1. Introduction & Scope

This Policy applies to all personal information processed in connection with the Irwin Casino brand, including the website at irwincasino.com and any official mobile applications, customer-support channels and marketing communications operated under the Irwin brand. It covers Canada-resident players and anyone who interacts with the brand from Canada. By creating an Irwin account, depositing funds or otherwise using our services, you agree to the practices described below. For information about how cookies and similar technologies are used, please also read our Cookies Policy. For the broader contract that governs your use of the site, see our Terms and Conditions.

• Applies to: registered players, applicants, and visitors who interact with our site (forms, live chat, cookies).
• Does not apply to: third-party sites linked from Irwin Casino — review their policies separately.
• Reading guide: this document is structured by topic. Use the on-page navigation to jump to a section.

2. Data Controller Information

The legal entity responsible for processing your personal information under this Policy is:

3. Personal Information We Collect

We collect only the personal information we need to operate a regulated gambling service, to comply with applicable law, and to provide you with a safe and personalised experience. Categories are grouped below.

3.1 Identification Data

Your name, date of birth, government-issued identification (passport, driver's licence, provincial ID), and a photo selfie used for liveness checks during KYC. We do not request your Social Insurance Number unless a specific legal obligation requires it (for example, narrow tax-reporting use cases).

3.2 Contact Data

Email address, mobile telephone number, postal address, and your preferred contact language. We use these to authenticate you, deliver service messages and — only with your consent — to send marketing communications under the CASL framework.

3.3 Financial & Transactional Data

Deposits, withdrawals, payment-method tokens, transaction history, Interac e-Transfer reference data, and cryptocurrency wallet addresses where applicable. We do not store full card numbers on our systems; full card data is handled by PCI-DSS-certified payment processors and only the masked reference is retained with your account.

3.4 Gameplay & Behavioural Data

Bets and wagers, game choices, session length, win/loss history, bonus participation, and your use of responsible-gaming tools (deposit limits, time-outs, self-exclusion). This information helps us deliver a relevant product and meet our regulatory obligations around player protection.

3.5 Technical Data

IP address, device identifier, browser type and version, operating system, time-zone, screen resolution, province-level geolocation, and cookies. See our Cookies Policy for granular detail.

3.6 Marketing Preferences

Your opt-in status, preferred channels (email, SMS, push), and your response history to past communications. Marketing is sent only after express consent under CASL and can be withdrawn at any time using the unsubscribe link in every message or your account preferences.

4. How We Collect Your Information

We collect personal information in three ways:

• Directly from you — when you register, deposit, take part in promotions, contact support, complete KYC, or use our responsible-gaming tools.
• Automatically — through cookies, server logs, device fingerprints, and analytics tools that record how you use our site.
• From third parties — including KYC and identity-verification providers, payment processors, anti-fraud screening vendors, regulators, and (where you sign in via a third party) social authentication services such as Google or Telegram.

5. Legal Basis for Processing

PIPEDA does not use the same legal-basis language as the European GDPR, but it does require that processing be reasonable, transparent and consented to. Quebec residents have additional rights under Loi 25, which requires express consent for certain sensitive uses of personal information. The table below maps how we justify each processing activity.

6. How We Use Your Information

We use the personal information described above for the following purposes:

• Creating, maintaining, securing and closing your account.
• Verifying your identity, age, source of funds and source of wealth where required by law.
• Processing deposits, withdrawals and bonuses, and reconciling your transactions.
• Operating games, recording bets, calculating settlements and detecting irregular play.
• Detecting and preventing fraud, collusion, money laundering and terrorist financing.
• Delivering customer support and managing complaints and disputes.
• Operating responsible-gaming tools, monitoring play patterns, and intervening with players showing signs of harm.
• Sending service messages (security alerts, account notifications, mandatory communications).
• Sending marketing communications, but only where you have given express consent under CASL.
• Performing analytics that help us improve product, payments, support and game selection.
• Meeting regulatory reporting obligations and responding to lawful requests from authorities.

7. Data Sharing & Third Parties

We do not sell your personal information. We share it only with vetted partners under contract, where necessary to deliver the service, comply with law or protect the integrity of our platform.

All processors operate under written data-processing agreements that require confidentiality, security safeguards, and use of personal information only for the agreed purposes.

8. International Data Transfers

Irwin is operated from outside Canada. As a result, your personal information may be hosted in or transferred to data centres in the European Union (primary) and Curaçao (disaster-recovery backup), with selected processors located in the United Kingdom, the United States and other jurisdictions in line with the recipient table above. Where we transfer personal information out of Canada, we put contractual safeguards in place, encrypt data in transit, and require recipients to provide a level of protection comparable to PIPEDA. Hosting outside Canada means that data may be subject to lawful access by authorities in those jurisdictions.

9. Data Retention Periods

We keep personal information only as long as we need it for the purposes it was collected for or as long as we are legally required to. The table below sets the baseline; longer retention may apply where dictated by law, regulatory request or an active dispute.

