Privacy Policy

This Privacy Policy explains how Wolinak Casino, operating the online platform at wolinakbet-ca.com for Wolinak Casino, collects, uses, discloses, and protects personal information of its players and website visitors. It applies to all users who access, register, or use any services, content, or features provided via wolinakbet-ca.com, including those who visit the site without creating an account. By using our services, you acknowledge that your personal information will be processed in accordance with this Privacy Policy. This Privacy Policy is effective as of 01 January 2026 and remains in force until replaced or updated in accordance with the "Updates" section below.

Who We Are

Observe: Users must know the identity and contact details of the operator responsible for data processing. Expand: The operation is linked to the Grand Royal Wôlinak Casino and regulated gaming authorities in Indigenous jurisdictions within Canada. Reflect: We identify the operator, physical presence, and contact channels relevant for privacy matters.

For the purposes of this Privacy Policy, references to "Wolinak Casino", "we", "us", or "our" mean the entity responsible for operating the Wolinak Casino online services at wolinakbet-ca.com. The online operations are associated with:

• Trading/brand name: Wolinak Casino (Grand Royal Wôlinak Casino)
• Primary physical address: Grand Royal Wôlinak Casino, Route Marie-Victorin, Abenaki reserve, Bécancour, Quebec, Canada
• Ultimate beneficial owner: Abenaki Council of Wôlinak
• Gaming authorizations:
  • Wôlinak Gaming Commission licence no. WGC-OP-001 (physical casino authorization, Wôlinak Abenaki reserve, Quebec, Canada)
  • Kahnawake Gaming Commission secondary online authorization no. KGC-884 (online gambling and payment processing, Mohawk Territory of Kahnawà:ke, Canada)

Some corporate details (such as exact legal entity name, registration number, and tax identification) may be updated from time to time and will be reflected in the latest version of this Privacy Policy once formally notified by the relevant authorities or internal governance bodies.

Data Protection Contact:

• Data Protection Officer / Privacy Contact: Data Protection Department, Wolinak Casino
• Email (primary privacy contact): [email protected]
• Email (support-related privacy queries): [email protected]
• Postal contact (privacy correspondence): Data Protection Department, Grand Royal Wôlinak Casino, Route Marie-Victorin, Abenaki reserve, Bécancour, Quebec, Canada

You may contact our Data Protection Department at any time with questions or requests concerning this Privacy Policy or our handling of your personal information.

What Personal Data We Collect

Observe: Online gambling operations require identification, technical, financial, and behavioral information to comply with KYC/AML, provide services, and protect users. Expand: We must detail each category and indicate typical examples. Reflect: We explain the nature of each data category without exceeding what is necessary for our purposes.

Identification and Contact Data

• Account and identity details: full name, date of birth, gender, nationality, language preference, government-issued identification details (such as driver's licence, passport, or provincial/territorial ID), and copies or scans of such documents when required for verification.
• Contact details: email address, telephone number(s), residential address, billing address, and preferred communication language.
• Account credentials: username, password (stored in hashed form), security questions/answers, authentication tokens.

Regulatory, KYC, and AML Data

• Information required to comply with know-your-customer (KYC) and anti-money laundering (AML) legislation and Indigenous gaming regulations, such as proof of address, source-of-funds documentation, occupation, and enhanced due diligence records.
• Records of identity checks, sanctions and politically exposed person (PEP) screening results (where applicable), and verification timestamps.

Technical and Usage Data

• Technical identifiers: IP address, approximate geolocation derived from IP (city/region level where permitted by law), device identifiers, operating system, browser type and version, device model, language settings, and time zone.
• Log data: access logs, login and logout timestamps, session duration, pages viewed, referral URLs, clickstream data, error logs, and device event information.
• Security data: failed login attempts, multi-factor authentication status, device fingerprinting information, and security alerts generated by our systems.

Gaming and Behavioral Data

• Gameplay information: betting and wagering history, game preferences, game session duration, wins and losses, bonus usage, tournament participation, and responsible gambling limits set by you (deposit limits, loss limits, time-outs, self-exclusion).
• Interaction data: clicks, scrolls, in-product messages, communications via live chat or customer support channels, and feedback or survey responses.
• Risk and fraud indicators: device and account behaviour patterns, unusual activity flags, fraud investigation notes, and risk scores generated by our internal tools or third-party systems.

