Player Privacy and Protection Policy

This Player Privacy and Protection Policy (“Policy”) sets out how AfriSlots (“we”, “us”, “operator”) collects, uses, discloses, stores, and protects personal data relating to individuals who access or use our gaming services. We are committed to ensuring that all personal data is handled in a lawful, fair, and transparent manner and in accordance with applicable privacy and data protection laws, including but not limited to:

• The Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada;
• Any additional provincial or territorial privacy statutes, where applicable;
• The rules and guidelines issued by the Tobique Gaming Commission;
• Our internal compliance obligations, licensing conditions, and operational risk controls.

We recognise the importance of protecting the personal and financial information of our players and of maintaining their trust. This Policy reflects our ongoing commitment to responsible data governance and privacy protection in a regulated gaming environment.

By accessing our platform or registering for an account, players acknowledge that their personal data may be processed in accordance with the terms of this Policy. The data we collect may include information necessary for identity verification, regulatory compliance (including anti-money laundering and responsible gambling obligations), transactional processing, and player support services.

This Policy applies to all player data collected through our websites, mobile applications, account registration processes, and any other interaction with our services, whether electronic, verbal, or written. It forms part of our broader player protection framework and should be read in conjunction with our Terms and Conditions, Responsible Gambling Policy, and other applicable policies and notices.

We reserve the right to update or modify this Policy from time to time to reflect changes in law, regulation, or business practices. Players are encouraged to review the most recent version regularly. Continued use of our services constitutes acceptance of the terms set out herein.

This Policy applies to all personal data collected, processed, or otherwise handled by us in connection with the use of our gaming platform and related services. It governs how we manage data obtained from players throughout their interaction with our systems, from account registration to closure, and includes both online and offline communications.

The scope of this Policy extends to:

• Individuals who register for an account or use our services, regardless of geographic location;
• Personal data submitted directly by players (e.g., during registration, payment, or support requests) or automatically collected through use of the platform (e.g., device identifiers, login data);
• Data processed for the purposes of regulatory compliance, responsible gambling, risk management, and fraud prevention;
• All data subject to disclosure under obligations imposed by the Tobique Gaming Commission, anti-money laundering (AML) regulations, or applicable laws.

This Policy also applies to data processed on our behalf by third-party service providers engaged to support our operations, such as payment processors, identity verification services, analytics platforms, and IT infrastructure providers. In all such cases, we ensure that appropriate contractual and technical safeguards are in place.

It does not apply to data collected by third-party websites or services that may be linked to or accessible from our platform. We are not responsible for the privacy practices or content of those external sites and encourage players to review their respective privacy notices.

This Policy should be read in conjunction with our Terms and Conditions, Responsible Gambling Policy, and any additional policies and notices that are available on our platform or may be presented at the point of data collection.

In the course of providing regulated gaming services, we may collect and process a variety of personal data from players. The specific categories of information we collect depend on the nature of the interaction and the services used, but may include, without limitation, the following:

3.1 Identification and Contact Data

• Full legal name;
• Date of birth;
• Residential address;
• Nationality and country of residence;
• Email address and telephone number;
• Government-issued identification documents (e.g., passport, driver's license).

3.2 Account and Transaction Data

• Username, password, and other login credentials;
• Account registration and modification history;
• Deposit and withdrawal records;
• Bonus usage and transaction history;
• Game activity, bet values, wins/losses, and session data.

3.3 Financial and Payment Information

• Payment card or e-wallet details;
• Bank account information (if applicable);
• Transaction identifiers and billing records;
• Currency preferences.

3.4 Responsible Gambling and Risk Monitoring Data

• Records of self-exclusion or time-out requests;
• Player-imposed limits (e.g., deposit, wager, or loss limits);
• Behavioural patterns identified through monitoring systems;
• Interaction logs relating to responsible gambling communications.

3.5 Technical and Usage Data

• Device identifiers (e.g., IP address, browser type, operating system);
• Geolocation data (where permitted by law);
• Log files, access timestamps, and system performance metrics;
• Cookies and tracking technologies (subject to cookie policy).