10. Data Security Measures

We use a layered set of controls to protect personal information against loss, theft and unauthorised access. While no online system can be guaranteed free from breach, the measures we implement are aligned with industry best practice for regulated gambling operators.

• Encryption in transit using TLS 1.2 or higher for all client-server connections.
• Encryption at rest for databases containing identification, financial and gameplay data.
• Role-based access controls with least-privilege principles and audit logging for sensitive systems.
• PCI DSS compliance for the payments infrastructure handling card data.
• Alignment with ISO/IEC 27001 information-security management principles.
• Multi-factor authentication available to players and required for staff accessing personal information.
• Vulnerability management through regular patching, third-party penetration testing and bug-bounty intake.
• Incident response procedures with timely notification to affected players and regulators where required by law.

11. Cookies & Similar Technologies

We use cookies, pixels and similar storage technologies to keep you signed in, remember preferences, measure performance, prevent fraud and (with consent) deliver marketing. You can manage these in the cookie banner at any time. For granular details, including the full cookie inventory and per-browser instructions, see our Cookies Policy.

12. Your Rights under PIPEDA

PIPEDA codifies ten "fair-information principles" that frame your rights and our obligations. They are:

1. Accountability — we are responsible for the personal information under our control.
2. Identifying purposes — we identify why we collect information at or before the time of collection.
3. Consent — your knowledge and consent are required for collection, use and disclosure, except where the law permits otherwise.
4. Limiting collection — we limit collection to what is necessary for the identified purposes.
5. Limiting use, disclosure and retention — we use information only for the stated purposes and keep it only as long as needed.
6. Accuracy — we keep your information accurate, complete and current.
7. Safeguards — we protect information with appropriate security measures.
8. Openness — our policies and practices are accessible to you.
9. Individual access — you may request access to your personal information and challenge its accuracy.
10. Challenging compliance — you may complain about how we handle your personal information.

Quebec residents — additional rights under Loi 25

If you reside in Quebec, you also benefit from rights under the provincial Act respecting the protection of personal information in the private sector (commonly called Loi 25), including:

• Data portability — the right to receive computerised personal information in a structured, commonly used format and to ask that it be transmitted to another party.
• Right to be forgotten in qualifying circumstances — for example, when information is no longer necessary, when consent is withdrawn, or when its dissemination causes serious prejudice.
• Right to refuse automated decision-making that produces legal or significant effects, and the right to know the principal factors that led to such a decision.
• Express consent for sensitive personal information, including biometric data used in identity verification.

British Columbia & Alberta residents — provincial PIPA

If you reside in British Columbia or Alberta, the provincial Personal Information Protection Acts may apply alongside PIPEDA. Your rights of access and correction closely mirror those described above, with the relevant Information and Privacy Commissioner serving as your provincial regulator.

13. How to Exercise Your Rights

You can exercise any of the rights described above by emailing [email protected] from the email address registered with your Irwin account. To protect your privacy, we will ask you to confirm your identity before we disclose any personal information. We respond within 30 days, which is the standard timeline under PIPEDA. In limited cases, where the request is unusually complex or requires extensive review, we may extend the period and will notify you of the reason.

• Requests are free of charge in normal circumstances; a reasonable fee may apply for repeated or excessive requests, as permitted by PIPEDA.
• If you ask us to delete personal information, we will do so unless we are required by law to keep it (for example, 5-year AML retention).
• If we reject a request, we will explain why and tell you how to escalate to the Office of the Privacy Commissioner of Canada or to the relevant provincial regulator.

14. Children's Privacy

Irwin Casino is intended only for adults of legal gambling age in their province (19+ in most of Canada; 18+ in Alberta, Manitoba and Quebec). We do not knowingly collect personal information from minors. If we discover that a minor has registered or attempted to register, we will close the account, delete or restrict the data subject to mandatory retention obligations, and return any deposited funds to the original payment method after standard checks.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology or legal requirements. The "Last updated" date at the top of the page shows when the document was last revised. Where changes are material — for example, where we introduce a new processing purpose — we will notify you by email and through an in-account banner before the change takes effect. Continuing to use Irwin after a change means you accept the updated Policy.

16. Contact Us & How to Complain

If you have questions about this Policy or how we handle your personal information, please contact our Data Protection Officer at [email protected]. We will do our best to resolve any concern directly. For broader account questions, visit our Contacts page.

If you remain unhappy with our response, you have the right to lodge a complaint with the appropriate regulator:

• Office of the Privacy Commissioner of Canada — federal authority for PIPEDA matters — priv.gc.ca
• Commission d'accès à l'information du Québec (CAI) — Quebec residents — cai.gouv.qc.ca
• Office of the Information and Privacy Commissioner for British Columbia — BC residents
• Office of the Information and Privacy Commissioner of Alberta — AB residents