Payment and Financial Data

• Transaction data: payment method type (e.g., credit/debit card, e-wallet, bank transfer), masked card numbers or payment instrument identifiers, transaction amounts, currencies, timestamps, payment status, and withdrawal details.
• Account balance and history: deposits, withdrawals, bonuses credited or forfeited, loyalty points (if applicable), and chargeback or refund information.
• We do not store full card numbers or CVV codes on our own systems when this is handled by PCI-DSS-compliant payment processors; instead, we retain references or tokens necessary to process payments securely.

Communications and Support Data

• Records of communications with you, including emails, support tickets, chat transcripts, call notes, and complaint or dispute records.
• Preferences for marketing communications and notifications (opt-in/opt-out status, channels, and topics).

Cookies and Similar Technologies

• Cookie identifiers: unique IDs stored in your browser or device to recognize returning users, maintain sessions, and remember preferences.
• Tracking technologies: web beacons, pixels, tags, SDKs, and storage technologies that help us measure usage, performance, and the effectiveness of campaigns.
• For details on how we use cookies and how you can manage them, please refer to the "Cookies & Tracking Technologies" section below.

Legal Basis for Processing

Observe: For Canadian users and cross-border processing, we must identify clear legal grounds for each main processing purpose. Expand: Our operations rely on consent, contractual necessity, legal obligations, and legitimate interests aligned with gambling regulation and privacy law principles. Reflect: We link each basis to representative activities and clarify when consent is required.

Performance of a Contract

• Processing necessary to enter into and perform our agreement with you, including:
  • Creating and managing your Wolinak Casino account on wolinakbet-ca.com;
  • Providing access to casino games, sports betting, and related features;
  • Processing deposits, wagers, withdrawals, bonuses, and loyalty rewards;
  • Providing customer support and resolving operational issues or disputes.

Compliance with Legal and Regulatory Obligations

• Processing required under:
  • Applicable Canadian federal and provincial/territorial laws relevant to financial transactions, AML, and responsible gambling;
  • Regulations of the Wôlinak Gaming Commission and Kahnawake Gaming Commission, including record-keeping and reporting obligations;
  • Tax, accounting, and financial reporting requirements;
  • Obligations to respond to lawful requests from courts, law enforcement, and regulatory bodies.
• This includes verifying your identity, monitoring transactions for suspicious activity, and maintaining records for legally prescribed periods.

Legitimate Interests

• We process personal information where it is necessary for our legitimate business interests, provided these interests are not overridden by your rights and freedoms, such as:
  • Ensuring the security and integrity of our website, systems, and user accounts;
  • Preventing fraud, abuse of bonuses, collusion, money laundering, or other prohibited activities;
  • Analyzing and improving our services, user experience, and product offerings;
  • Personalizing content, recommending games, and tailoring certain communications within reasonable expectations;
  • Protecting our legal rights, pursuing or defending claims, and managing business continuity.
• Where we rely on legitimate interests, we implement safeguards such as data minimization, access controls, and appropriate retention limits.

Consent

• In specific cases, we rely on your explicit or implied consent, including:
  • Sending electronic marketing communications (email, SMS, push notifications) where required by law;
  • Using certain non-essential cookies or similar technologies for analytics and advertising;
  • Processing sensitive information (if any) for responsible gambling support, where applicable.
• You may withdraw your consent at any time (see "Your Rights" section). Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal or processing carried out on other legal bases.

Purpose of Processing

Observe: Users must understand how and why their information is used. Expand: Purposes cover service delivery, security, legal compliance, personalization, marketing, and analytics. Reflect: We describe each purpose with examples corresponding to the data categories collected.

Provision and Management of Casino Services

• Registering and verifying your account, ensuring you meet eligibility and age requirements.
• Providing access to online casino games, sports betting, and related functionality.
• Processing deposits, wagers, withdrawals, bonuses, promotional credits, and loyalty rewards.
• Maintaining accurate account balances and transaction records.

