Privacy Policy

OBSERVE: A privacy policy is required to explain how Only Win (available to Canadian visitors via onlywin-bet.ca) collects, uses, discloses, and protects personal information and to meet applicable Canadian privacy requirements (including PIPEDA and, where applicable, substantially similar provincial private-sector laws) as well as industry expectations for online gambling services.

EXPAND: This policy applies to website visitors, registered players, and anyone who communicates with us or uses services, features, or content on onlywin-bet.ca (including mobile access). Where you interact with third parties (e.g., payment providers), their privacy terms may also apply.

REFLECT: Effective date: 6 November 2026 (superseding prior versions, if any). If you do not agree with this policy, you should stop using onlywin-bet.ca and, if applicable, close your account after withdrawing available funds (subject to verification and legal obligations).

Who We Are

OBSERVE: Only Win is a brand presentation of Only Win offered to Canadian users via onlywin-bet.ca. Licensing information available to us indicates the casino operations are offered under a Curaçao framework: master license 8048/JAZ (issuing authority: Antillephone N.V.; status: valid as of 15 December 2024). A license validator link is stated to be available in the casino footer and should be clickable.

EXPAND: For privacy compliance and transparency, users should be able to identify the entity acting as "operator"/"controller" for personal information. In the provided materials, the specific owning legal entity name, legal address, and sublicense number are not publicly disclosed. This creates a transparency gap that we address by providing a direct contact channel and committing to supply corporate details upon verified request.

REFLECT: Until corporate particulars are published in the footer/legal notice of onlywin-bet.ca, the following details apply:

Operator legal name: Not specified in provided data (operating as Only Win / Only Win on onlywin-bet.ca).
Legal address: Not specified.
Registration number / tax ID: Not specified.
Licensing reference: Curaçao master license 8048/JAZ (Antillephone N.V.); Only Win operates as a sublicensee (specific sublicense details not provided).

Privacy Contact (DPO / Privacy Team)

OBSERVE: No privacy email, phone number, or contact form was provided in the supplied contact dataset; only the official website URL is listed: https://onlywin-bet.ca.

EXPAND: Canadian privacy expectations (and comparable global best practice) require an accountable contact for privacy requests and complaints. Where a dedicated DPO is not formally appointed, an internal "Privacy Team" contact should be provided.

REFLECT: You may contact our privacy function via:

Web: https://onlywin-bet.ca (use the site's support/help routes to submit a "Privacy" request).
Email: Not specified in provided data (we will provide a dedicated privacy email once published in the site's legal/footer area).
Phone: Not specified in provided data.
Postal address: Not specified (can be provided upon verified request when operator legal details are confirmed).

What Personal Data We Collect

OBSERVE: To deliver online gambling services on onlywin-bet.ca, Only Win must process identification, contact, transactional, technical, and responsible gaming/anti-fraud related data, including records required for verification and compliance.

EXPAND: Data can be collected directly (forms, account creation), automatically (device logs, cookies), and from third parties (KYC/AML providers, payment processors, fraud/identity checks), subject to lawful basis and data minimization.

REFLECT: We may collect the following categories:

Account & identity data: full name, date of birth, nationality, residential address, email address, phone number, username, account identifiers; documents and verification results (e.g., ID images, proof of address, liveness/selfie checks) where required for KYC.
Payment & transaction data: deposit/withdrawal records, payment method identifiers (e.g., masked card details, bank/PSP references), billing details, chargeback/dispute information, wallet addresses where applicable, fraud-screening flags. We do not intentionally store full payment card numbers when tokenization is used by payment partners.
Gameplay & behavioural data: betting history, game sessions, stakes, wins/losses, bonuses claimed, clicks, navigation patterns, responsible gambling settings (limits, time-outs), and communications about disputes or support cases.
Technical & log data: IP address, approximate geolocation derived from IP, device type, OS/browser, unique device identifiers, referral URLs, timestamps, error logs, authentication logs, and security events.
Marketing & preferences: subscription status, consent records, communication preferences, campaign interaction metrics (e.g., email opens/clicks where permitted), and suppression lists (to respect opt-outs).
Cookies and similar technologies: cookie identifiers, pixel tags/SDK identifiers, analytics event data, advertising identifiers (where used and permitted).

