Privacy Policy

Version: 1.0  |  Last Updated: November 3, 2026

1. Introduction

Welcome to Iris Casino ("we", "us", or "our"), operated through the website theiriscasinos.com (the "Platform"). We are committed to safeguarding the privacy and personal information of every individual who accesses or uses our services. This Privacy Policy ("Policy") describes what personal data we collect, the purposes for which we use it, the legal bases on which processing rests, the parties with whom we may share it, and the rights available to you under applicable privacy legislation.

This Policy forms part of a suite of governing documents that includes our Terms and Conditions and our Responsible Gaming Policy. By registering an account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, please discontinue use of the Platform immediately.

This Policy applies to all users located in Canada and to all personal data collected via the Platform, regardless of the device or channel used to access our services.

2. Data We Collect

We collect personal data that you provide directly to us, data generated automatically through your use of the Platform, and data received from trusted third parties. The categories below outline the specific types of information involved.

2.1. Information You Provide Directly

• Registration data: Full legal name, date of birth, email address, residential address, telephone number, username, and password chosen during account creation.
• Identity verification documents: Government-issued photo ID (such as a passport or driver's licence), proof of address (such as a utility bill or bank statement), and, where required, source-of-funds documentation to comply with anti-money laundering obligations.
• Payment information: Billing address, payment method details, and transaction history. We do not store full card numbers; payment card data is handled by PCI-DSS-compliant processors.
• Communications: Any messages, complaints, live-chat transcripts, or correspondence you send to our support or compliance teams.
• Responsible gaming preferences: Self-exclusion requests, deposit limits, session limits, and cooling-off periods recorded in connection with our Responsible Gaming Policy.

2.2. Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings.
• Usage and behavioural data: Pages visited, games played, wagering amounts, session duration, click-stream data, search queries on the Platform, and feature interactions.
• Geolocation data: Approximate geographic location derived from your IP address, used to verify eligibility and apply regional restrictions.
• Cookie and tracking data: Information gathered through cookies, pixels, and similar technologies as described in Section 6.

2.3. Information from Third Parties

• Identity and fraud verification providers: Results of identity checks, watchlist screenings, and politically exposed persons (PEP) database queries.
• Payment processors and financial institutions: Transaction confirmations, chargeback notifications, and fraud alerts.
• Analytics and marketing partners: Aggregated audience segments, attribution data, and campaign performance metrics.
• Publicly available sources: Where legally permitted, we may verify or supplement your information using publicly accessible records.

3. How We Use Your Data

We process your personal data only for specific, documented purposes. We do not use your data in ways that are incompatible with those purposes unless we notify you in advance or are required by law.

3.1. Account and Service Delivery

We use your registration and identity data to create and maintain your account, authenticate logins, process deposits and withdrawals using accepted Canadian payment methods (including Interac e-Transfer, Visa, Mastercard, PayPal, Skrill, Neteller, iDebit, Instadebit, MuchBetter, Paysafecard, Apple Pay, and bank transfers), and provide uninterrupted access to our games and features.

3.2. Legal and Regulatory Compliance

We process identity, payment, and behavioural data to meet obligations under anti-money laundering (AML) regulations, counter-terrorist financing (CTF) requirements, and age-verification rules. All users must be at least 19 years of age to register and use the Platform. Data processed under this purpose is retained for the periods mandated by law and cannot be deleted at your request where a legal obligation persists.

3.3. Responsible Gaming and Player Protection

We analyse gameplay patterns, session data, and account behaviour to identify signs of problem gambling and to enforce responsible gaming measures in accordance with our Responsible Gaming Policy. Where we identify risk indicators, we may contact you proactively or apply account-level interventions.

3.4. Fraud Prevention and Security

We use technical, behavioural, and device data to detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, and other prohibited conduct described in our Terms and Conditions.

3.5. Marketing and Communications

With your consent, we may send you promotional offers, newsletters, and personalised bonuses by email, SMS, or on-site messaging. You may withdraw your marketing consent at any time by clicking the unsubscribe link in any email or by contacting us at support@theiriscasinos.com. Withdrawal of marketing consent does not affect the lawfulness of any prior processing.