Customer Support and Relationship Management

• Responding to your inquiries, complaints, and feedback via email, live chat, or other channels.
• Recording and analyzing support interactions to improve our services and resolve issues efficiently.
• Notifying you of changes to our services, terms, or policies.

Regulatory Compliance, Fraud Prevention, and Risk Management

• Performing KYC, AML, and age verification checks and maintaining supporting documentation.
• Monitoring transactions and gameplay behavior for suspicious or high-risk activity.
• Detecting and preventing fraud, money laundering, bonus abuse, collusion, account takeover, and other unlawful or prohibited conduct.
• Complying with record-keeping, reporting, and audit requirements imposed by relevant regulators and applicable law.

Service Improvement and Analytics

• Analyzing gameplay trends, website usage patterns, and customer feedback to improve games, promotions, and user experience.
• Performing statistical, aggregated, or anonymized analysis to support business planning and service optimization.
• Testing and developing new features, functionalities, and user interface improvements.

Personalization and Marketing

• Customizing game recommendations, content, and offers based on your activity and preferences.
• Sending marketing communications (where permitted by law and your communication preferences) about promotions, new games, and special events.
• Measuring the effectiveness of marketing campaigns and adjusting them accordingly.

Security and Integrity of Our Platform

• Ensuring secure connections and protecting against unauthorized access, cyberattacks, and technical failures.
• Maintaining logs and using security tools to monitor, detect, and respond to threats.
• Carrying out internal investigations, audits, and incident response activities when necessary.

Disclosure & Sharing

Observe: Users need to know under what conditions their information may be shared. Expand: Online casinos rely on payment processors, service providers, regulators, and sometimes partners. Reflect: We specify categories of recipients, purposes, and safeguards, including restrictions on their use of data.

Service Providers and Technical Partners

• Payment processors and financial institutions: For processing deposits, withdrawals, and refunds, verifying payment methods, and preventing fraud. These partners typically act as independent controllers or processors subject to financial and privacy laws and industry standards (e.g., PCI-DSS).
• IT and hosting providers: Companies providing infrastructure, hosting, cloud storage, security, and content delivery networks for wolinakbet-ca.com.
• Customer support platforms and communication tools: Systems facilitating email, live chat, ticketing, call handling, and mass notifications.
• Analytics and performance monitoring providers: Tools used to measure website usage and performance, subject to our cookie and consent practices.

Regulators, Authorities, and Dispute Bodies

• Gaming regulators: Wôlinak Gaming Commission, Kahnawake Gaming Commission, and any other competent regulatory authorities that oversee our operations, licensing, and compliance.
• Law enforcement and public authorities: Where required or permitted by law, in response to lawful requests, subpoenas, court orders, or to protect our rights, the rights of players, or public safety.
• Dispute resolution and complaints bodies: Where you escalate a complaint to a regulator or alternative dispute resolution (ADR) body, relevant information about your account and dispute may be shared as necessary to handle the case.

Affiliates and Business Partners

• Affiliate partners: Limited information may be shared in aggregated or pseudonymized form to calculate commission or performance metrics, without disclosing unnecessary personal details.
• Marketing and advertising partners: Where you have provided consent for marketing cookies or similar technologies, certain identifiers and usage data may be shared with advertising networks and campaign management tools to deliver or measure marketing communications.

Corporate Transactions

• In the event of a reorganization, merger, acquisition, asset sale, or similar corporate transaction involving Wolinak Casino or its related entities, personal information may be transferred as part of the transaction, subject to confidentiality obligations and, where required, your consent or further safeguards.

Data Sharing Principles

• We only share personal information with third parties:
  • to the extent necessary for the purposes described in this Privacy Policy;
  • on the basis of appropriate legal grounds;
  • under contractual obligations that require them to protect your data and use it only according to our instructions or their own legal obligations.
• We do not sell your personal information to third parties in the sense of a commercial "sale" of databases for independent use, as understood in many privacy frameworks.

International Transfers

Observe: Our operations and providers may be located in different regions, which can involve cross-border data flows. Expand: While our core operations target Canadian players, some services may be hosted or supported outside Canada. Reflect: We explain where data may go and how it is protected, using industry-standard safeguards.