Legal Basis for Processing

OBSERVE: In Canada, lawful processing commonly relies on meaningful consent (express or implied, depending on sensitivity and context) and necessity for providing services, while gambling operations also require processing to meet KYC/AML, fraud prevention, and record-keeping expectations.

EXPAND: Because Only Win serves Canadian players via onlywin-bet.ca (including Ontario) without being listed as an iGaming Ontario operator (grey market context), transparency and consent controls are especially important for trust and risk disclosure, while still maintaining strong anti-fraud and compliance controls.

REFLECT: We process personal information under one or more of the following grounds, as applicable:

Consent: where you provide consent (e.g., marketing messages, non-essential cookies, certain analytics/advertising technologies). You may withdraw consent at any time, subject to legal/contract limits.
Contract performance: to create and manage your account, provide games and related services, process deposits/withdrawals, apply bonuses, provide customer support, and enforce terms.
Legitimate interests: to prevent fraud, secure accounts, protect platform integrity, measure and improve service performance, troubleshoot, and maintain audit trails - balanced against your rights and expectations.
Compliance with legal obligations: KYC/AML, age verification, record retention, responsible gambling measures, responding to lawful requests by competent authorities, and financial/accounting requirements.

Purpose of Processing

OBSERVE: Only Win uses personal information to deliver gambling services on onlywin-bet.ca, manage risk, and maintain security and compliance.

EXPAND: Purposes must be specific and proportionate; where new purposes are materially different, we will provide notice and, where required, obtain additional consent.

REFLECT: We use personal data for the following purposes:

Service delivery: registration, identity/age checks, account administration, gameplay functionality, bonus administration, VIP/loyalty features (if offered), and customer support.
Payments and financial operations: processing deposits/withdrawals, reconciliation, chargeback handling, fraud detection, and transaction monitoring.
Security and integrity: account security, access control, incident detection/response, prevention of collusion, cheating, and prohibited play patterns.
Compliance: AML/KYC controls, responding to lawful requests, maintaining required records and audit logs.
Service improvement and analytics: performance measurement, debugging, product improvement, and user experience optimization (with appropriate cookie controls).
Marketing (where permitted): sending newsletters, promotions, and personalized offers in line with your preferences and applicable anti-spam requirements, and maintaining consent/opt-out records.

Disclosure & Sharing

OBSERVE: Online casinos rely on vetted third parties to process payments, verify identity, provide hosting, analytics, and security services. Disclosures should be limited to what is necessary and governed by contracts.

EXPAND: Where disclosures involve sensitive information (e.g., verification documents, gambling activity), enhanced safeguards and need-to-know access are expected. Disclosures to advertising networks should be separated from essential operations and typically require consent for non-essential tracking.

REFLECT: We may share personal information as follows:

Payment partners and financial institutions: to process deposits/withdrawals, manage fraud/chargebacks, and complete reconciliation.
KYC/AML and fraud-prevention providers: for identity, age, sanctions/PEP screening, device intelligence, risk scoring, and transaction monitoring where required or proportionate.
IT and hosting/service providers: cloud hosting, content delivery networks, email delivery, customer support tooling, log management, and security monitoring - under confidentiality and security obligations.
Regulators, law enforcement, and competent authorities: where required or permitted by law, including for AML reporting or responding to binding legal requests.
Affiliates and advertising networks: only where you have provided consent for non-essential cookies/advertising technologies or where permitted under applicable law; sharing is limited to campaign measurement and attribution needs.
Corporate transactions: if the business is reorganized, merged, or sold, subject to appropriate confidentiality, notice, and lawful basis.