3.6 Customer Support and Correspondence

• Records of live chat, email, and telephone communications;
• Submitted documents or attachments for identity verification or dispute resolution;
• Notes or transcripts created by support personnel during service interactions.

We collect personal data either directly from the player, through use of our services, or from third-party service providers who assist with identity verification, payments, and compliance checks.

We process personal data only where we have a valid legal basis for doing so. Depending on the context, the processing of player data may rely on one or more of the following lawful grounds:

4.1 Contractual Necessity: Processing is required to establish, manage, and fulfil the contractual relationship between the player and the operator. This includes enabling account creation, processing wagers and transactions, providing customer support, and ensuring access to gaming services.

4.2 Legal and Regulatory Compliance: We are subject to various legal and regulatory obligations, including those related to anti-money laundering (AML), counter-terrorist financing (CTF), fraud prevention, responsible gambling, tax reporting, and gaming regulation under the authority of the Tobique Gaming Commission. Personal data is processed as necessary to meet these obligations.

4.3 Legitimate Interests: We may process personal data for our legitimate business interests, provided such interests are not overridden by the player's fundamental rights and freedoms. These interests may include:

• Maintaining platform integrity and cybersecurity;
• Preventing fraud and abuse;
• Improving service quality and user experience;
• Conducting internal analytics and business reporting;
• Enforcing contractual terms and conditions.

Where required, we conduct a balancing test to ensure that our interests are proportionate and respect individual privacy.

4.4 Consent: In certain situations, we may rely on the player's explicit consent, such as for the receipt of marketing communications or the use of optional cookies and tracking tools. Consent may be withdrawn at any time through the mechanisms provided on our platform.

4.5 Protection of Vital Interests: We may process personal data in limited circumstances to protect the vital interests of a player or another individual, particularly where there is a risk of harm or unlawful activity.

We use personal data only for specified, legitimate purposes and in accordance with applicable privacy laws and our licensing obligations. The data we collect may be used for the following operational and regulatory purposes:

5.1 Account Management and Identity Verification

• Registering and managing player accounts;
• Verifying identity, age, and eligibility to use the platform;
• Enforcing account security and authentication measures.

5.2 Payment Processing and Financial Operations

• Processing deposits, withdrawals, and refunds;
• Managing payment instruments and verifying payment ownership;
• Detecting and preventing fraudulent or unauthorised financial activity.

5.3 Responsible Gambling Measures

• Implementing and maintaining self-exclusion, limit-setting, and time-out requests;
• Monitoring player behaviour for indicators of potential harm;
• Communicating with players regarding responsible gambling tools and interventions.

5.4 Legal and Regulatory Compliance

• Meeting obligations under gaming, AML, and CTF laws;
• Responding to lawful requests from regulatory or law enforcement authorities;
• Maintaining audit logs, transaction records, and compliance documentation.

5.5 Customer Support and Dispute Resolution

• Responding to inquiries, complaints, or account-related issues;
• Reviewing correspondence and documentation submitted by players;
• Investigating and resolving payment or technical disputes.

5.6 Service Improvements and Analytics

• Conducting internal reporting, trend analysis, and platform optimization;
• Measuring player satisfaction and service performance;
• Developing new features and enhancing user experience.

5.7 Marketing and Communication (Where Permitted)

• Sending account-related notifications, updates, and service announcements;
• Delivering marketing messages or promotions, where legally permitted and subject to consent preferences.

We do not use personal data for purposes that are incompatible with those stated in this Policy, and we do not engage in automated decision-making or profiling with legal or significant effects on players unless permitted by law.

As part of our commitment to player protection and regulatory compliance, we collect and process certain personal data specifically related to responsible gambling. This data is treated with heightened confidentiality and is only accessed or used for appropriate operational or compliance purposes.

6.1 Types of Responsible Gambling Data

Responsible gambling data may include, but is not limited to:

• Player-imposed limits (e.g., deposit, loss, or time limits);
• Records of self-exclusion, cooling-off, or time-out requests;
• Interactions with customer support concerning gambling behaviour;
• System-detected behavioural indicators (e.g., frequent session lengths, repeated deposit attempts);
• Notes or observations recorded by trained staff during responsible gambling reviews or interventions.

