jurisdictions. In the event personal information is transferred to the USA or other foreign jurisdiction, the storage and other processing may be subject to the laws of that jurisdiction and may be disclosed to or accessed by the courts, law enforcement and governmental authorities in accordance with those laws.

The Company may disclose personal information to law enforcement, regulators, and other third parties in response to a search warrant to other legally valid inquiry or order, or to another organization for the purposes of investigating a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise may be required or permitted by applicable Canadian, U.S. or other law or legal process. Your personal information may also be disclosed where necessary for the establishment, exercise or defence of legal claims and to investigate or prevent actual or suspected loss or harm to persons or property.

Additionally, we may transfer any information we have about you as an asset in connection with a proposed or completed merger, acquisition or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of the Company or as part of a corporate reorganization or other change in corporate control.

HOW IS PERSONAL INFORMATION RETAINED AND SECURED?

Personal information collected by the Company is retained in accordance with applicable law and record keeping requirements. After the applicable retention period for records containing personal information has elapsed, the records are securely disposed of in accordance with applicable regulations. Throughout the retention period, the Company will make reasonable efforts to ensure personal information in our custody or under our control is kept accurate, complete, and up to date. Please contact the Company’s Customer Service Support Team to advise the Company of any updates or corrections you would like to make regarding your personal information. Alternatively, you may also edit your personal information stored with us via your player account. 

The Company has implemented physical, administrative, and technological security measures to protect the personal information in its custody and under its control. Access to personal information at the Company is restricted to individuals who require such access to perform their duties. Furthermore, the Companyimposes information security requirements on third party vendors and service providers to whom personal information is disclosed. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. The Company therefore does not warrant, represent, or guarantee the absolute security of personal information in our custody or under our control. In order to protect your account, we strongly recommend that you do not disclose your password to anyone. We will never ask you for your password in any unsolicited communication (such as letters, phone calls or email messages). If you become aware of any unauthorized access to or use of your account, you are required to notify us immediately. For general information on how to protect your information online, please refer to the resources posted by the Information and Privacy Commissioner of Ontario at [https://www.ipc.on.ca/privacy-individuals/ensuring-your-privacy-is-protected/]. 

In the event of an incident that materially impacts your personal information (a “Data Incident”). We will notify you, iGaming Ontario, and any other applicable regulatory authority about the Data Incident, and we will aid iGaming Ontario and any applicable authorities in the management and handling of the Data Incident.

HOW IS THE PERSONAL INFORMATION OF THE COMPANY’S INTERNET GAMING CUSTOMERS PROCESSED?

You can visit GGPoker’s website and download its mobile applications without registering for an Internet Gaming account (“Account”). However, products and services available through GGPoker websites and mobile applications require that you register for an Internet Gaming account. Should you choose to register for an Internet Gaming account, the Company will process your personal information in the course of administering your account. The following types of information may be collected throughout your registration for, and use of, an Internet Gaming account: 

• Full Name
• Date of Birth
• Full Home Address
• Email Address
• Phone Number
• Transaction and Play History
• Government issued photo-identification 
• Supporting Documents to Verify Identity and Address
• Jurisdiction and country of issue of the Identity Document
• Credit File Number
• Source of Credit File
• Date of Verification of Credit File
• Expiry Date on Identity documents (if applicable)
• Country of residence
• Citizenship
• Preferred/Alias Name

• Device Information and connection IP address
• Payment Information
• Withdrawal Account Information
• Language and Marketing Preferences
• Device Location
• Supporting Documents to Confirm Withdrawal Account Ownership

• Responsible Gambling Settings/Limits
• Username and Password
• Security Questions and Answers
• Descriptive Occupation – Job Title  and Industry
• Customer Service Records
• Player ID (assigned by the Company)

Please be advised that certain information such as name, date of birth, address and citizenship are mandatory for the players to provide us for purposes including legal, provision of services, and AML.