Regional Compliance Note (Canada): We do not sell personal information in the ordinary sense. Where "sharing" could be interpreted as cross-context behavioural advertising, we provide cookie/consent controls and honour opt-outs as required by applicable law and platform settings where technically feasible.

International Transfers

OBSERVE: Only Win operates under a Curaçao licensing framework and may use international vendors; therefore, personal information may be transferred outside Canada.

EXPAND: Under Canadian privacy guidance, cross-border transfers require transparency and appropriate contractual and technical safeguards. Users should understand that foreign jurisdictions may have different laws and access rights for authorities.

REFLECT: Your personal information may be processed in Canada and in other jurisdictions where we or our service providers operate, which may include (depending on vendor and hosting choices) the Caribbean (including Curaçao), the United States, the United Kingdom, and the European Economic Area, or other locations reasonably necessary for service delivery and security operations. Safeguards we use include:

Contractual protections: data protection clauses and confidentiality obligations with service providers; where appropriate, use of standard contractual clauses or equivalent commitments.
Security controls: encryption in transit and access controls to reduce risks during cross-border processing.
Vendor due diligence: assessing provider security posture and restricting processing to defined purposes.

Note: References to "Privacy Shield" are not relied upon as a universal mechanism; where cross-border frameworks are relevant, we use current contractual and risk-based safeguards.

Data Retention

OBSERVE: Gambling services require retention for compliance (KYC/AML, fraud prevention, financial records) and dispute handling. Retention must be limited, documented, and defensible.

EXPAND: Because specific Curaçao/AML retention rules and operational policies are not fully published in the provided data, we set clear maximum periods as a baseline and retain longer only where legally required or necessary to establish, exercise, or defend legal claims.

REFLECT: Unless a longer period is required by law or needed for legal claims, we apply the following retention approach (measured from account closure or last interaction, as applicable):

Core account & identity data: up to 5 years after account closure (to support compliance, fraud prevention, and dispute resolution).
KYC/verification records: up to 5 years after account closure or completion of verification, unless a legal obligation requires longer.
Transaction and payment records: up to 7 years (typical accounting and dispute limitation needs), subject to applicable legal requirements.
Gameplay records (betting history): up to 5 years after account closure (longer if required to investigate fraud, enforce rules, or handle disputes).
Security and access logs: typically 6 - 24 months, unless needed for incident investigation or legal claims.
Marketing preferences and consent logs: for as long as needed to demonstrate consent and honour opt-outs, typically up to 5 years after last contact or until you withdraw consent (whichever is later), subject to legal requirements.
Cookies/online identifiers: per cookie lifespan (see Cookies section) and deleted/expired automatically unless renewed by your settings/consent.

Deletion and Anonymization Criteria

OBSERVE: Users may request deletion, but gambling compliance and fraud controls can require continued retention.

EXPAND: Deletion should be operationally realistic: removing direct identifiers while retaining necessary audit records via restricted access or anonymization/pseudonymization where possible.

REFLECT: We delete or irreversibly anonymize personal information when (a) retention periods expire, (b) the purposes are fulfilled, and (c) no legal/compliance requirement applies. If deletion is not possible, we restrict access and processing to the minimum required for compliance or legal defence.

Your Rights

OBSERVE: Canadian privacy law provides individuals rights to access and correct personal information and to challenge compliance. The section request also requires alignment with GDPR-style rights and Mexican privacy law concepts; we present these as additional, best-practice rights and process commitments that we apply where legally required and, otherwise, to the extent operationally feasible without conflicting with gambling compliance obligations.

EXPAND: Users may be located in different jurisdictions; cross-border operations and grey-market access increase the need for a clear, repeatable rights-handling workflow: identity verification, scope clarification, lawful exceptions (AML/fraud), and response timeframes. For Mexico alignment, relevant references include the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and ARCO rights; for EU alignment, GDPR rights apply where GDPR is applicable (e.g., if processing targets/relates to individuals in the EEA/UK or otherwise triggers extraterritorial scope).