• Your personal information may be processed:
  • Within Canada, including the Wôlinak Abenaki reserve and the Mohawk Territory of Kahnawà:ke, where our primary gaming regulatory frameworks are based;
  • In other countries where our service providers, hosting facilities, payment processors, or support teams are located, which may include jurisdictions outside your province or territory and, in some cases, outside Canada.
• Where we transfer personal information to a country or territory that does not provide the same level of data protection as your home jurisdiction, we implement appropriate safeguards, which may include:
  • Contractual protections such as data protection agreements and standard contractual clauses (where applicable under relevant laws);
  • Technical safeguards such as encryption in transit and at rest, strict access controls, and minimization of the data transferred;
  • Organizational measures, including due diligence and ongoing oversight of service providers.
• Our contracts with key service providers require them to:
  • Process personal information only for the specified purposes;
  • Maintain appropriate security and confidentiality;
  • Assist us in complying with data protection obligations, including data subject rights where applicable.

Data Retention

Observe: Retention must balance legal requirements with minimization principles. Expand: Gambling and AML regulations often require keeping data for fixed periods. Reflect: We set category-based retention periods and define deletion criteria, subject to legal exceptions.

• General principle: We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, including to meet legal, regulatory, accounting, or reporting requirements, and then securely delete or anonymize it.

Indicative Retention Periods

• Account and identification data: Typically retained for the duration of your account and up to 5 - 7 years after account closure, depending on applicable regulatory and AML obligations in the relevant jurisdictions.
• KYC/AML and verification records: Generally retained for at least 5 years from the date of the last transaction or account closure, or longer where specifically required by gaming or AML legislation.
• Transaction and financial records: Maintained for 5 - 7 years for tax, accounting, and regulatory compliance purposes.
• Gameplay and behavioral data: Retained for the life of the account and for a limited period (typically up to 5 years) after closure, primarily for dispute resolution, regulatory review, and integrity investigations, after which it may be aggregated or anonymized.
• Marketing and communication preferences: Retained for as long as you are subscribed to marketing communications or until you withdraw consent or object to such processing, with minimal data kept thereafter to respect your opt-out choices.
• Support and complaint records: Generally retained for up to 5 years after the case is closed, or longer where necessary to establish, exercise, or defend legal claims or comply with regulatory obligations.

Deletion and Anonymization

• When personal information is no longer required, we will:
  • Securely delete or destroy it, or
  • Irreversibly anonymize it so that it can no longer be associated with an identified or identifiable person.
• Deletion may be delayed where:
  • We are required by law or regulation to retain the data for a specified period;
  • The information is needed for the establishment, exercise, or defense of legal or regulatory claims;
  • Technical limitations temporarily prevent immediate deletion, in which case we will securely store and isolate the data until deletion is possible.

Your Rights

Observe: Even though our primary regulatory framework is Canadian/Indigenous, players expect rights aligned with international standards like GDPR, and the prompt also refers to Mexican law alignment. Expand: We describe a broad suite of rights and how to exercise them, including timelines and cost. Reflect: We present a unified rights framework, with references to comparable protections under GDPR and Mexican regimes, while clarifying processes and limitations.

Overview of Your Rights

• Right of access: You may request confirmation whether we process your personal information and obtain a copy of such information, along with an explanation of how it is used.
• Right to rectification (correction): You may request that inaccurate or incomplete personal information be corrected or updated.
• Right to erasure (deletion): You may request that we delete your personal information in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected or you have withdrawn consent (where consent was the sole basis).
• Right to restriction of processing: You may ask us to limit the processing of your information in specific situations, such as while we verify its accuracy or assess an objection you have raised.
• Right to object: You may object to certain types of processing, including:
  • direct marketing at any time; and
  • processing based on our legitimate interests, on grounds relating to your particular situation, subject to legal and regulatory constraints.
• Right to data portability: Where technically feasible and legally required, you may request a structured, commonly used, and machine-readable copy of certain information you have provided to us and ask us to transmit it to another controller.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject solely to automated decisions: Where applicable, you may have the right to request human review of decisions that are based solely on automated processing and that significantly affect you, such as certain fraud checks or eligibility assessments.

