Sportzino Privacy Protocol

Sportzino Casino Canada prioritizes the encryption and safekeeping of all player telemetrics and demographic PII. We enforce stringent data-storage siloing methodologies in compliance with federal Canadian PIPEDA regulations.

Data Collection Vectors

We log initial device parameters necessary for PWA optimal routing, KYC processing document vectors (stored temporarily during identity confirmation via third-party secure APIs), and generalized navigational tracking solely for UX enhancements.

Framework of Sportzino Data Handling

Sportzino Casino Canada handles player data under the framework of the federal Personal Information Protection and Electronic Documents Act (PIPEDA), the substantially-similar provincial privacy statutes in Alberta, British Columbia and Quebec (where applicable), and the internal Sportzino Data Discipline, a set of operational commitments that goes beyond the statutory minimum. The Data Discipline codifies four commitments: minimum-viable collection, purpose-bound retention, cryptographic segregation of sensitive fields, and radical transparency in the data-access report available to every player on request. This privacy note walks through each commitment in enough detail that a technically-literate player can independently verify the platform's posture, and every clause is cross-referenced with the operational surface where the corresponding data actually flows.

The data the platform holds falls into six categories: identity data (name, date of birth, government identifier), contact data (email, mobile, civic address), authentication data (credential hashes, MFA seeds, device fingerprints), transactional data (wagers, spins, tickets, redemptions), behavioural telemetry (session length, cabinet preferences, promotional engagement), and communication data (support tickets, marketing consents). Each category is retained under a different rule, encrypted with a different key schedule and subject to a different deletion cadence, which is why any conversation about "what does Sportzino know about me" must start with a category-by-category breakdown rather than a single blanket answer.

Data Collection Vectors

The platform collects data through three explicit vectors: forms you complete, automatic telemetry generated by your device during a session, and third-party services acting on the platform's behalf. Form data is the most transparent; you always know what you have typed and why. Automatic telemetry is more subtle, though the platform publishes a plain-language telemetry manifest inside the settings drawer that names every field the client transmits. Third-party services are limited to the KYC verification provider, the payment rails, the SMS aggregator that delivers MFA codes, and a small handful of infrastructure vendors listed in the transparency ledger. Every third-party vendor is bound by a written data-processing agreement that mirrors the internal Data Discipline commitments.

Notably absent from the data-collection surface is any form of cross-site behavioural tracking. Sportzino does not embed advertising pixels, does not sell player data to any external marketing broker, does not enrich player profiles with commercially-purchased demographic data, and does not participate in any device-graph identity network. The platform's marketing acquisition is based entirely on first-party outreach and organic referrals, which is why the promotional shelf described on the Sportzino promotional shelf privacy characteristics feels quiet compared to less-disciplined competitors. That quietness is a deliberate consequence of the data discipline.

Cookies, Local Storage and Similar Technologies

The Sportzino web surface uses a small number of first-party cookies and a modest amount of local storage. The cookies are limited to session tokens (HttpOnly, Secure, SameSite=Strict), a preference cookie storing UI settings, and a consent cookie recording the player's choice regarding non-essential telemetry. Local storage carries the pre-cached shell described on the Sportzino mobile silence contract for push notifications page and a small keyboard-shortcut memory. IndexedDB is used for the game asset cache. No third-party analytics tag, advertising pixel or fingerprinting library is loaded by the platform.

The consent banner on first visit is a genuine opt-in, not a dark-pattern nudge. Declining non-essential telemetry disables session-level analytics but preserves every operational function of the platform. The consent preference can be revisited at any time inside the settings drawer; changing it triggers an immediate re-evaluation of the current session and, where necessary, an audit trail entry describing the change.

Player Rights and the Data Access Report

Under PIPEDA every player has the right to know what data the platform holds about their account, to correct any inaccurate data, and to request deletion within the constraints of the platform's legal retention obligations. Sportzino operationalises those rights through the data-access report described on the Sportzino privacy officer direct contact channel page. The report is a signed PDF delivered inside 24 hours of a validated request and covers every category of data the platform holds about the requesting player. Requesting the report is free of charge; players can request one report per rolling three-month window without any friction.