REFLECT: Subject to identity verification and lawful exceptions, you may request:

Access: confirmation of whether we process your data and a copy of relevant personal information.
Correction/rectification: correction of inaccurate or incomplete information.
Deletion (erasure): deletion where data is no longer needed or where consent is withdrawn, unless retention is required for AML/KYC, fraud prevention, accounting, or legal claims.
Restriction: limitation of processing in certain cases (e.g., contested accuracy) while we verify.
Objection: objection to certain processing based on legitimate interests (where applicable), including certain analytics/marketing uses.
Portability: where applicable, receiving certain data you provided in a structured, commonly used format.
Withdraw marketing consent: opt out at any time via account settings (if available) and/or unsubscribe links; we will maintain a record of your opt-out to ensure compliance.
Mexican ARCO alignment (where relevant): rights of Acceso, Rectificación, Cancelación, and Oposición as described under the LFPDPPP, handled through the same request channel and identity verification steps.

How to Exercise Your Rights (Procedure)

Submit a request: use onlywin-bet.ca support channels and clearly state it is a "Privacy Request" for Only Win.
Verify identity: we may request information sufficient to confirm you are the account holder (to prevent unauthorized disclosure).
Specify scope: tell us which right you are exercising and the data/processing you are referring to.
We respond: we aim to respond within 30 days (by 2026 standards). If more time is reasonably required due to complexity, we will explain the reason and provide an updated timeline, as permitted by law.
Fees: requests are handled free of charge unless they are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse, as permitted by law, with an explanation.

Important: We may deny or partially fulfil requests where required to comply with legal obligations (e.g., AML/KYC), to protect other individuals' rights, or to preserve evidence for disputes, fraud investigations, or security incidents.

Cookies & Tracking Technologies

OBSERVE: onlywin-bet.ca uses cookies and similar technologies to keep the site functional, secure sessions, measure performance, and (with consent where required) support analytics and advertising.

EXPAND: Consent-based cookie management is a common expectation, especially for non-essential tracking. Users should be able to change preferences and still access core services (subject to required cookies).

REFLECT: We may use:

Strictly necessary / functional cookies: required for login sessions, security, load balancing, and essential site features. These cannot typically be disabled without impairing service.
Analytics cookies: help us understand how users interact with onlywin-bet.ca (pages visited, error events, performance metrics) to improve usability and stability.
Preference cookies: remember settings such as language and display preferences.
Advertising / targeting cookies (where used): measure campaign performance and, where permitted, provide more relevant ads; generally enabled only with your consent.
Third-party cookies: set by service providers (e.g., analytics or fraud-prevention tools) that support the above purposes, subject to contracts and consent settings where applicable.

How to Manage Cookies

Browser controls: you can block or delete cookies via your browser settings (Chrome, Safari, Firefox, Edge). Blocking essential cookies may prevent login or deposits/withdrawals.
On-site controls: where available, use the cookie banner or privacy/preferences panel on onlywin-bet.ca to accept, reject, or customize non-essential cookies.
Device controls: on mobile devices, adjust advertising identifier permissions and tracking settings where supported by the OS.

Data Security

OBSERVE: Gambling platforms handle sensitive identity and financial activity data, requiring layered technical and organizational controls.

EXPAND: Security measures should address confidentiality, integrity, availability, and resilience, including incident response and vendor oversight. While certifications (ISO 27001/SOC 2) are not confirmed in the provided data, we describe controls consistent with those frameworks and state certification only "where applicable".

