Privacy Policy

Version: 1.0  |  Last Updated: November 3, 2026

1. Introduction

Welcome to Oxibet Casino ("we", "us", "our"), accessible at theoxibetcasino.com (the "Website"). We are committed to protecting the privacy and personal data of everyone who visits or uses our services. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and what rights you have in relation to it.

This policy applies to all users of our Website, mobile applications, and any related services (collectively, the "Services"). By accessing the Website or registering an account, you acknowledge that you have read, understood, and agree to the practices described in this document. If you do not agree, please discontinue using our Services immediately.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, which together form the complete framework governing your relationship with Oxibet Casino.

2. Data We Collect

We collect personal data from you in several ways: directly when you register or interact with us, automatically through technology as you use the Website, and occasionally from third-party sources for verification or fraud-prevention purposes.

2.1. Information You Provide Directly

• Identity data: full legal name, date of birth, gender.
• Contact data: email address, telephone number, postal address.
• Account credentials: username and encrypted password.
• Financial data: payment method details (e.g., card type and last four digits, e-wallet identifiers, bank account references used for deposits and withdrawals).
• Identity verification documents: government-issued photo ID, proof of address, and source-of-funds documentation when required by our Know Your Customer (KYC) procedures.
• Responsible gaming preferences: deposit limits, self-exclusion requests, session reminders, and similar settings you configure through your account.
• Communications data: any information you include when contacting our support team by email, live chat, or other channels.

2.2. Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution.
• Usage data: pages visited, links clicked, games played, session duration, wagering activity, and navigation paths across the Website.
• Cookies and tracking data: as described in Section 6 of this policy.
• Geolocation data: approximate location derived from your IP address, used to confirm eligibility based on your province.

2.3. Information from Third Parties

• Identity verification providers: confirmation of identity documents and address.
• Payment processors: transaction status, fraud signals, and chargeback notifications.
• Analytics and advertising partners: aggregated audience data and campaign attribution information.
• Fraud prevention agencies: information about patterns of suspicious activity shared across the industry.

We do not intentionally collect special categories of sensitive personal data (such as health, ethnicity, or biometric data) unless you voluntarily provide information relevant to a responsible gaming assessment.

3. How We Use Your Data

We process personal data only for specific, documented purposes. Below is a detailed explanation of each purpose and the types of data involved.

3.1. Account Registration and Management

We use your identity, contact, and credential data to create and maintain your account, authenticate your identity at login, and send important account-related communications such as verification emails and security alerts.

3.2. Service Delivery and Gaming Operations

Your usage data and financial data are processed to facilitate deposits, withdrawals, game play, bonus crediting, and the general delivery of all features available through our Services.

3.3. Know Your Customer (KYC) and Age Verification

We are required to verify that every player is of the minimum legal gambling age applicable in their province (18 or 19 years, depending on location) and to confirm their identity before processing certain withdrawals or at any point we consider necessary. Your identity documents are processed solely for this purpose and retained in accordance with Section 8.

3.4. Responsible Gaming

Data about your gaming behaviour, account activity, and any self-imposed limits helps us identify potential signs of problem gambling and intervene appropriately. More detail is available in our Responsible Gaming policy.

3.5. Fraud Prevention, Security, and Legal Compliance

We process technical, financial, and identity data to detect and prevent fraud, money laundering, and abuse of promotions. We may share findings with law enforcement or regulatory authorities where required by applicable law.

3.6. Marketing and Personalisation

Where you have provided consent or where we have a legitimate interest, we may use your contact and usage data to send promotional offers, personalise on-site content, and recommend games or bonuses that may interest you. You may opt out of marketing communications at any time using the unsubscribe link in any email or by contacting us at [email protected].

3.7. Analytics and Service Improvement

Aggregated and pseudonymised usage data helps us understand how our Services are used, troubleshoot technical issues, and improve overall product quality.

4. Legal Bases for Processing

We rely on the following legal bases when processing your personal data:

Where we rely on legitimate interests as a legal basis, we have conducted a balancing test and determined that our interests are not overridden by your rights and interests. You may request details of any such balancing test by contacting our privacy team.

