Player Privacy and Protection Policy

1. Introduction

This Player Privacy and Protection Policy (“Policy”) sets out how Zplnn Casino (“we”, “us”, “operator”) collects, uses, discloses, stores and protects personal data relating to individuals who access or use our gaming services. We are committed to ensuring that all personal data is handled in a lawful, fair and transparent manner and in accordance with applicable privacy and data protection laws, including but not limited to:

• The Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada;
• Any additional provincial or territorial privacy statutes, where applicable;
• The rules and guidelines issued by the Tobique Gaming Commission;
• Our internal compliance obligations, licensing conditions and operational risk controls.

By accessing our platform or registering for an account, players acknowledge that their personal data may be processed in accordance with the terms of this Policy. The data we collect may include information necessary for identity verification, regulatory compliance (including anti-money laundering and responsible gambling obligations), transactional processing and player support services.

This Policy applies to all player data collected through our websites, mobile applications, account registration processes, and any other interaction with our services, whether electronic, verbal or written. It forms part of our broader player protection framework and should be read in conjunction with our Terms and Conditions, Responsible Gambling Policy, and other applicable policies and notices. We reserve the right to update or modify this Policy from time to time to reflect changes in law, regulation or business practices.

2. Scope of the Policy

This Policy applies to all personal data collected, processed, or otherwise handled by us in connection with the use of our gaming platform and related services. It governs how we manage data obtained from players throughout their interaction with our systems, from account registration to closure, and includes both online and offline communications. The scope of this Policy extends to:

• Individuals who register for an account or use our services, regardless of geographic location;
• Personal data submitted directly by players (e.g. during registration, payment, or support requests) or automatically collected through use of the platform (e.g. device identifiers, login data);
• Data processed for the purposes of regulatory compliance, responsible gambling, risk management and fraud prevention;
• All data subject to disclosure under obligations imposed by the Tobique Gaming Commission, anti-money laundering (AML) regulations, or applicable laws.

This Policy also applies to data processed on our behalf by third-party service providers engaged to support our operations, such as payment processors, identity verification services, analytics platforms and IT infrastructure providers, in all of which cases we ensure that appropriate contractual and technical safeguards are in place. It does not apply to data collected by third-party websites or services that may be linked to or accessible from our platform.

3. Types of Personal Data Collected

In the course of providing regulated gaming services, we may collect and process a variety of personal data from players. The specific categories depend on the nature of the interaction and the services used, but may include, without limitation:

3.1 Identification and Contact Data

• Full legal name; date of birth; residential address;
• Nationality and country of residence;
• Email address and telephone number;
• Government-issued identification documents (e.g. passport, driver’s licence).

3.2 Account and Transaction Data

• Username, password and other login credentials;
• Account registration and modification history;
• Deposit and withdrawal records;
• Bonus usage and transaction history;
• Game activity, bet values, wins/losses and session data.

3.3 Financial and Payment Information

• Payment card or e-wallet details;
• Bank account information (if applicable);
• Transaction identifiers and billing records;
• Currency preferences.

3.4 Responsible Gambling and Risk Monitoring Data

• Records of self-exclusion or time-out requests;
• Player-imposed limits (e.g. deposit, wager, or loss limits);
• Behavioural patterns identified through monitoring systems;
• Interaction logs relating to responsible gambling communications.

3.5 Technical and Usage Data

• Device identifiers (e.g. IP address, browser type, operating system);
• Geolocation data (where permitted by law);
• Log files, access timestamps and system performance metrics;
• Cookies and tracking technologies (subject to our cookie policy).

3.6 Customer Support and Correspondence

• Records of live chat, email and telephone communications;
• Submitted documents or attachments for identity verification or dispute resolution;
• Notes or transcripts created by support personnel during service interactions.

We collect personal data either directly from the player, through use of our services, or from third-party service providers who assist with identity verification, payments and compliance checks.

4. Legal Basis for Processing

We process personal data only where we have a valid legal basis for doing so. Depending on the context, the processing of player data may rely on one or more of the following lawful grounds:

4.1 Contractual Necessity: Processing required to establish, manage and fulfil the contractual relationship between the player and the operator, including account creation, processing wagers and transactions, providing customer support, and ensuring access to gaming services.

4.2 Legal and Regulatory Compliance: We are subject to various legal and regulatory obligations, including those related to AML, CTF, fraud prevention, responsible gambling, tax reporting and gaming regulation under the authority of the Tobique Gaming Commission. Personal data is processed as necessary to meet these obligations.

4.3 Legitimate Interests: We may process personal data for our legitimate business interests, provided such interests are not overridden by the player’s fundamental rights and freedoms. These may include maintaining platform integrity and cybersecurity, preventing fraud and abuse, improving service quality, conducting internal analytics and business reporting, and enforcing contractual terms. Where required, we conduct a balancing test to ensure our interests are proportionate and respect individual privacy.

