Privacy Policy

What data is collected at each stage of the player journey

The data collection footprint at WOW Vegas is concentrated in four distinct stages. At account creation, the platform collects email, date of birth, password (hashed at the device, never transmitted in plain text), province of residence, and the device fingerprint of the registering browser or mobile device. At first deposit, it collects payment-method tokens (card numbers are not stored — only the tokenized references from the processor) and the billing address associated with the payment method. At first redemption, it collects Tier 1 KYC documents (government ID image, selfie, verification metadata). At higher redemption tiers, Tier 2 and Tier 3 add proof-of-address documents and, at Tier 3, source-of-funds declarations.

The platform does not collect biometric data beyond the live selfie used for the KYC liveness check. The selfie is processed by the KYC partner, encrypted at rest, and accessed only on review requests. The platform also does not collect any geolocation data beyond the IP-derived province inference that the Canadian-only promotions gate against. The full data inventory is documented in the privacy policy text earlier on this page and the independent operator audit confirms the inventory matches actual platform behaviour through 2026.

Retention windows and the data deletion right

Canadian privacy law (PIPEDA federally and provincial equivalents) gives players the right to access their data and request deletion. Most data categories at WOW Vegas are deletable on request, with two notable exceptions: KYC documents are retained for the regulatory minimum of 7 years from the last redemption to satisfy AML record-keeping requirements, and transactional records are retained for the same period for the same reason. Marketing-preference data, session logs, and gameplay history are deleted on request within 30 days of submission. The deletion request flow is in Account → Privacy → Request My Data and is straightforward — no support call required.

Third-party data sharing and the absence of advertising sharing

WOW Vegas does not share player data with advertising networks. The platform does not run programmatic ads, does not embed ad pixels, and does not sell or rent the player database to any third party for advertising or marketing purposes. Three categories of third-party sharing do exist and are limited to operational necessity: payment processors (card tokens passed to Stripe and Interac for transaction settlement), the KYC verification partner (Onfido handles the ID-document review), and the customer-support platform (Zendesk for ticket management). Each third party operates under a data-processing agreement that prohibits secondary use of the shared data.

Cookies, tracking pixels and the first-party-only approach

The web client uses first-party cookies for session management and player preference storage. There are no third-party tracking pixels (no Facebook Pixel, no LinkedIn Insight, no Twitter conversion tracker). The analytics stack runs on a privacy-preserving first-party tool that records aggregate session metrics (page-load timing, lobby filter usage, broad navigation patterns) but does not produce individual-player browsing trails. The cookie banner respects the Canadian implied-consent model rather than the more aggressive EU GDPR-style banners — practical for Canadian users, transparent about what each cookie does.

How marketing preferences work and the unsubscribe mechanics

Promotional emails are sent under express consent collected at sign-up, with each email containing an unsubscribe link as required by Canadian Anti-Spam Legislation. The Account → Preferences panel toggles email categories independently: drop alerts, weekly tournament reminders, seasonal events, VIP host messages and transactional notices can each be enabled or disabled separately. Transactional emails (security alerts, KYC notifications, redemption receipts) cannot be disabled because they are required for account security and compliance. The full Canadian unsubscribe regime is documented on the platform terms of use page.

Children and the under-18 protection layer

WOW Vegas is strictly age-gated at sign-up. The age confirmation step blocks any registration with a date of birth indicating under-18 (or under-19 in the stricter provinces). The KYC document review at first redemption provides a second age-verification checkpoint that catches any falsified date entered at registration. If a parent or guardian discovers an underage account has been created — typically by a teenager using a parent's identity — the platform's support team can verify the situation through documentation and remove the account along with any account history. The responsible play protections page covers parental control software the platform supports.

Cross-border data flows and where servers are located

Canadian player data is processed primarily on Canadian and US data centre infrastructure. The platform's KYC partner and card processor each route some data through US servers, which is disclosed in the privacy policy and is consistent with PIPEDA's cross-border transfer guidelines. The platform's transparency report includes a regional breakdown of data residency by category. Canadian players have the right to request a current data-residency report at any time through the privacy contact email listed on this page.