How to Exercise Your Rights

1. Submit a request: You may exercise your rights by contacting us at [email protected] or [email protected]. Please clearly state:
   • your full name, account username, and contact details;
   • the right(s) you wish to exercise; and
   • any relevant details to help us locate your information.
2. Verification: For your security, we may request additional information to verify your identity before fulfilling your request, especially for access, deletion, or portability requests.
3. Response timeframe: We aim to respond to all valid requests within 30 calendar days of receipt. If we need more time due to the complexity or number of requests, we will inform you of the extension and reasons.
4. Fees: We will process your request free of charge. However, we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded, repetitive, or excessive, consistent with principles reflected in international standards such as the GDPR and comparable provisions in Mexican data protection regulations.
5. Limitations: Some rights may be limited where:
   • We must retain certain information to comply with legal or regulatory obligations (e.g., AML, gaming regulations);
   • Disclosure would adversely affect the rights and freedoms of others;
   • The request concerns privileged information or ongoing investigations.

To the extent applicable, our practices are intended to be consistent with internationally recognized privacy principles, including those reflected in the EU General Data Protection Regulation (GDPR) and comparable rights frameworks, such as those under Mexican data protection regulations, particularly in relation to transparency, access, rectification, and objection. However, your specific rights and remedies will ultimately depend on the laws of your place of residence and of the jurisdictions in which we operate.

Cookies & Tracking Technologies

Observe: Cookies are essential for operation, but non-essential tracking requires transparency and control. Expand: We categorize cookies and provide management options. Reflect: We clarify impacts of disabling cookies while allowing user choice.

Types of Cookies We Use

• Strictly necessary (functional) cookies: These cookies are essential for the operation of wolinakbet-ca.com, enabling core features such as logging in, maintaining your session, remembering your language and region settings, processing deposits and withdrawals, and ensuring security. These cookies cannot be turned off via our internal tools and are generally set only in response to actions you take that amount to a service request.
• Preference cookies: These remember your settings and choices (such as preferred language, display options, and saved details) to provide a more personalized experience on return visits.
• Analytics and performance cookies: These cookies collect information about how visitors use our website, including which pages are visited most often, how users move around the site, and whether error messages are encountered. This data is generally aggregated and used to improve the performance and usability of our services.
• Advertising and marketing cookies: These cookies or similar technologies may be set by us or by our marketing partners to build a profile of your interests based on your browsing and gameplay activity and to show you relevant advertisements on our site or on other websites. They may also be used to measure the effectiveness of campaigns.
• Third-party cookies: Some cookies are set by third-party providers (for example, analytics tools, payment providers, or embedded content services) whose services we use to enhance our platform. These third parties may use the information collected in accordance with their own privacy policies.

How to Manage or Disable Cookies

• In-browser controls: Most web browsers allow you to manage cookies through their settings, including deleting existing cookies, blocking all cookies, or limiting cookies to certain sites. Please consult your browser's help section for specific instructions.
• Internal cookie tools (if available): Where our site provides a cookie banner or preference center, you can use it to accept or reject non-essential cookies such as analytics or advertising cookies.
• Impact of disabling cookies: If you choose to disable or block certain cookies, some functionalities of wolinakbet-ca.com may not work properly, such as staying logged in, saving preferences, or processing certain transactions.

Data Security

Observe: Online gambling platforms process sensitive financial and behavioral data, requiring robust security. Expand: We describe technical, organizational, and procedural safeguards, referencing commonly recognized standards. Reflect: We emphasize protection measures while acknowledging that no system is absolutely secure.

Technical Measures

• Encryption in transit: Data transmitted between your device and wolinakbet-ca.com is protected using modern cryptographic protocols (such as TLS 1.2 or higher), helping to prevent interception or tampering.
• Encryption at rest: Sensitive information, including certain financial and authentication data, is stored using encryption and other data protection techniques.
• Access controls: We implement strict access control measures, including role-based permissions, strong authentication requirements, and logging of administrative access.
• Network and system security: Firewalls, intrusion detection and prevention systems, anti-malware tools, and security monitoring solutions are used to protect our infrastructure.

