Privacy Policy

Version 1.0 last updated August 1, 2022

1. Introduction

   1. The website www.spinaway.ca (“Casino”, “Website”) is owned and operated by NGame N.V, a company registered in accordance with Curaçao Law. Abraham de Veerstraat 9, Willemstad, Curacao (“SpinAway”, “Company”, “We”, “Us”, “Our”). This Website and our applications, software, websites, APIs, products, and services (the “Services”) are being offered by SpinAway as part of the regulated iGaming market conducted and managed by iGaming Ontario (http://www.igamingontario.ca/en) (“iGO”). SpinAway collects Personal Information (as defined hereunder) in accordance with the Privacy Laws (as defined hereunder).
   2. We have a legal obligation under gambling regulations to process Personal Information from players in order to provide you with the Services as part of the internet gaming (iGaming) market in Ontario regulated by the Alcohol and Gaming Commission of Ontario (“AGCO”) and conducted and managed by iGO.
   3. We collect, use and disclose Personal Information of our customers (“you”, “your”) in order to provide our Services to you and on behalf of, and as agent to iGO. Such processing of Personal Information is done in accordance with applicable Privacy Laws (as defined hereunder).

2. Purpose

   1. This Privacy Policy (the “Policy”) explains how we protect your privacy when we obtain Personal Information from you, how we use that information, what your rights are in this respect and how we safeguard that.
   2. By registering a player account with our Website, you confirm and give consent that you understand and consent to this Policy. If you do not agree with the terms of this Policy and do not wish to provide us with the Personal Information we require, please do not use this Website.
   3. Please note that this Policy constitutes an agreement between you and us. We may periodically make modifications to this Policy. When the Policy is updated, the players must actively consent to the new changes.

3. Definitions

   1. “Personal Information” means any information about an identifiable individual and includes any information that constitutes personal information within the meaning of any of the Privacy Laws.
   2. “Player Information” means the information set forth in each Player Profile.
   3. “Process” and “Processing” means the collection, use, disclosure, transfer and retention of Personal Information.
   4. “Privacy Laws” means all applicable laws, regulation, administrative guidelines and other binding authority governing the collection, use, disclosure and retention of Personal Information which we have to comply with, including without limitation the Freedom of Information and Protection of Privacy Act (FIPPA), Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA), the legislation commonly known as the Canadian Anti-Spam Legislation (S.C. 2010, c. 23) (CASL), Ontario Regulation 722/21 made under the Alcohol and Gaming Commission of Ontario Act, the Operating Agreement between iGO and SpinAway, and the iGO Privacy Directive.

