How we handle your personal information

Who we are

This site is operated by Crown DK CAN Ltd, registered with the Alcohol and Gaming Commission of Ontario (AGCO) under Internet Gaming Operator Registration AGCO Internet Gaming Operator Registration OPIG1238029. We decide why and how your personal information is handled, which makes us accountable for it.

Our Privacy Officer can be reached at privacy@casinodraftkings.com.

The law we work under

We handle personal information under Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), together with the requirements the AGCO places on registered internet gaming operators.

Some information we hold is not ours to delete on request. Verification and transaction records must be retained under gambling and anti-money-laundering rules, including the reporting obligations administered by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). Where that applies, we say so rather than implying a choice you do not have.

Registration data

Your legal first and last name, date of birth, residential address in Ontario, email address, optional telephone number, and the password you choose. Your password is stored only as a one-way hash: we cannot read it, and neither can anyone who obtains the file.

Why: to create and administer your account, to establish that you are eligible to hold one, and to contact you about it.

Contact data

Your email address and telephone number, plus the content of messages you send us through the contact form or by email, and our replies.

Why: to answer you, to keep a record of what was asked and answered, and to handle complaints. Support correspondence is kept so that a dispute can be reviewed later, including by the regulator.

Identity verification

Images or data from a government-issued identity document, the details extracted from it, and the result returned by the verification provider we use.

Why: to confirm you are who you say you are before real-money play. This prevents under-age play and account takeover, and it satisfies anti-money-laundering obligations. Verification is a condition of our registration, so we cannot waive it and still let you play.

Age verification

Your date of birth as declared, and as confirmed against your identity document.

Why: the minimum age for online gambling in Ontario is 19. If the confirmed date of birth shows you are under 19, the account is closed, any deposit is returned to its source, and we retain the fact of the refusal so the account cannot simply be opened again.

Geolocation data

This deserves its own explanation, because it is the most sensitive category we touch.

Why we need it

Ontario law permits us to offer real-money play only to people who are physically located in Ontario at the time they play. Your address does not establish that. Only a live position does.

How the check works

When a location check is required, your browser asks your permission to share its position. If you allow it, your device reports a latitude, longitude and an accuracy radius. Those values are sent to our server over HTTPS, and the server tests whether the position falls inside the boundary of Ontario. The test happens on our server, not in your browser, because an answer computed on your device could be altered on your device.

What we keep, and what we do not

We keep the verdict of the check (passed, failed, refused, or not precise enough), the time it was made, and the time it expires. We do not write your coordinates to disk, and we do not build a history of where you have been. The coordinates exist in memory only for as long as it takes to answer inside or outside.

If you refuse

Refusing the browser permission is a valid choice and we record it as a refusal rather than treating it as a failure. The consequence is simply that real-money play stays unavailable. Every informational page on this site remains open to you.

Limits of the method

Browser geolocation is not a certified location service, and it can be wrong near a provincial border. If a check cannot be made confidently, we decline rather than guess.

IP address

The network address your requests arrive from, and what it indicates about country and region.

Why: security, rate limiting, fraud detection, and as a secondary signal alongside the geolocation check. An IP address alone is not accurate enough to establish that you are in Ontario, so we never rely on it as the location check.

Device and browser data

Browser type and version, operating system, screen characteristics, language, and a derived fingerprint used to tie a session to the device that started it.

Why: to render the site correctly, to diagnose faults, and to detect a session being replayed from somewhere it did not originate.

Payment information

The payment method you use, the name it is registered to, a masked identifier such as the last digits of a card, and the outcome of each attempt.

Why: to process deposits and withdrawals, to confirm the method belongs to you, and to return withdrawals to their source. Full card numbers are handled by the payment provider and are not stored on our systems.

Transaction history

Deposits, withdrawals, bets placed, results, balance movements and the limits in force at the time.

Why: to run your account, to show you your own history, to enforce the limits you set, and to meet record-keeping obligations. This is one of the categories we must retain for a fixed period regardless of a deletion request.

Cookies

Cookies and similar storage, in the categories set out in our Cookie Policy. Only strictly necessary cookies run before you make a choice.

Analytics

Aggregate measurement of how the site is used, gathered only with your consent. Analytics are used to improve pages, not to profile you individually or to decide what you are offered.

Fraud prevention

Signals such as failed sign-in attempts, unusual patterns of play or payment, duplicate account indicators, and the outcomes of checks we run.

Why: to protect players and the integrity of the games. This also supports responsible gambling: the same monitoring that detects fraud is what surfaces patterns of play associated with harm, which we are required to watch for.

Marketing and CASL

We send commercial email only where you have given express consent, as Canada's Anti-Spam Legislation (CASL) requires. Consent is requested separately at registration, is never pre-ticked, and is not a condition of opening an account.

Every message includes a working unsubscribe link and our identity. You can withdraw consent at any time in your account or by using that link, and we act on it promptly. Self-exclusion removes you from marketing automatically.

Service providers

We share personal information with third parties only where necessary:

• Identity verification providers — to confirm your identity and age.
• Payment providers and banks — to move money in and out.
• Game suppliers — to deliver the games you play.
• Hosting and infrastructure providers — to run the site.
• Analytics providers — only with your consent.
• Professional advisers — legal, accounting and audit.

Each is bound by contract to use the information only for the purpose we specify and to protect it to a comparable standard. We also disclose information where the law requires: to the AGCO and iGaming Ontario (iGO), to FINTRAC, to law enforcement acting under proper authority, and to the operators of a centralized self-exclusion programme so that an exclusion registered elsewhere is honoured here.

We do not sell your personal information.

Some providers operate outside Canada. Where information is processed in another country it is subject to that country's laws, including lawful access by its authorities. We choose providers that offer comparable protection and bind them contractually.

Storage, retention and protection

Information is transmitted over HTTPS and held on access-controlled systems. Passwords are stored as one-way hashes. Access is limited to staff who need it, and administrative actions on accounts are logged.

We keep personal information only as long as needed for the purpose it was collected, and then for any additional period the law requires. In practice that means account, verification and transaction records are retained for a fixed period after your account closes, under gambling and anti-money-laundering record-keeping rules, after which they are deleted or anonymised. Support correspondence is kept for a shorter period.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Your rights

• Access — ask what we hold about you and get a copy.
• Correction — have inaccurate or incomplete information fixed.
• Withdraw consent — for anything based on consent, such as marketing or analytics. Withdrawing consent for something legally required to operate your account means we can no longer offer you the account.
• Deletion — ask for deletion, subject to the retention obligations above. We will tell you specifically what we must keep and why.
• Complain — to our Privacy Officer first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

We respond to access requests within 30 days. We will ask you to verify your identity first, so that nobody else can obtain your information by asking for it.

Contacting our Privacy Officer

Write to privacy@casinodraftkings.com, or by post to Crown DK CAN Ltd, 222 Berkeley Street, Boston, MA 02116, United States.

If we change this policy we will update the date at the top, and we will tell you directly if the change materially affects how your information is used.