6.2 Purpose of Processing

This data is processed to:

• Facilitate the application of player protection tools;
• Identify potential signs of gambling-related harm;
• Support internal reviews and escalation processes;
• Comply with licensing requirements and regulatory audits;
• Cooperate with relevant support services or authorities where appropriate.

6.3 Access and Confidentiality

Access to responsible gambling data is not used for marketing purposes and is not disclosed to third parties except:

• Where required by law or a competent authority;
• Where necessary to protect the player's vital interests;
• With the explicit and informed consent of the player.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, and contractual obligations, as well as to protect our legitimate interests.

7.1 General Retention Principles

The retention period for each category of personal data is determined based on factors such as:

• The nature of the data and the purpose for which it was collected;
• Applicable laws, including gaming, anti-money laundering, and tax legislation;
• The duration of the player's relationship with us and the status of the account;
• Relevant statutes of limitation for potential legal claims.

7.2 Post-Account Closure

When a player account is closed, whether voluntarily or due to inactivity, we may retain certain data for a defined period to:

• Comply with record-keeping and audit requirements imposed by the Tobique Gaming Commission and applicable laws;
• Respond to future regulatory or law enforcement inquiries;
• Defend against legal claims or enforce our terms and conditions.

7.3 Secure Disposal

Once personal data is no longer required, it is securely deleted, anonymized, or otherwise rendered inaccessible in accordance with internal data disposal protocols. We may periodically review retention schedules and data holdings to ensure that data is not kept longer than necessary.

We implement appropriate technical and organizational measures to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are designed to ensure a level of security appropriate to the risk.

8.1 Technical Safeguards

Our security framework may include, but is not limited to:

• Data encryption during transmission and storage;
• Secure socket layer (SSL) protocols and firewalls;
• Intrusion detection and prevention systems;
• Regular vulnerability assessments and penetration testing;
• Data backup and disaster recovery protocols.

8.2 Organizational Safeguards

Access to personal data is restricted to personnel who require it for legitimate business or regulatory purposes. All employees and contractors handling personal data are subject to confidentiality obligations and receive training on data protection and information security.

8.3 Incident Response

We maintain an incident response plan to promptly address any suspected or confirmed data breaches. Where required by law, we will notify affected individuals and relevant authorities of a breach within the prescribed timeframe and take appropriate remedial action. Despite our efforts, no system can be guaranteed fully secure. Players are advised to take steps to protect their own account information, such as using strong passwords and maintaining the confidentiality of login credentials.

We do not sell or rent personal data. However, we may share player information with trusted third parties or public authorities where necessary to operate our services lawfully, securely, and in compliance with our regulatory obligations.

9.1 Disclosures to Regulatory and Legal Authorities

We may disclose personal data to:

• The Tobique Gaming Commission or other applicable regulators;
• Law enforcement, courts, or other governmental bodies in response to lawful requests;
• Agencies involved in anti-money laundering (AML) or counter-terrorist financing (CTF) efforts.

Such disclosures are made strictly in accordance with legal and regulatory requirements and may include account details, transaction records, and responsible gambling history, where relevant.

9.2 Disclosures to Service Providers

We may share data with third-party service providers who support our operations, such as:

• Payment processors and banking partners;
• Identity verification and fraud prevention services;
• Hosting providers, software vendors, and IT infrastructure partners;
• Customer support, analytics, and communication tools.

These third parties act as data processors and are contractually bound to protect the data, use it only for authorized purposes, and implement adequate security measures.

9.3 Legal Protection and Risk Mitigation

We may disclose personal data where necessary to:

• Enforce our Terms and Conditions or investigate suspected violations;
• Prevent fraud, abuse, or security threats;
• Defend against legal claims or protect the rights, property, or safety of the operator, players, or others.

All data sharing is conducted in accordance with applicable privacy laws, and we take reasonable steps to ensure that data recipients uphold equivalent standards of protection.