4. Information We Collect

   1. The types of Personal Information which we collect from you are:
      • Account Information: Information that you provide to us when filling in the forms on our account registration pages, as well as any other data that you submit via the Website or email and linked to your player profile (e.g. first and last name, date of birth, email address, phone number, authentication details, physical address, physical location, personal numeric code (e.g. Social Insurance Number), password, gender, tax filing number and documentary evidence confirming all such information, occupation, source of wealth and source of income);
      • Correspondence: Your communications with us via the Website, email, web chat, marketing (opt in/opt out) or through other means of communication;
      • Use of Services: All player account transaction history, payment details and any other information that is generated, captured, organized and/or transmitted by or in connection your use of our Services, whether this takes place via the Website(s) or via other means of communication;
      • To use the Services, you must provide certain Personal Information for identification and verification, such as your name, credit, debit or other card number, card expiration date, and CVV code. This information is encrypted and sent to your card network, which upon approval sends back a token, which is a set of random digits for engaging in transactions without exposing your card number;
      • Website logins and details, including traffic data, GeoIP location data, browser/device data, weblogs, activity logs, cookies and other traffic information recorded in our system;
      • Due Diligence: Documents and proofs reasonably requested by us to verify your account, to process deposits or withdrawals and to conduct anti-fraud, Anti-Money Laundering and Due Diligence checks (on our own initiative or as required by applicable legislation). Such proofs may include copies of government-issued photo IDs, passports, payment slips, bank statements, etc.;
      • We use electronic identity verification software provided by third party suppliers as part of our internal risk management procedure (Verification software); this includes using a Credit Reference Agency for the purposes of identity verification. We will share your Personal Information with these third parties as part of providing our services.;
      • We also collect information that you provide when you choose to contact us or to participate in a survey, contest, promotion or other customer assessments that we may carry out from time to time (such as your preferences in relation to our Services, your habits, payment transaction history,);
      • We will derive your approximate location from your IP address, collecting connection details and information with regard to your device, software or hardware that may identify you, such as your device’s unique identifiers (e.g. UDID, IMEI and MAC address), browser fingerprinting, IP address and geo-location data, as well as other device information such as browser type, language, operating system, the referring web page, pages visited, location, and cookie information;
5. In addition to Personal Information, we also collect un-identified and non-identifiable information pertaining to you, which may be made available or gathered via your use of the Services (“Non-Personal Information”). Non-Personal Information which is collected consists of technical information and aggregated usage information, and may contain, among other things, your operating system, type of browser, screen resolution, browser and keyboard language, your ‘click-stream’ and activities on the Services, the period of time you used the Services and related time stamps, etc.
6. For the avoidance of doubt, any Non-personal Information connected or linked to any Personal Information shall be deemed as Personal Information as long as such connection or linkage exists and is possible to identify natural person by using such Information.
7. Types of Non-personal Information we collect from or about you are:
   • Log-in history and technical information: In order to enhance the functionality of the Services and to provide you with a better user experience, we collect technical information transmitted by your device, including certain software and hardware information (e.g. the type of browser and operating system your device uses, language preference, access time and the domain name of the Website; etc.).
   • Gameplay information: We record game play information including, among other things, your deposits, bets, bonuses, game session duration and high scores. We may share and publish such information.
   • Device and connection information: We collect information from the particular device you are using, for security and fraud detection and prevention purposes. For example, we may gather information with regard to other software which is running simultaneously with ours for detecting if you are using software which is associated with fraudulent activity (e.g. robots, malware, etc.) or checking if the connection you are using is via a VPN or proxy.
   • Analytics information: We collect information about your use of the Services, such as applications' usage, log files, user activity (e.g. pages viewed, the amount of time spent on particular pages, online browsing, clicks, actions, etc.), time stamps, alerts, etc. This information is collected for amongst other things troubleshooting errors and bugs as well as for research and analytics purposes about your use of the Services.
   • Anonymous information: We may create aggregated, anonymized or de-identified from Personal Information collected via your use of the Services or via other means. Such information is not, on its own, reasonably capable of being associated or linked to you personally. We use such Non-Personal Information to analyze usage patterns, so that we may improve, optimize, or enhance our Services and improve our users' experience with and ability to navigate our Website.

8. How We Use Your Information

   1. We process the Personal Information and Non-Personal Information we collect from you in order to deliver our Services. In particular, we will process your Personal Information and Non-Personal Information for the following purposes:
      • Registering an account with us;
      • Processing your bets and transactions. This includes your use of credit card and online payment systems;
      • Providing you with our Services;
      • Personalizing your experience by segmenting you into groups based on your gaming behavior, presenting your favourite games or games that you might be interested in at the top of your games content, based on the preferences you set, your place of residence and your game play data;
      • Rendering customer support, such as assistance with setting up and managing your account, troubleshooting and protecting against errors;
      • Determining your eligibility to use the Services;
      • Identifying and performing the necessary verification checks;
      • Providing registered players with information about our promotional offers, or providing promotional information from our selected business partners, associates and affiliates (only if players specifically consented to receiving such marketing material through the Website);
      • Complying with legal responsibilities, including complying with anti-money laundering (AML) and combating the financing of terrorism (CFT) laws;
      • Flagging gaming patterns or behaviours that could indicate problem gambling;
      • Preventing fraud, abuses and misuses of our Services;
      • Monitoring and investigating transactions for the purposes of preventing fraud, terms abuse, money laundering and other illegal or irregular gaming activities;
      • Analyzing customer trends through market study assessments (participation in surveys is not obligatory and you can always choose not to take part);
      • Conducting research and statistical analysis of aggregated data.
   2. We ensure that we only process the minimum amount of Personal Information and limit its use only for the purposes identified above.

9. Marketing Communications

   1. We may use your Personal Information, including your email address and phone number, to send you marketing communications regarding products, services, and promotions, where such use is compliant with Privacy Laws. This may include information about products and services from our business partners, such as casino game providers. Whenever you decide to stop receiving such marketing and advertising material, you may opt out of this in your player account settings or by contacting our Customer Support team.
   2. Additionally, note that by accepting any contest prize or winnings from us, you consent to the use of your name and/or nickname for advertising and promotional purposes without additional compensation, except where prohibited by law.
   3. We will never share your Personal Information with any third party who intends to use it for commercial purposes unless we have expressly informed you and you have given us your consent to do so pursuant to the Privacy Laws.