Deletion is subject to statutory retention: transactional data must be retained for seven years under Canadian anti-money-laundering rules, and identity data must be retained for at least two years under Canadian sweepstakes compliance. Anything outside those statutory windows can be deleted on request, and the platform commits to executing a valid deletion request inside 30 calendar days. The deletion is cryptographic — the affected records are shredded with the associated encryption keys — which means a deletion cannot be reversed even by the platform itself once it has executed.

Security Posture in Practice

The Sportzino security posture is built on defence-in-depth. At the network edge the platform runs a WAF with a bespoke ruleset tuned against the sweepstakes-industry attack profile. At the application layer every service enforces strict input validation and output encoding to eliminate the OWASP top ten by construction. At the data layer every sensitive field is encrypted at rest with a hardware-security-module key that never appears in plaintext outside the HSM. At the operational layer the platform runs continuous vulnerability scanning against every service, plus a quarterly third-party penetration test whose findings are published in a summary form inside the compliance transparency ledger. The Sportzino compliance function is proud of the posture and welcomes any player question about it.

If you have any privacy-related question the fastest path is the Sportzino Canadian client support desk. If you would like to explore the platform first, the Sportzino Canada home page for continued browsing is one tap away. Play responsibly, and remember the settings drawer is always the fastest path to a firm safeguard.

Contact the Privacy Officer

The designated Sportzino Privacy Officer is reachable directly at [email protected] and responds to substantive privacy inquiries inside a 48-hour SLA regardless of tier. If you have exhausted the internal privacy channel and remain unsatisfied, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada, whose contact details are published on the federal government website. The Sportzino compliance function will cooperate fully with any privacy investigation without ever attempting to characterise the player negatively; the platform believes the availability of an independent regulator is a structural feature of the Canadian privacy system that benefits everyone, including the platform itself.

International Data Transfer and Regional Storage

Sportzino Canadian player data is stored primarily in Canadian data centres, with a specific carve-out for the KYC micro-service which is co-located with the identity-verification vendor's Canadian facility to minimise document round-trips. Backups are retained in encrypted form inside a separate Canadian region to satisfy business-continuity requirements. No player data is transferred outside Canada except in the two specific scenarios documented below: fraud investigations that require correlation with international payment-rail data, and regulator-mandated transfers to a bilateral information-sharing partner. Both scenarios are governed by written data-transfer agreements that mirror the internal Data Discipline commitments.

The two scenarios are exceedingly rare. Fraud correlation transfers happen only when the platform has already identified a specific fraud pattern that involves a foreign counterparty, and the transfer covers only the specific transactional data needed to complete the correlation. Regulator-mandated transfers happen only when a foreign regulator with a bilateral information-sharing agreement requests specific data about a specific player under a documented investigation. Both scenarios are logged in the compliance transparency ledger with the destination country and the categorical description of the data transferred, so any player can inspect the transfer history through the standard data-access report.

Incident Response Discipline

The Sportzino incident-response discipline commits the platform to a strict 72-hour notification window for any confirmed data incident that affects Canadian player data, mirroring the PIPEDA breach-notification obligation. The notification includes the categories of data affected, the operational remediation completed, and the specific actions the affected player can take to protect their account. Every incident is followed by a written post-mortem published inside the compliance transparency ledger with a public-facing summary; the underlying operational detail is available on request to any regulator with jurisdiction. The platform has published two post-mortems in its operational history, both for near-misses that produced no confirmed data exposure but that met the internal disclosure threshold under the Data Discipline.

Marketing, Consent and the Silence Contract

The Sportzino marketing surface is deliberately restrained. Every marketing communication — email digest, push notification, in-app banner — respects the Silence Contract described on the portable Sportzino Canadian companion application page. Marketing consents are collected on registration in a granular fashion: separate opt-ins for email, push and in-app placement, none of them default-on. The consent state is stored inside the profile and can be inspected or changed at any moment through the settings drawer. Withdrawing a consent takes effect immediately across every downstream marketing system, and any communication already in flight at the moment of withdrawal is stopped before delivery.

Marketing content is authored by the internal Sportzino promotional team and never outsourced to a third-party marketing agency. Every piece of copy is reviewed against the responsible-gaming checklist before it goes live, which is why the tone is consistently informational rather than urgency-driven. Players who prefer to opt out of every marketing channel entirely can do so with a single toggle; the operational communications (transaction confirmations, KYC reminders, cash-out receipts) are always delivered regardless of marketing preference because they are not marketing.