We will collect certain of the above personal information, and if provided by you, your business telephone number, employer’s name, and employer’s address for the purposes of complying with our anti-money laundering obligations under applicable law.  If you attest that you are a Politically Exposed Person (“PEP”) the Head of an International Organization (“HIO”), or a family member or a close associate of a PEP or HIO, as those terms are defined in the Terms and Conditions, you will be required to provide additional information such as your source of funds, your source of wealth, the nature of your connection to the PEP or HIO if you are a family member or close associate of a PEP or HIO, the office or position of the PEP/HIO, the PEP or HIO organization/institution name and, if you are a family member or close associate of a PEP or HIO, the nature of the relationship between the family member and close associate of the PEP or HIO. Such information is collected on behalf of iGaming Ontario and may be shared with other Operators as part of enterprise level player monitoring. 

In general, and in addition to other processing as described throughout this Policy, the processing of personal information for administering Internet Gaming accounts can be organized into four main phases:

1. A. Registration & Account Activation – when you choose to register for an account, the Company will collect certain identity,  employment, and contact information. This information will be used to administer your account throughout your use of the Internet Gaming service, to confirm your eligibility for registration, and for anti-fraud and legal compliance purposes. Additionally, the Company will seek to confirm that the device you use to register is located in Ontario, as the Company’s Internet Gaming service is only available to persons residing in Ontario and who use the service while physically located in Ontario.

Prior to account activation, the Company will seek to verify the identity of a registering individual. In order to conduct identity and age verification we may search for your details using third party agencies like Credit Reporting Agencies. If your identity cannot be verified with the information you provided at registration, we may require that you submit additional information or proof of identity and proof of address prior to the completion of registration. To confirm your identity with the additional information provided, the Company shares some of the information you provide with a third party identity verification service called Jumio. Access to this additional information will only be provided to the Company personnel who require such access to complete the identity verification process. The information will be retained in a manner consistent with this Policy and the Company ’s internal retention and information security procedures. 

1. Use of the Service – after registration and account activation, you will be able to securely log into GGPoker’s Internet Gaming service. When you log in, GGPoker will seek to confirm that the device you are using is located in Ontario, as the Company’s Internet Gaming service is only available to persons residing in Ontario and who use the service while physically located in Ontario. Additionally, information about your use, such as transaction data, responsible gambling settings, and play history, will be retained and used to provide you access to your overall account history, for responsible gambling purposes including monitoring, analyzing and communicating with you about your use of the Internet Gaming service, and for purposes as otherwise described throughout this Policy. Furthermore, during the game within the game-client, we may display a country flag next to your avatar based on your country of citizenship that you would provide to us during account registration process. 
2. Purchasing and Withdrawals – while logged in to your Internet Gaming account, you will have the option to purchase certain Company products and services. Should you choose to do so, the Company will collect payment card information and payment through its third party secure payment providers. Transaction information will be processed to provide you access to a history of your transactions, for anti-fraud purposes, for compliance with applicable law and regulation, and as otherwise described throughout this Policy.

Should you choose to withdraw funds from your Internet Gaming account, the Company will collect bank account information from you to process your withdrawal requests. This information will be shared with the Company’s partner financial institution to process your withdrawal request. Where permitted or required for compliance with applicable law, including the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, the Company may collect additional information a third party identity verification service.

In addition, you will be required to upload supporting documentation to confirm your withdrawal information. Access to uploaded supporting documentation will only be provided to the Company personnel who require such access to complete the withdrawal process. The documentation will be retained in a manner consistent with this Policy and the Company’s internal retention and information security procedures.

1. Inactivity & Deletion – in certain circumstances as described in the Terms and Conditions, your account may be deemed inactive or dormant. In such circumstances, personal information will be retained in accordance with applicable law and record retention requirements. After the applicable retention period for records containing personal information has elapsed, the records are securely disposed of in accordance with applicable regulations.

In addition to the processing as described above, your personal information associated with your Internet Gaming account may be processed in circumstances unique to you. Examples of such processing include:    

• Customer Service – additional personal information may be collected and processed to assist you with your customer service inquiries.
• Prize Winner Publication – should you win a qualifying prize, your personal information may be published as described in the Terms and Conditions and where permitted or required by law.