10. Obtaining Personal Information

    1. We only collect the necessary Personal Information for the purposes specified above. The majority of the Personal Information that we collect about you is information that you provide to us. We shall not collect any Personal Information about you without your knowledge. We may, however, automatically collect certain data about you where you would have provided such information through the use of our Services and through your interactions with us.
    2. Pursuant to our anti-fraud, Anti-Money Laundering and Due Diligence legal obligations, we carry out due diligence checks to verify information about you, including your identity and your source of income and/or source of wealth. We work with reputable third parties to carry out these checks and they provide a report which contains Personal Information about you and your background. We may also lawfully receive certain Personal Information from online vendors and service providers, such as fraud prevention companies. In addition, we retain the right to engage the services of third-party providers to render technical support, so as to process your online transactions and source gaming content.
    3. Please understand that we may be granted access to any Personal Information you may provide to such vendors, service providers and third-party e-commerce services. Rest assured that we will use and safeguard any Personal Information so obtained, as set out in this Policy. Any information that you provide will only be disclosed to third parties outside the Company in accordance with this Policy, and we shall take any necessary steps to ensure that our agreements with third-party service providers always protect your Personal Information.

11. Data Recipients

    1. We may pass Personal Information that you have given us to other entities within our group of companies and to our business partners. These companies include our parent companies, their parent companies and all of the subsidiaries of these respective companies, as well as other companies with whom we carry out business and hold necessary agreements. Processing of your information may be undertaken another company in the group of companies, which may use a third party to fulfil such data processing needs.
    2. Employees of the Company, more specifically our Anti-Money Laundering Officer, Payments & Anti-Fraud analysts, Customer Support agents, Customer Retention team members, VIP player managers as well as other selected employees, shall also have access to your Personal Information for the purpose of executing their duties and providing you with assistance.
    3. Our employees who have access to or are associated with the processing of the players’ Personal Information have signed confidentiality agreements to respect the confidential nature of the players’ information pursuant to applicable gaming, data protection and Privacy Laws. In addition, we limit access to your Personal Information to those employees, agents, contractors and other third parties who have a need to know business requirement. They will only process your Personal Information on our instructions and they are, as mentioned above, subject to a duty of confidentiality.
    4. In order to provide you with efficient service, we use third party service providers authorized to process Personal Information on our behalf, who are acting as our contractors. Processing of Personal Information by our parent companies, their parent companies and all of the subsidiaries of these respective companies and/or by our service providers may transferr your Personal Information outside Canada. Whenever we transfer your Personal Information outside Canada, we make sure that the recipients of your Personal Information have policies and processes in place to ensure that your Personal Information will be properly safeguarded at all times. We use contractual and other means to ensure that such Recipients provide a level of protection for your Personal Information that is adequate and comparable to the level of protection set forth in this Policy and will always conduct rigorous due diligence to ensure there are no risks to such transfers. We do however advise that where Personal Information is collected from you and processed in a foreign country, this information may be accessible to law enforcement and national security authorities of that jurisdiction.By browsing the Website and communicating electronically with us, you acknowledge and agree to the processing of your Personal Information outside of Canada by us, by our parent companies, their parent companies and all of the subsidiaries of these respective companies, and by our contractors and service providers.

12. Disclosing Data To Third Parties

    1. • We do not sell, share or rent your Personal Information to third parties, except as described in this Policy. Your Personal Information will be disclosed only to the extent required for one or more of the specific purposes stipulated in this Policy.
       • We may disclose your Personal Information in limited situations such as, if required by law, regulation, court order, by law enforcement authorities or by other legal subpoena or warrant. We may also disclose your personal information to a regulatory or law enforcement agency if we believe it to be necessary to protect the legitimate interests of the Company, its customers or any third party.
    2. Personal Information will only be disclosed to third parties in the following cases:
    3. • For the purposes stipulated in this Policy;
       • Where we are required to do so by law;
       • If the Website needs to share data with its payment processors to facilitate payment transactions in accordance with their privacy policies (In particular, most banking card transactions are processed by Wirecard Bank AG whose privacy policy applies to such transactions);
       • To comply with our legal and regulatory duties and responsibilities to the relevant licensing and regulatory authorities as well as all duties and responsibilities owed under any other applicable legislation and to any other applicable regulators in other jurisdictions;
       • When the Company believes that disclosure is necessary to protect the Company’s or the player’s safety, or the safety of others, investigate fraud, or respond to a government request;
       • To any other third party with the player’s prior consent to do so
    4. We use third-party data processors to process limited Personal Information on our behalf. Such service providers support the Website, especially relating to hosting and operating the Website, marketing, analytics, improving the Website, and sending email newsletters. We shall ensure that the transfer of the Personal Information to the recipient is compliant with applicable Privacy Laws and that the same obligations are imposed on the processor as is imposed on us under the respective Services Agreement.
    5. We may disclose Personal Information if we acquire any new businesses. Should our Company undergo any changes to its structure such as a merger, acquisition by another company or a partial acquisition, it is most likely that our customers’ Personal Information will be included within the sale or transfer. We will, as part of our Policy, inform our players by email prior to affecting such transfer of Personal Information.
    6. Please note our content may link to third party websites to provide relevant references. We are not responsible for such external content, which may contain separate privacy policies and data processing disclosures.

