This Privacy Policy explains how personal information is collected, used, disclosed, and retained by Thunder Bay in connection with access to and use of its online casino and betting services in Canada. By using the services, you acknowledge that you have reviewed and understood this policy. If you do not agree with any part of this document, use of the services should be discontinued.
This policy applies to all personal information processed by Thunder Bay in connection with account registration, identity verification, gameplay activity, financial transactions, and communications.
1. Legal Framework
Thunder Bay operates in accordance with applicable Canadian privacy legislation. Depending on the province in which you reside, your personal information may be governed by federal legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), and/or by applicable provincial privacy laws. Where Thunder Bay operates within a provincially regulated framework, additional obligations imposed by the relevant provincial regulator also apply.
Users located in Ontario should be aware that regulated online gambling operators in that province are required to share certain gaming and transactional data with iGaming Ontario and the Alcohol and Gaming Commission of Ontario (AGCO) under the terms of their operating agreements. This sharing is a regulatory requirement and is not subject to individual opt-out.
2. Information Collected
Thunder Bay collects personal information that is necessary to provide regulated gambling services, verify user identity, prevent fraud, and comply with legal obligations. The categories of information collected include the following:
- Identity and contact information: full legal name, date of birth, residential address, email address, and telephone number.
- Verification documents: government-issued identification, proof of address, and any additional documentation required to confirm age, identity, or residency.
- Account and activity data: login credentials, account preferences, session history, gameplay records, wagering activity, and responsible gambling settings.
- Financial and transaction data: deposit and withdrawal records, payment instrument details as required for processing, and transaction timestamps.
- Device and technical data: IP address, device identifiers, browser type, operating system, and connection data collected automatically when you access the services.
- Communications data: records of correspondence with support, including the content and timing of messages.
3. Use of Personal Information
Thunder Bay uses collected personal information for the following purposes:
- To verify identity and confirm that age and residency requirements applicable in the relevant province are met.
- To create, maintain, and administer user accounts.
- To process deposits, withdrawals, and related financial activity.
- To detect, investigate, and prevent fraud, money laundering, and other prohibited conduct.
- To comply with regulatory and reporting obligations, including those imposed by provincial gaming authorities.
- To administer responsible gambling tools, including self-exclusion programs and account restrictions.
- To respond to support requests and resolve account-related disputes.
- To send service-related communications, including account notices, security alerts, and policy updates.
Personal information is not used for purposes that are incompatible with those listed above without first obtaining consent or as otherwise permitted by law.
4. Disclosure of Personal Information
Thunder Bay does not sell personal information to third parties. Personal information may be disclosed in the following circumstances:
- To regulatory authorities: where required by an operating agreement or applicable law, gaming and transactional data may be shared with the relevant provincial gaming regulator and oversight body.
- To service providers: third-party processors may be engaged for identity verification, payment processing, fraud detection, and technical infrastructure. These processors are contractually bound to handle personal information only as directed by Thunder Bay and in accordance with applicable privacy law.
- To law enforcement or legal authorities: where required by a valid legal order, warrant, or statutory obligation.
- In connection with a corporate transaction: if Thunder Bay undergoes a merger, acquisition, or restructuring, personal information may be transferred as part of that transaction, subject to equivalent privacy protections.
5. International Data Transfers
Personal information collected by Thunder Bay may be stored or processed outside of Canada. Where this occurs, reasonable steps are taken to ensure that the receiving jurisdiction or processor provides a comparable level of protection. However, personal information stored abroad may be subject to the laws of that jurisdiction, including lawful access by foreign authorities.
6. Data Retention
Thunder Bay retains personal information for as long as necessary to fulfill the purposes described in this policy, to comply with legal and regulatory retention requirements, and to resolve disputes or enforce applicable terms. When personal information is no longer required, it is securely deleted or anonymized in accordance with internal data management procedures.
Regulatory requirements in Canada’s gaming sector may impose minimum retention periods for certain categories of data, including identity verification records and transaction histories. These requirements take precedence over any shorter retention period that might otherwise apply.
7. Your Rights
Subject to applicable law, you have the right to request access to the personal information held by Thunder Bay about you, to request correction of inaccurate or incomplete information, and to withdraw consent where processing is based on consent and withdrawal does not conflict with a legal or regulatory obligation.
To exercise any of these rights, a written request should be submitted to the designated privacy contact of Thunder Bay. A response will be provided within the timeframe required by applicable law. In some cases, a request may not be fulfilled where doing so would conflict with a regulatory obligation or where the information is required for the resolution of an ongoing dispute.
8. Cookies and Tracking Technologies
Thunder Bay uses cookies and similar tracking technologies to support the technical operation of the services, maintain session integrity, and collect aggregate usage data. Browser settings may be adjusted to limit or refuse cookies, but doing so may affect the functionality of certain features. Tracking technologies are not used to build advertising profiles or to share behavioral data with advertising networks.
9. Security
Thunder Bay applies technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and loss. These measures are reviewed and updated on a regular basis. However, no transmission over the internet or electronic storage system is entirely secure, and absolute security cannot be guaranteed. In the event of a data breach that poses a real risk of significant harm, affected individuals and the relevant regulatory authority will be notified as required by law.
10. Changes to This Policy
Thunder Bay may update this Privacy Policy from time to time to reflect changes in practices, services, or legal obligations. When material changes are made, registered users will be notified through the contact information associated with their account or by posting a notice within the account interface. Continued use of the services following notification of changes constitutes acceptance of the revised policy.
11. Contact
Questions about this Privacy Policy, requests to exercise a privacy right, or concerns about the handling of personal information should be submitted in writing to the Thunder Bay privacy contact or privacy team.
If a response is not considered satisfactory, the concern may be escalated to the Office of the Privacy Commissioner of Canada or to the applicable provincial privacy authority in the relevant jurisdiction.