4.4 Consent: In certain situations we may rely on the player’s explicit consent, such as for the receipt of marketing communications or the use of optional cookies and tracking tools. Consent may be withdrawn at any time through the mechanisms provided on our platform.

4.5 Protection of Vital Interests: We may process personal data in limited circumstances to protect the vital interests of a player or another individual, particularly where there is a risk of harm or unlawful activity.

5. Use of Personal Data

We use personal data only for specified, legitimate purposes and in accordance with applicable privacy laws and our licensing obligations. The data we collect may be used for the following operational and regulatory purposes:

5.1 Account Management and Identity Verification

• Registering and managing player accounts;
• Verifying identity, age and eligibility to use the platform;
• Enforcing account security and authentication measures.

5.2 Payment Processing and Financial Operations

• Processing deposits, withdrawals and refunds;
• Managing payment instruments and verifying payment ownership;
• Detecting and preventing fraudulent or unauthorised financial activity.

5.3 Responsible Gambling Measures

• Implementing and maintaining self-exclusion, limit-setting and time-out requests;
• Monitoring player behaviour for indicators of potential harm;
• Communicating with players regarding responsible gambling tools and interventions.

5.4 Legal and Regulatory Compliance

• Meeting obligations under gaming, AML and CTF laws;
• Responding to lawful requests from regulatory or law enforcement authorities;
• Maintaining audit logs, transaction records and compliance documentation.

5.5 Customer Support and Dispute Resolution

• Responding to inquiries, complaints, or account-related issues;
• Reviewing correspondence and documentation submitted by players;
• Investigating and resolving payment or technical disputes.

5.6 Service Improvements and Analytics

• Conducting internal reporting, trend analysis and platform optimization;
• Measuring player satisfaction and service performance;
• Developing new features and enhancing user experience.

5.7 Marketing and Communication (Where Permitted)

• Sending account-related notifications, updates and service announcements;
• Delivering marketing messages or promotions, where legally permitted and subject to consent preferences.

We do not use personal data for purposes incompatible with those stated in this Policy, and we do not engage in automated decision-making or profiling with legal or significant effects on players unless permitted by law.

6. Responsible Gambling Data

As part of our commitment to player protection and regulatory compliance, we collect and process certain personal data specifically related to responsible gambling. This data is treated with heightened confidentiality and is only accessed or used for appropriate operational or compliance purposes.

6.1 Types of Responsible Gambling Data

• Player-imposed limits (e.g. deposit, loss, or time limits);
• Records of self-exclusion, cooling-off, or time-out requests;
• Interactions with customer support concerning gambling behaviour;
• System-detected behavioural indicators (e.g. frequent session lengths, repeated deposit attempts);
• Notes or observations recorded by trained staff during responsible gambling reviews or interventions.

6.2 Purpose of Processing

• Facilitate the application of player protection tools;
• Identify potential signs of gambling-related harm;
• Support internal reviews and escalation processes;
• Comply with licensing requirements and regulatory audits;
• Cooperate with relevant support services or authorities where appropriate.

6.3 Access and Confidentiality

Access to responsible gambling data is not used for marketing purposes and is not disclosed to third parties except: where required by law or a competent authority; where necessary to protect the player’s vital interests; or with the explicit and informed consent of the player.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory and contractual obligations, as well as to protect our legitimate interests.

7.1 General Retention Principles

The retention period for each category of personal data is determined based on factors such as the nature of the data and the purpose for which it was collected; applicable laws (including gaming, anti-money laundering and tax legislation); the duration of the player’s relationship with us and the status of the account; and relevant statutes of limitation for potential legal claims.

7.2 Post-Account Closure

When a player account is closed, whether voluntarily or due to inactivity, we may retain certain data for a defined period to comply with record-keeping and audit requirements imposed by the Tobique Gaming Commission and applicable laws; respond to future regulatory or law enforcement inquiries; and defend against legal claims or enforce our terms and conditions.

7.3 Secure Disposal

Once personal data is no longer required, it is securely deleted, anonymized, or otherwise rendered inaccessible in accordance with internal data disposal protocols. We may periodically review retention schedules and data holdings to ensure that data is not kept longer than necessary.

8. Data Security

We implement appropriate technical and organizational measures to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, designed to ensure a level of security appropriate to the risk.

8.1 Technical Safeguards

• Data encryption during transmission and storage;
• Secure socket layer (SSL) protocols and firewalls;
• Intrusion detection and prevention systems;
• Regular vulnerability assessments and penetration testing;
• Data backup and disaster recovery protocols.

8.2 Organizational Safeguards

Access to personal data is restricted to personnel who require it for legitimate business or regulatory purposes. All employees and contractors handling personal data are subject to confidentiality obligations and receive training on data protection and information security.

8.3 Incident Response

We maintain an incident response plan to promptly address any suspected or confirmed data breaches. Where required by law, we will notify affected individuals and relevant authorities of a breach within the prescribed timeframe and take appropriate remedial action. Despite our efforts, no system can be guaranteed fully secure. Players are advised to take steps to protect their own account information, such as using strong passwords and maintaining the confidentiality of login credentials.