13. Data Retention

    1. As stated under our Terms & Conditions, you can decide to have your player account closed at any time, and we can also close your account under the circumstances set out in our Terms & Conditions. Following closure of your account, we will retain your Personal Information on record for as long as required by applicable laws and as prescribed by the iGO policies and Privacy Laws. Thereafter, the processing of such Personal Information will be restricted and will only be used should it be required by competent authorities in cases of enquiries regarding financial and fiscal records, fraud, money laundering or investigations into any other illegal activity.
    2. Upon the expiration of the above-mentioned deadlines, your Personal Information will be securely deleted and/or anonymized in accordance with our retention and disposition policy and schedule and in compliance with Privacy Laws.

14. Data Accuracy

    1. We will take every reasonable step to ensure your information is up to date to accomplish the purposes for which we collected it for and erase or rectify information that is inaccurate or incomplete.
    2. You have the right to challenge the accuracy and completeness of the Information we hold about you and we will make sure we amend it as appropriate.
    3. Please note, it is also your responsibility in ensuring that we hold the most up to date information about you. For this reason, we invite you to regularly check your Personal Information and make sure you update your account Information by accessing your account or by contacting our Customer Support.

15. Your Rights To Access And Control Your Personal Information

    1. At any given time, you will have the following rights regarding your Personal Information processed by us:
       • (A) Right to access: you have the right to request access to your Personal Information. Please note we may refuse to act upon your request in circumstances where such refusal is required by law, including: i) where your Personal Information is inseparable from the Personal Information of other individuals; ii) where acceding to your request would disclose information that is subject to solicitor-client privilege; iii) where acceding to your request would result in the disclosure of confidential commercial information.
       • (B) Right to erasure: you have the right to ask for your Personal Information to be kept and stored by us no longer than necessary to fulfil the collection purpose. You can indicate whether you prefer destruction, erasure or anonymization of your personal information. Please note, in some cases, we may be subject to statutory requirements to retain certain classes of information for a specified period of time. We have legal obligations associated with Anti-Money Laundering and other matters to retain information obtained for customer due diligence purposes, such as your name and address and all documentation gathered during account registration and payment processes, for a period of 5 years after you close your account. This period may be extended by a further 5 years where such extension would be considered necessary for the purposes of the prevention, detection, analysis and investigation of money laundering or funding of terrorism activities by the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”), relevant supervisory authorities or law enforcement agencies.
       • (C) Right to rectification: you have a right to challenge the accuracy and completeness of your Personal Information and have information amended as necessary within a reasonable time.
    2. In order to exercise any of the above rights, you can submit a request by email to dataprotection@spinaway.com. Your request will be reviewed and answered within applicable timeframes.
    3. We endeavour to respond to your requests at minimal or no costs to you. However, if we envisage a any cost to you, we will inform you of the approximate cost beforehand.

16. Security And Protection Of Personal Information

    1. We hereby acknowledge that in collecting and processing your Personal Information for the purposes of managing your player account, we are bound by strict legal provisions on the protection and security of Personal Information.
    2. We have implemented all necessary technical and organizational measures, whether physical, electronic or procedural, to protect the confidentiality and security of the Personal Information you share with us. These measures have been implemented to protect Personal Information against unauthorized access, destruction, loss, alteration, access, disclosure or use. Our security controls are designed to maintain an adequate level of confidentiality, integrity and data availability of Personal Information.
    3. Player accounts can only be accessed with the player’s unique ID and password. You are responsible for keeping your login information confidential and making sure it cannot be accessed by another person.
    4. However, please note that it is also your responsibility to ensure your information is kept secure. We recommend all our customers to:
       • use strong passwords (at least 8 characters, a mixture of both uppercase and lowercase letters, a mixture of letters and number and inclusion of at least one special character)
       • avoid sharing login details or any other account information on social media or with other third parties
       • protect your personal devices from unauthorised access (use antivirus, password protect your device, etc.)