REFLECT: We implement measures designed to protect personal information, including:

Encryption in transit: TLS 1.2+ (or higher where supported) for connections to onlywin-bet.ca and for service-to-service communications where feasible.
Encryption at rest: encryption for sensitive data stores where appropriate, with managed key controls and rotation practices.
Access controls: role-based access, least-privilege principles, logging of privileged access, and segregation of duties for sensitive operations (e.g., payouts, KYC review).
Account security: support for multi-factor authentication (MFA) where available, credential monitoring, and brute-force protection.
Secure development & change management: patching, vulnerability management, code review practices, and environment separation (dev/test/prod) where feasible.
Monitoring & audits: security monitoring, periodic audits/assessments, and vendor risk reviews. Controls are designed to align with recognized standards such as ISO/IEC 27001 and SOC 2 principles where applicable.
Staff training: privacy/security training and confidentiality obligations for staff and contractors with access to personal information.
Incident response: documented procedures to detect, contain, investigate, and remediate incidents; where legally required, we will provide notifications to affected individuals and/or authorities within required timeframes.

Limitations: No method of transmission or storage is 100% secure. You are responsible for keeping your login credentials confidential and for using a secure device and network.

Complaints & Contacts

OBSERVE: Users need accessible channels to raise privacy concerns, request review, and escalate to supervisory bodies where applicable. Provided data lacks direct email/phone/postal details, so we provide a clear process using the official domain and identify relevant authorities.

EXPAND: In Canada, privacy complaints can be escalated to the Office of the Privacy Commissioner of Canada (OPC). In Mexico, the authority is INAI. In the EU/EEA, complaints may be made to a relevant Data Protection Authority (DPA) where GDPR applies. We must also maintain response time expectations and document outcomes.

REFLECT: To submit a complaint or inquiry for Only Win (onlywin-bet.ca):

Primary channel (web): https://onlywin-bet.ca (submit via support and label your message "Privacy Complaint" or "Privacy Request").
Email: Not specified in provided data (a dedicated privacy email will be used once published in the site's legal/footer area).
Phone: Not specified.
Postal: Not specified.

Complaint Handling Procedure

Submit details: include your account identifier (if any), issue description, relevant dates, and what resolution you seek.
Identity verification: we may verify identity to protect confidentiality.
Acknowledgement: we aim to acknowledge receipt within 7 days.
Investigation and response: we aim to provide a substantive response within 30 days. If more time is needed, we will explain why and provide an expected decision date.
Outcome: we will explain findings, actions taken (if any), and your escalation options.

Escalation to Supervisory Authorities

Canada (OPC): Office of the Privacy Commissioner of Canada - https://www.priv.gc.ca/
Mexico (INAI): Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales - https://home.inai.org.mx/
EU/EEA (DPAs): you may contact your local supervisory authority; a directory is available via the European Data Protection Board - https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

Regional Compliance Note (Ontario/Canada): Only Win is not listed in the iGaming Ontario operator directory based on the provided data (checked 15 December 2024). This privacy policy addresses data handling, but it does not provide provincial iGaming consumer protection status.

Updates

OBSERVE: Privacy practices evolve due to product changes, vendor updates, legal developments, and security requirements. Users must be informed of material changes in a timely manner.

EXPAND: Best practice is advance notice for significant changes, versioning, and clear options for users who object (e.g., withdraw consent, close account). Because contact emails are not provided, we commit to multi-channel notifications via on-site mechanisms and account dashboard, and email where available in the user account.

REFLECT: We may update this policy from time to time. Notification methods may include:

Email notice: to your registered email address (if you have an account and email messaging is operational).
Website banner: prominent notice on onlywin-bet.ca.
Account/dashboard alert: an in-account message upon login where available.

Advance notice for significant changes: for material changes that affect your rights or how we use your information, we will provide at least 30 days' advance notice (where practicable). If you object, you may withdraw relevant consents (e.g., marketing/cookies) and/or close your account after withdrawing available funds, subject to identity verification and legal retention obligations.

Last updated: November 2026

Changelog (Material Changes)

November 2026: Initial publication for Only Win on onlywin-bet.ca, including clarified cross-border transfer disclosures, a structured rights request workflow (30-day target), and defined baseline retention periods.