9. Data Sharing and Disclosure

We do not sell or rent personal data. However, we may share player information with trusted third parties or public authorities where necessary to operate our services lawfully, securely and in compliance with our regulatory obligations.

9.1 Disclosures to Regulatory and Legal Authorities

We may disclose personal data to the Tobique Gaming Commission or other applicable regulators; law enforcement, courts, or other governmental bodies in response to lawful requests; and agencies involved in AML or CTF efforts. Such disclosures are made strictly in accordance with legal and regulatory requirements and may include account details, transaction records and responsible gambling history, where relevant.

9.2 Disclosures to Service Providers

We may share data with third-party service providers who support our operations, such as payment processors and banking partners; identity verification and fraud prevention services; hosting providers, software vendors and IT infrastructure partners; and customer support, analytics and communication tools. These third parties act as data processors and are contractually bound to protect the data, use it only for authorized purposes, and implement adequate security measures.

9.3 Legal Protection and Risk Mitigation

We may disclose personal data where necessary to enforce our Terms and Conditions or investigate suspected violations; prevent fraud, abuse, or security threats; and defend against legal claims or protect the rights, property, or safety of the operator, players, or others. All data sharing is conducted in accordance with applicable privacy laws.

10. International Transfers

As part of our operational structure and reliance on third-party service providers, personal data may be transferred to, processed in, or stored in jurisdictions outside the player’s country of residence. These jurisdictions may have different data protection laws, which may not offer the same level of protection as those in the player’s home country.

10.1 Conditions for International Transfers

Where personal data is transferred internationally, we take appropriate steps to ensure that such transfers comply with applicable privacy and data protection laws. These steps may include ensuring the recipient country is recognized as providing an adequate level of data protection; entering into contractual agreements with recipients that incorporate standard data protection clauses or equivalent safeguards; and conducting due diligence on service providers’ security practices and legal obligations.

10.2 Purpose and Scope of Transfers

International transfers may occur in connection with the use of cloud hosting providers and data centres located abroad; the engagement of international fraud prevention or payment service providers; and group-wide operations or reporting, where applicable. We only transfer personal data when necessary for the provision of services, compliance with legal obligations, or the exercise of legitimate business operations.

11. Player Rights

Where relevant under the applicable legislation, players may have specific rights in relation to their personal data. We are committed to ensuring that individuals can exercise these rights in accordance with applicable laws and our obligations as a regulated gaming operator. Such rights may include:

• Right to Access — request access to their personal data, including what data we hold, how it is used, and with whom it has been shared, subject to certain legal exceptions.
• Right to Correction — request the correction of inaccurate, incomplete, or outdated personal data. We may request verification to ensure the accuracy of the update.
• Right to Erasure — subject to legal and regulatory retention requirements, request deletion where the data is no longer necessary, consent is withdrawn (where consent is the basis), or the data was unlawfully processed. This right may be limited where data must be retained for legal compliance, record-keeping, or dispute resolution.
• Right to Restriction or Objection — request the restriction of processing or object to certain uses (e.g. direct marketing), where permitted by law.
• Right to Withdraw Consent — where processing is based on consent, withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint — file a complaint with a data protection authority or privacy regulator if players believe their data has been mishandled or their privacy rights infringed.

To exercise any of these rights, players may contact us using the contact details described in Section 13. We may require proof of identity and may respond within a reasonable period, in accordance with applicable law.

12. Cookies and Tracking

We may use cookies and similar tracking technologies on our website and platform to enhance user experience, ensure platform functionality, and support analytical and marketing efforts.

12.1 What Are Cookies?

Cookies are small data files stored on a user’s device that help us recognize returning users, remember preferences, manage session security, and analyze usage patterns. There are different types of cookies, including:

• Essential cookies: necessary for core site functions (e.g. login, account navigation);
• Performance cookies: help us understand how users interact with the site;
• Functionality cookies: store user preferences and settings;
• Marketing cookies: used to deliver relevant advertisements and measure campaign effectiveness (only used with consent, where required).

12.2 How We Use Cookies

• Maintain secure player sessions;
• Remember user preferences and localization settings;
• Analyze traffic and usage trends;
• Provide relevant promotional content (where permitted by law and user consent).

12.3 Cookie Management

Players may control or disable cookies at any time through their browser settings. Most browsers allow users to refuse or delete cookies entirely. Please note that disabling essential cookies may impact the functionality of the platform. Where required by law, players will be given the option to accept or decline non-essential cookies upon visiting the site. More details are provided in our separate Cookie Policy.

13. Contact Information

For questions, concerns, or requests related to this Player Privacy and Protection Policy or the handling of their personal data, players may contact us using the details provided on our Contact page. We aim to respond to all legitimate inquiries within a reasonable timeframe, in accordance with applicable legal and regulatory requirements. To ensure the security of personal data, we may require identity verification before responding to certain requests. You can also reach our data protection officer at privacy@zplnn.st.