Organizational and Procedural Measures

• Security policies and training: We maintain internal policies covering data protection, information security, acceptable use, and incident response. Staff members with access to personal information receive appropriate training and are bound by confidentiality obligations.
• Vendor due diligence: We assess key service providers (including hosting, payment, and analytics partners) for their security posture and contractually require them to implement adequate safeguards, taking into account recognized frameworks such as ISO 27001 or SOC 2 where applicable.
• Incident response: We maintain procedures to detect, assess, and respond to suspected or actual security incidents and data breaches. Where required by law, we will notify affected individuals and relevant authorities without undue delay.
• Regular reviews and testing: We conduct ongoing risk assessments, security reviews, and periodic testing of our systems, including vulnerability assessments and, where appropriate, independent audits or certifications of platform providers (e.g., RNG audits by iTech Labs).

While we strive to use industry-standard safeguards to protect your personal information, no system or transmission method can be guaranteed to be completely secure. You are also responsible for keeping your account credentials confidential and for using appropriate security measures on your own devices.

Complaints & Contacts

Observe: Users require clear channels to raise concerns or lodge complaints about privacy. Expand: We provide internal escalation and external supervisory contacts. Reflect: We define procedural steps and timelines, aligning with international expectations.

Contacting Us with Questions or Concerns

• Primary contact for privacy matters:
  • Email: [email protected]
  • Support: [email protected]
  • Postal: Data Protection Department, Grand Royal Wôlinak Casino, Route Marie-Victorin, Abenaki reserve, Bécancour, Quebec, Canada

Internal Complaint Procedure

1. Submission: Send a detailed description of your concern, including any supporting evidence and your account details, to our Data Protection Department via the contact methods above.
2. Acknowledgment: We will acknowledge receipt of your complaint within 5 working days, where practicable.
3. Investigation: We will investigate your complaint, which may involve reviewing internal records, consulting relevant departments, and, where necessary, requesting additional information from you.
4. Response: We aim to provide a substantive response within 30 calendar days of receiving your complete complaint. If we cannot meet this timeframe, we will inform you of the reason and indicate when you can expect a final response.
5. Further review: If you are unsatisfied with the response, you may request that your case be escalated internally for further review by a more senior team or committee.

External Escalation to Supervisory or Regulatory Authorities

If you believe that we have not addressed your privacy concerns adequately, you may have the right to lodge a complaint with a competent supervisory authority or regulator in your place of residence or in the jurisdiction where the issue has arisen. Depending on your location and the nature of the issue, this may include, for example:

• Gaming regulator complaint channel:
  • Kahnawake Gaming Commission official complaint form: https://gamingcommission.ca/complaints
  • General information: https://gamingcommission.ca
• Data protection and privacy authorities: If you are located in a jurisdiction with a dedicated data protection authority (for example, an EU member state or Mexico), you may contact that authority following the procedures set out on its official website. For Mexico, this would ordinarily be the national data protection authority responsible for private-sector data protection matters.

Nothing in this Privacy Policy limits your right to seek other remedies under applicable law.

Updates

Observe: Privacy policies must evolve as services, laws, and technologies change. Expand: We explain how updates are communicated and how users can react. Reflect: We include version control and advance notice for significant changes.

Changes to This Privacy Policy

• We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, regulatory guidance, or technical and organizational practices.
• When we make material changes that significantly affect how we process your personal information or your rights, we will:
  • provide notice via email to the address associated with your account (where available);
  • display a prominent banner or notification on wolinakbet-ca.com; and
  • where appropriate, prompt you to review and accept the updated policy when you next log in.

Advance Notice and User Options

• For significant changes, we will, where reasonably practicable, provide at least 30 days' advance notice before the changes come into effect.
• If you do not agree with the updated Privacy Policy, you may choose to stop using our services and request account closure. In such cases, we will continue to process your personal information only as necessary to close your account and comply with legal, regulatory, and record-keeping obligations.

Version Control

• Last updated: January 2026
• Any previous versions of this Privacy Policy may be made available upon request to our Data Protection Department.
• Where relevant, we may maintain a brief changelog summarizing material updates, such as:
  • clarifications of data categories and retention periods;
  • additions of new service providers or categories of recipients;
  • changes in contact details or regulatory references.

By continuing to access or use wolinakbet-ca.com after the effective date of any updated Privacy Policy, you acknowledge that your personal information will be processed in accordance with the updated version.