5. Data Sharing & Third Parties

We do not sell your personal data to third parties. However, we share data with carefully selected partners and service providers where necessary to operate our Services or to comply with our legal obligations.

5.1. Categories of Recipients

• Payment processors and financial institutions: Interac, Visa, Mastercard, PayPal, Neteller, MuchBetter, iDebit, Instadebit, Paysafecard, Apple Pay, Google Pay, and similar providers process transaction data to complete deposits and withdrawals.
• Identity verification and KYC providers: third-party services that confirm the authenticity of documents you submit during the verification process.
• Game software providers: where necessary, your user identifier and wagering activity may be shared with game studios to ensure fair play and resolve disputes.
• Analytics and marketing technology providers: pseudonymised data is shared with analytics platforms and advertising networks under strict data processing agreements.
• Fraud prevention and security services: we participate in industry-wide data sharing programmes designed to detect and prevent money laundering, bonus abuse, and account takeover fraud.
• Regulatory and law enforcement authorities: we may disclose personal data when required by a court order, legal process, or regulatory directive.
• Professional advisors: lawyers, auditors, and insurers who are bound by confidentiality obligations.

5.2. Data Processing Agreements

All third-party processors are required to enter into a data processing agreement with us confirming that they will process your data only on our documented instructions, maintain appropriate technical and organisational security measures, and not engage any sub-processors without our prior consent.

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies (collectively, "cookies") to operate core website functions, analyse traffic, and deliver targeted content.

6.1. Types of Cookies We Use

• Strictly necessary cookies: essential for the Website to function, including session management, login persistence, and fraud prevention signals. These cannot be disabled without impairing Website functionality.
• Performance and analytics cookies: collect anonymised or pseudonymised data about how visitors navigate the Website, which pages are most visited, and where technical errors occur.
• Functional cookies: remember your preferences such as language settings, display options, and responsible gaming tool configurations.
• Targeting and advertising cookies: used to deliver advertisements relevant to your interests on third-party platforms and to measure the effectiveness of our marketing campaigns. These are deployed only where you have provided your consent.

6.2. Managing Your Cookie Preferences

When you first visit our Website, a cookie consent banner allows you to accept, reject, or customise non-essential cookies. You may update your preferences at any time via the cookie settings link in the footer of the Website. Please note that disabling strictly necessary cookies will prevent you from using core features of the Website, including logging in to your account.

You can also manage cookies through your browser settings; however, browser-level controls affect all websites equally and may not perfectly reflect the granular choices available through our cookie preference centre.

7. Data Security

We implement a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration.

7.1. Technical Measures

• All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Passwords are stored using one-way cryptographic hashing; we never store plaintext passwords.
• Sensitive financial data is processed in environments that comply with PCI DSS standards.
• Access to production systems and personal data is restricted to authorised personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Regular vulnerability assessments and penetration tests are conducted by qualified security professionals.

7.2. Organisational Measures

• All staff with access to personal data receive regular privacy and security training.
• Third-party processors are vetted for security compliance before onboarding and audited periodically thereafter.
• We maintain an incident response plan. In the event of a data breach that is likely to result in risk to your rights, we will notify you and relevant authorities without undue delay and, where required, within 72 hours of becoming aware.

No method of transmission over the internet or electronic storage is completely secure. While we take every reasonable precaution, we cannot guarantee absolute security of your data.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations.

• Account and transaction data: retained for a minimum of five (5) years after account closure to satisfy anti-money laundering record-keeping obligations and to resolve any disputes that may arise.
• KYC and identity documents: retained for five (5) years from the date of verification or the date of last transaction, whichever is later.
• Marketing consent records: retained for the duration of our relationship with you and for two (2) years after you withdraw consent, as evidence of compliance.
• Technical and log data: retained for up to twelve (12) months for security monitoring and fraud investigation purposes.
• Responsible gaming records: self-exclusion and limit history is retained for at least five (5) years to protect vulnerable players from circumventing cooling-off periods.

When personal data is no longer required, we securely delete or anonymise it so that it can no longer be associated with you.