17. Data Breach Management And Notification Plan

    1. Despite the security measures outlined above, the Internet is not a perfectly secure medium and the will always be the chance that your Personal Information could potentially be subject to unauthorized acts by third parties. Although we take reasonable steps and employ appropriate security measures to safeguard your Personal Information, no method of transmitting or storing data is completely secure. We cannot guarantee the security of your Personal Information and any transmission of your Personal Information through the Internet is at your own risk. We cannot be responsible for the acts of those who gain unauthorized access to your Personal Information, and we make no warranty, express, implied or otherwise, that we will prevent such access or abuse.
    2. In the event that our security measures identify a potential data breach, we have implemented a robust data breach management and notification plan where we ensure that any data breach is effectively identified and contained, a risk assessment is undertaken and notifications are followed. We ensure our plan provides for response, evaluation and review of any data breach and actions put in place to minimize the risk and damage of a data breach. Where a confirmed data breach could reasonably result in a real risk of significant harm to our customers, we report the breach as soon as feasible to:
       • The Office of the Privacy Commissioner of Canada;
       • The Information and Privacy Commissioner of Ontario;
       • The affected customers;
       • Any other organisation or government institution that we believe may be able to reduce the risk and/or mitigate the results of the data breach.
    3. We will also notify iGO, and we will aid iGO and all other responsible regulatory authorities in breach management and handling the results from a data breach.
    4. We will keep a record of any such data breach to the extent required by applicable laws. If you have a security-related concern, please contact us at dataprotection@spinaway.com.

18. Contacting

    1. You may always contact us in regards to this Policy should you wish to:
       • Exercise your rights;
       • Confirm the accuracy of the personal information we have collected about you;
       • Enquire about our use of your personal information;
       • Prohibit future use of your data for direct marketing purposes;
       • Update or rectify any information that you have provided us (in such cases you shall provide any evidence we may reasonably require to effect such changes).
    2. Note it is illegal to provide us with false information about you and it is your responsibility to ensure that we are always updated with your correct data.
    3. If you have any questions, comments, complaints or suggestions relating to this notice, or any other concerns about the way in which we process information about you, please contact us at: dataprotection@spinaway.com.
    4. If you are unsatisfied with the resolution of your complaint, you also have the right to escalate your complaint to iGO.

19. Cookie Policy

    1. When you visit, access or interact with the Website, we and third-party companies collect information by using cookies and other tracking technologies such as pixel tags (for simplicity we refer to all such technologies as 'cookies').
    2. Cookies are small text files that are stored on your computer or equipment when you visit our web pages. Some of the cookies are essential for the Website to operate; others improve your Website experience and help us deliver a better service to you.
    3. The cookies used on the Website do not collect Personal Information such as name, address, email address etc. However, certain cookies may collect information which relate to a unique ID or another identifier, such as IP Address and hashed emails, which, when combined with other information, may become Personal Information which can indirectly identify you. In such instances, we will require your consent before placing cookies on your computer.
    4. Once you have given us your cookie consent, we will store the cookie on your device to be used for your future visits to the Website.
    5. Below are the types of cookies we use and their purposes.
       • Required Cookies: enable the navigation and basic functionality of the Website, e.g., access to member areas of the Website.
       • Functional Cookies: allow us to analyse your Website usage and your selections on the Website (e.g. your session key, language, or region), so we can save these settings and offer you a more personalised experience.
       • Advertising Cookies: allow us to gauge how effective our content marketing is. These cookies are provided by our partners to track Website visits and new player registrations from advertising. We do not share your Personal Information (such as name or email) to affiliated partners except for site visit data collected directly by such Advertising Cookies. However your site visit data may be linked with other Personal Information collected through other sources by the providers. The latter external data processing is governed by the privacy notices and policies of these third-party providers.
    6. In addition to the above, we use a number of third party service providers who also set cookies on this Website, in order to deliver the services that they are providing to us. Such services include, but are not limited to, helping us to improve your experience by tracking your activity on the Website, measuring the effectiveness of the Website and the effectiveness of our marketing campaigns.
    7. Most online browsers automatically accept cookies. If you prefer, it is possible to block some or all cookies, or to delete cookies that have already been set by modifying your browser settings. However, we recommend that you do not block or delete your cookies as this may restrict your use of our Website.