Security controls — encryption, access management, audit logging

The platform encrypts data at rest using AES-256 and in transit using TLS 1.3. Access to Canadian player data is restricted by role-based access controls with audit logging on every administrative action. The full security control inventory is reviewed annually by an independent third-party auditor; the 2026 audit was completed in March and the summary findings are public in the operator transparency report. The independent platform audit verified the security controls against published expectations during our six-month evaluation window.

Your rights as a Canadian player under PIPEDA

Canadian players have five enumerated rights: the right to access your data, the right to correct inaccuracies, the right to delete (within regulatory exceptions noted above), the right to withdraw consent for non-essential data uses, and the right to file a complaint with the Office of the Privacy Commissioner of Canada if you believe the platform has mishandled your data. The platform's privacy contact responds to access requests within 30 days as required by law. The contact details and request procedure are on the main privacy policy text above the extended notes here.

The privacy practices summary in plain language

WOW Vegas collects the data needed to run a sweepstakes casino that complies with Canadian regulations: an account identity, payment data for purchases, KYC documents for redemptions, and operational analytics to keep the platform running. It does not share that data with advertisers, does not run third-party tracking pixels, and does not collect biometric information beyond the KYC liveness selfie. Sensitive data is encrypted, access is logged and audited, and you can delete most categories on request. For payment and KYC specifics see the payment rails and KYC tiers reference; for the broader operator assessment see the audit summary; for the rest of the platform start at the WOW Vegas Canada home page. The platform's commitment is summarized further in the responsible-play and privacy intersection notes and the site author's editorial standards.

Data subject access requests — the formal process

Canadian PIPEDA gives you the right to receive a complete copy of the data the platform holds on your account. The request flow is: Account → Privacy → Request My Data → confirm identity via authenticated email → receive a packaged data export within 30 days. The export includes the account profile, payment-method tokens (not card numbers), redemption history, promotional history, session metadata, KYC document references, and the marketing-preference history. The export format is a zipped JSON archive with a human-readable summary PDF. There is no charge for the request and you can submit one every 12 months without restriction.

Correction requests and how factual errors are resolved

If the data on file contains a factual error — wrong date of birth, misspelled name, incorrect province — the correction flow runs through the support team with supporting documentation. Corrections to KYC-bound fields (name, DOB) require matching new ID documents; corrections to non-bound fields (preferences, email) can be done in Account Settings without verification. Most corrections complete within 5 business days. The account recovery procedures page covers how corrections interact with account security.

Audit and assurance — the third-party privacy review

An independent third-party privacy auditor reviews the platform's PIPEDA compliance annually. The 2026 audit was completed in February by an Ontario-licensed information-governance firm and confirmed compliance across the 10 fair-information principles. The summary findings are published in the operator transparency report alongside the security audit findings. The independent platform audit confirms the privacy practices match the documented policy during our six-month evaluation window.

Data minimization and the retention philosophy

The platform's data-handling philosophy aligns with PIPEDA's data-minimization principle: collect only what's needed, retain only as long as needed, and delete proactively when retention windows expire. The 7-year KYC retention is the regulatory minimum and is the longest window. Marketing data deletes after 24 months of inactivity; session logs delete after 12 months; gameplay history is aggregated into anonymized analytics after 18 months. The platform terms of use and the formal privacy policy above this appendix reference the same windows in the regulatory language.

Children's privacy and the COPPA-equivalent posture

The platform does not target users under the age of majority and applies the multi-layer age-gating described elsewhere on this site to prevent under-age account creation. If a parent or guardian discovers an under-age account, the support team will close it and purge associated data on receipt of the parent's identity verification. Canadian privacy law does not have a direct COPPA equivalent but PIPEDA's principles apply consistently to all individuals including minors. The parental control resources page lists the practical tools parents can deploy on family devices.

Breach notification — what happens if something goes wrong

The platform's breach-response procedure follows PIPEDA's mandatory breach-notification requirements: a real risk of significant harm triggers notification to the Office of the Privacy Commissioner and to affected individuals within a reasonable time after the breach is discovered. The platform has not had a notifiable breach in its operational history. The breach-response framework is published in the operator transparency report and the audit summary. The main WOW Vegas Canada page and the site editorial standards describe how we cover any future incidents.