To provide Internet Gaming products and services, your personal information may be shared with third party service providers assisting the Company in the administration of Internet Gaming. Examples of such third parties include:

• Identity Verification Services – to prevent fraudulent activity and for compliance with applicable law, the Company shares your name, date of birth, and address with a third party identity verification service at registration or in the course of administering active Internet Gaming accounts;
• Address Verification – to confirm your address is entered correctly at registration, the Company shares the address with an address verification service. The other information you provide the Company is not shared for address verification;
• Payment Provider – to facilitate payment, your payment card information is collected and processed by the Company’s secure payment provider. Your full payment card information is retained by the secure payment provider, and is not shared with or stored by the Company;
• Banking Provider – to facilitate your requests for withdrawals of funds, the bank account information you provide is shared with the Company’s partner financial institution. This information is used to ensure your withdrawals are deposited into your account;
• Geo-location Provider – the Company Internet Gaming service is only available to eligible individuals who are physically located in Ontario. Accordingly, your connection information and the location of the device you use to access the Internet Gaming service may be shared with the Company’s third party geo-location service; and

YOUR RIGHTS

If you have an account, you may log in to access and update certain personal information stored with your account. For assistance, please contact the Company Support Centre at [email protected].

You have the right to request access to personal information retained by the Company. Upon request, the Company will make reasonable efforts to catalogue and summarize the personal information related to you that is in its custody or under its control. Please be advised that all access requests received by GGPoker are subject to exceptions, exclusions, and exemptions provided under the applicable laws. The Company may refuse to share information if it falls under any such exception, exclusion or exemption, or if the Company is otherwise not required to disclose. 

The Company will use reasonable efforts to ensure your personal information is up-to-date and accurate. We ask that you update your information through your account whenever your information is incomplete, out-of-date or otherwise changes. You can also request the correction of any personal information in the Company’s custody or under its control. If, in the Company’s sole and absolute discretion, the correction cannot be made, you may require that a statement of disagreement be attached to the information reflecting any correction that was requested but not made. 

You may request access, updating and corrections of inaccuracies in your personal information in our custody or control by emailing or writing to us at the contact information set out below. We may request certain personal information for the purpose of verifying the identity of the individual seeking access to his or her personal information records.

INCIDENT BREACH MANAGEMENT POLICY

The Company maintains this incident breach management policy that is updated regularly which contains a plan to be implemented when a data breach is reported.

Data breach is any incident of security, loss of control, system or human failure, error or issue that leads to, or results in, the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, whether deliberate or inadvertent, and affects the confidentiality, integrity or availability of the respective data.

The incident breach management policy sets out steps and procedures to be followed in case such a data breach occurs. The Step 1 of the plan is to contain the breach and do a preliminary assessment and the preservation of evidence. The Step 2 of the plan involves a detailed assessment and evaluation of the risks associated with the breach. Step 3 involves the process of notifying the customers who were affected by the breach and any required notifications to iGaming Ontario or any other regulator within the prescribed timeline for reporting of any such data breach to iGaming Ontario or other regulators. Step 4 involves creation and implementation of mechanisms and measures to prevent similar data breaches in the future. Players may reach out to the Privacy Officer via e-mail at [email protected] with any questions regarding the reported data breach.

COOKIES & WEBSITE LOG DATA

In addition to any information that you choose to submit to us, we or selected third parties may use a variety of technologies that store or access information already stored on your personal computer, laptop, tablet or mobile phone (each a “device”) whenever you visit or interact with our Internet Gaming website or applications. 

A cookie is a text file placed on a device when a user visits a website. Cookies can be temporary (i.e. session) or permanent (e.g., persistent). They can also be first party (i.e., placed by us) or third party (i.e.., placed by a third party advertiser or advertisements server). 

Cookies that may be used to store or access information already stored by the Company on your device include but are not limited to:

Provider	Name	Description
ggpoker.ca	ajs_anonymous_id, ajs_user_id	Generates a universally unique ID (UUID) to identify viewers.
Google	Various cookies created by Google Analytics	List can be found here:  https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage Google’s free Google Analytics opt-out tool is available at:  https://support.google.com/analytics/answer/181881?hl=en
Facebook	_fbp	Policy can be found here: https://www.facebook.com/policies/cookies
Hotjar	Various cookies created by Hotjar	List can be found here: https://help.hotjar.com/hc/en-us/articles/115011789248-Hotjar-Cookies
Cloudflare	Various cookies created by Cloudflare	List can be found here: https://developers.cloudflare.com/fundamentals/get-started/cloudflare-cookies

The Company uses both session cookies (used only during your visit and expire when you close your browser) and persistent cookies (stored on your device for longer than just your visit) on its Internet Gaming website. Cookies used by the Company collect certain information about your device, such as its IP Address, operating system and browser specifications, but do not collect personal information such as your name or email address. Additionally the Company may place bots/trackers in its marketing emails sent to you for tracking player behaviour with respect to such email. 