9. Your Rights

Depending on your province of residence, you may have various rights in relation to your personal data. We are committed to honouring these rights in accordance with applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

9.1. Right of Access

You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed. We will respond to access requests within 30 days. If your request is complex or numerous, we may extend this period by a further 30 days, notifying you accordingly.

9.2. Right to Correction

If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You may update basic profile information (such as your email address or phone number) directly within your account settings; for other corrections, please contact our support team.

9.3. Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing — most commonly for direct marketing and non-essential cookies — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To withdraw marketing consent, use the unsubscribe link in any promotional email or write to us at [email protected].

9.4. Right to Erasure ("Right to Be Forgotten")

You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis applies, or where processing is unlawful. We will assess each request individually. Erasure may be declined or limited where we are required to retain data to comply with a legal obligation, including anti-money laundering record-keeping requirements described in Section 8.

9.5. Right to Restrict Processing

In certain circumstances, you may ask us to suspend processing of your data — for example, while we investigate a correction request or respond to an objection — without deleting it.

9.6. Right to Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and to request that we transmit that data directly to another controller where technically feasible.

9.7. Right to Object

You have the right to object to processing based on legitimate interests, including profiling for direct marketing purposes. Where you object to marketing, we will cease processing your data for that purpose without requiring justification. For other objections, we will assess whether our legitimate interests override your rights and freedoms.

9.8. How to Exercise Your Rights

To submit any privacy rights request, please contact our Privacy Officer at [email protected] or write to the address set out in Section 13. We may need to verify your identity before processing a request. We will not charge a fee for handling routine requests, but may apply a reasonable administrative fee for manifestly unfounded or repetitive requests.

9.9. Right to Complain

If you believe your privacy rights have been violated and we have not resolved your concern, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca, or with the applicable provincial privacy commissioner in your province of residence.

10. International Data Transfers

Oxibet Casino operates in a global digital environment. Some of the third-party service providers and technology platforms we use may store or process your personal data in jurisdictions outside Canada, including in the European Union, the United Kingdom, or the United States.

When transferring personal data internationally, we take steps to ensure that an adequate level of protection is in place. These safeguards may include:

• Transfers to countries or organisations that have been recognised as providing an adequate level of data protection;
• Execution of Standard Contractual Clauses (SCCs) or equivalent contractual instruments that bind the recipient to protect your data in accordance with standards comparable to Canadian law;
• Reliance on the recipient's adherence to recognised certification frameworks such as ISO 27001 or SOC 2 Type II, where contractually incorporated.

If you would like further information about the specific safeguards applicable to any particular transfer, please contact our Privacy Officer at [email protected].

11. Minors

Our Services are strictly intended for adults who meet the minimum legal gambling age in their province of residence. As confirmed in our Terms & Conditions, the minimum age to register and use Oxibet Casino is 18 years in Alberta, Manitoba, and Québec, and 19 years in all other Canadian provinces and territories.

We do not knowingly collect personal data from individuals who are below the applicable minimum age. If we become aware that a minor has registered an account or submitted personal data, we will promptly close the account and delete all associated data.

If you believe a minor has created an account on our Website, please notify us immediately at [email protected] so that we can take appropriate action. Parents and guardians are encouraged to use parental control tools and internet filtering software to prevent minors from accessing gambling websites.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the Services we provide. When we make material changes, we will update the version number and Last Updated date at the top of this document and, where the changes are significant, notify you by email or through a prominent notice on the Website at least 14 days before the changes take effect.

Your continued use of the Website after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should stop using the Services and may request account closure by contacting our support team.

We recommend reviewing this policy periodically to stay informed about how we protect your personal information. All previous versions of this policy can be made available upon request.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us through any of the following channels:

We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 calendar days. If your request is particularly complex, we will keep you informed of progress and provide an expected resolution date.

For concerns that we have not resolved to your satisfaction, you are entitled to contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or call 1-800-282-1376.

This document forms part of the Oxibet Casino legal framework, which also includes the Terms & Conditions and the Responsible Gaming policy. All three documents should be read together for a full understanding of your rights and obligations when using our Services.