As part of our operational structure and reliance on third-party service providers, personal data may be transferred to, processed in, or stored in jurisdictions outside the player's country of residence. These jurisdictions may have different data protection laws, which may not offer the same level of protection as those in the player's home country.

10.1 Conditions for International Transfers

Where personal data is transferred internationally, we take appropriate steps to ensure that such transfers comply with applicable privacy and data protection laws. These steps may include:

• Ensuring the recipient country is recognized as providing an adequate level of data protection;
• Entering into contractual agreements with recipients that incorporate standard data protection clauses or equivalent safeguards;
• Conducting due diligence on service providers' security practices and legal obligations.

10.2 Purpose and Scope of Transfers

International transfers may occur in connection with:

• Use of cloud hosting providers and data centres located abroad;
• Engagement of international fraud prevention or payment service providers;
• Group-wide operations or reporting, where applicable.

We only transfer personal data when necessary for the provision of services, compliance with legal obligations, or the exercise of legitimate business operations.

Where relevant under the applicable legislation, players may have specific rights in relation to their personal data. We are committed to ensuring that individuals can exercise these rights in accordance with applicable laws and our obligations as a regulated gaming operator.

11.1 Such rights may include:

11.1.1 Right to Access. Players have the right to request access to their personal data, including information about what data we hold, how it is used, and with whom it has been shared, subject to certain legal exceptions.

11.1.2 Right to Correction. Players may request the correction of inaccurate, incomplete, or outdated personal data. We may request verification to ensure the accuracy of the update.

11.1.3 Right to Erasure. Subject to legal and regulatory retention requirements, players may request the deletion of their personal data where: the data is no longer necessary for the purpose it was collected; the player withdraws consent (where consent is the legal basis); the data was unlawfully processed. This right may be limited where the data must be retained for legal compliance, record-keeping, or dispute resolution.

11.1.4 Right to Restriction or Objection. Players may request the restriction of processing or object to certain uses of their data (e.g., for direct marketing), where permitted by law.

11.1.5 Right to Withdraw Consent. Where data processing is based on consent (e.g., for marketing communications), players have the right to withdraw that consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.

11.1.6 Right to Lodge a Complaint. Players have the right to file a complaint with a data protection authority or privacy regulator if they believe their data has been mishandled or their privacy rights have been infringed.

11.1.7 How to Exercise Rights. To exercise any of the rights described above, players may contact us using the contact details provided in Section 13. We may require proof of identity and may respond within a reasonable period, in accordance with applicable law.

We may use cookies and similar tracking technologies on our website and platform to enhance user experience, ensure platform functionality, and support analytical and marketing efforts.

12.1 What Are Cookies?

Cookies are small data files stored on a user's device that help us recognize returning users, remember preferences, manage session security, and analyze usage patterns. There are different types of cookies, including:

• Essential cookies: Necessary for core site functions (e.g., login, account navigation);
• Performance cookies: Help us understand how users interact with the site;
• Functionality cookies: Store user preferences and settings;
• Marketing cookies: Used to deliver relevant advertisements and measure campaign effectiveness (only used with consent, where required).

12.2 How We Use Cookies

We use cookies to:

• Maintain secure player sessions;
• Remember user preferences and localization settings;
• Analyze traffic and usage trends;
• Provide relevant promotional content (where permitted by law and user consent).

12.3 Cookie Management

Players may control or disable cookies at any time through their browser settings. Most browsers allow users to refuse or delete cookies entirely. Please note that disabling essential cookies may impact the functionality of the platform. Where required by law, players will be given the option to accept or decline non-essential cookies upon visiting the site. More details may be provided in a separate Cookie Policy, where applicable.

For questions, concerns, or requests related to this Player Privacy and Protection Policy or the handling of their personal data players may contact us using the details provided on the platform. We aim to respond to all legitimate inquiries within a reasonable timeframe, in accordance with applicable legal and regulatory requirements. To ensure the security of personal data, we may require identity verification before responding to certain requests. You can also reach our data protection officer at privacy@afrislots.com.