The Company installs First Party cookies on devices that access its websites unless the browser used by the device has disabled the installation of cookies. The first party cookies the Company installs ensure the website functions as intended, and in some circumstances are necessary for the Company to provide services requested by website visitors. For example, enabling first party cookies is required to log in to your Company’s Internet Gaming account, as first party cookies are used to support the log-in process. 

The Company also installs Third party cookies on devices that access its websites unless the browser used by the device has disabled the installation of cookies. Third party Cookies are used by the Company to analyze and improve the performance of our websites, offerings, and advertisements. The Company uses web analytics services, including Google Analytics, to understand the interests of our visitors, to market our products and services, and for other internal business purposes.

You can learn more about data collection and use via Google Analytics by visiting https://policies.google.com/technologies/ads?hl=en-US, and can make use of Google’s free Google Analytics opt-out tool at https://support.google.com/analytics/answer/181881?hl=en. 

You can opt out of the installation of cookies, or delete cookies that were previously installed, by updating your settings in the browser you use to visit GGPoker websites. Please note, however, that cookies allow for optimal functionality of GGPoker websites, and are required for some features of our websites to operate. By using the Company’s websites and applications, you consent to the installation of cookies by or on behalf of the Company as described in this Policy

Interest-Based Advertising/Advertising Cookies

We work with third-parties such as ad networks and other advertising companies that use their own tracking technologies (including cookies and pixel tags) on our Website and other websites and apps in order to provide you with tailored advertisements across the Internet. This is a common marketing practice referred to as interest-based or online behavioural advertising. These companies may collect information about your activity across your different devices on our Website and third-party websites and apps (such as web pages you visit and your interaction with our advertising and other communications) and use this information to make predictions about your preferences, develop personalized content and deliver ads that are more relevant to you on third party websites. This information may also be used to evaluate our online advertising campaigns.

Opting-out of Interest-Based Advertising: For more information about interest-based advertising on your desktop or mobile browser and to understand your options, including how you can opt-out of receiving interest-based ads from third-party advertising companies participating in the Digital Advertising Alliance of Canada (DAAC) Self-Regulatory Program for Online Interest-Based Advertising, please visit the DAAC website at http://youradchoices.ca/choices. 

To learn more about interest-based advertising in mobile apps and to understand your options, including how you can opt out of this type of advertising by third-party advertising companies that participate in the DAAC’s AppChoices tool, please download the version of AppChoices for your device at https://youradchoices.ca/appchoices/.  

Important Notes About your Opt-Out: 

• If you opt-out of interest-based advertising by a third party, these tracking technologies may still collect data for other purposes including analytics and you will still see ads from us across the Internet, but the ads will not be targeted based on behavioural information about you and may therefore be less relevant to you and your interests.
• Interest-based advertising opt-outs work by saving cookies in your browser that tell the various ad partners that you have opted-out. Because cookies are generally browser-specific, your choice will only apply to the web browser from which you opt-out. You must opt-out from each web browser from which you do not want interest-based advertising (and this may involve different devices, if you use more than one). 
• If you delete or clear your browser’s cookies, you will need to opt-out again.

THIRD PARTY LINKS

In some cases, our websites provide links to other sites created and maintained by other public and/or private sector organizations. We provide these links solely for your information and convenience. The Company is not responsible for the privacy practices of websites not administered by or on behalf of the Company.

CHANGES TO THIS POLICY

The Company reserves the right to modify this policy at any time, so please review it frequently. Whenever we do so, we will post the updated version on our websites along with the last updated date. 

CONTACTING THE COMPANY 

If you have any questions or concerns about this policy, please contact our Privacy Officer at [email protected].

Additionally, if you wish to make a complaint, you can make one through our complaints process, which can be found in our Terms and Conditions of Use ([email protected]).