3.6. Platform Improvement and Analytics

Aggregated and pseudonymised usage data helps us understand how players interact with the Platform, enabling us to improve game selection, navigation, and feature design. Where analytics involve profiling, appropriate safeguards are applied.

4. Legal Bases for Processing

We rely on one or more of the following legal grounds for each processing activity:

5. Data Sharing & Third Parties

We do not sell your personal data to any third party. We share your information only in the circumstances described below, and only to the minimum extent necessary for each purpose.

5.1. Service Providers and Data Processors

We engage carefully selected third-party suppliers who process data on our behalf, including payment processors, identity verification agencies, cloud hosting providers, customer-support platform vendors, and fraud-prevention specialists. All processors are bound by written data-processing agreements requiring them to maintain appropriate security standards and to use your data solely for the purposes we specify.

5.2. Regulatory and Law-Enforcement Authorities

We may disclose personal data to competent authorities, regulators, or law-enforcement agencies when required by law, court order, or regulatory directive — for example, in connection with AML reporting or responses to lawful information requests. Such disclosures are made only to the extent required and, where permitted, you will be notified.

5.3. Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to a successor entity. We will notify you before your information becomes subject to a materially different privacy policy as a result of any such transaction.

5.4. Responsible Gaming Partners

Where you request self-exclusion or where we identify serious risk factors, we may share limited data with recognised responsible gaming organisations or self-exclusion scheme operators in Canada to give full effect to player-protection measures. We encourage players in need of support to contact the organisations listed in our Responsible Gaming Policy, including the Responsible Gambling Council (RGC), the Centre for Addiction and Mental Health (CAMH), Gamblers Anonymous Canada, ConnexOntario (1-866-531-2600), and the Problem Gambling Help Line at 1-800-461-0140 (Quebec) or 1-888-795-6111 (British Columbia).

6. Cookies & Tracking Technologies

The Platform uses cookies and similar technologies, including pixels, web beacons, and local storage, to operate essential functions, measure performance, and deliver relevant content.

6.1. Types of Cookies We Use

• Strictly necessary cookies: Required for the Platform to function, including session management, authentication, and security tokens. These cannot be disabled without disrupting core services.
• Performance and analytics cookies: Collect anonymised or pseudonymised data about how users navigate the Platform, allowing us to identify and fix usability issues and measure feature adoption.
• Functional cookies: Remember your preferences, such as language settings, last-visited game categories, and responsible gaming selections, to personalise your experience.
• Marketing and targeting cookies: Used with your consent to deliver personalised promotional content and to attribute registrations or deposits to specific advertising campaigns.

6.2. Managing Cookies

When you first visit the Platform, you will be presented with a consent banner that allows you to accept, reject, or granularly manage non-essential cookie categories. You may update your preferences at any time via the cookie settings link in the Platform footer. You may also configure your browser to block or delete cookies; however, disabling strictly necessary cookies will impair core Platform functionality. Note that third-party cookie settings are governed by the respective third-party providers' privacy policies.

7. Data Security

We implement a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your device and our servers is protected using Transport Layer Security (TLS). Sensitive data at rest, such as identity documents and financial records, is stored using industry-standard encryption algorithms.
• Access controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. Multi-factor authentication is required for administrative system access.
• Network security: Firewalls, intrusion-detection systems, and continuous monitoring protect our infrastructure against external threats.
• Vendor due diligence: Third-party processors are assessed for security compliance before engagement and are subject to periodic review.
• Incident response: We maintain a documented data-breach response plan. In the event of a breach that poses a risk to your rights, we will notify you and relevant authorities in accordance with applicable legal timescales.

While we take these measures seriously, no system is entirely immune to risk. We encourage you to use a strong, unique password and to contact us immediately at support@theiriscasinos.com if you suspect any unauthorised activity on your account.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy or to comply with our legal and regulatory obligations. Our general retention principles are as follows:

• Account and transaction data: Retained for a minimum of five (5) years from the date of account closure or last transaction, as required by AML and financial record-keeping obligations.
• Identity verification documents: Retained for the period required by applicable law, typically five (5) years following the end of the business relationship.
• Customer support communications: Retained for up to three (3) years to enable resolution of disputes and quality monitoring.
• Marketing consent records: Retained for the duration of the relationship and for a reasonable period thereafter as evidence of consent.
• Cookie and analytics data: Session-level data is typically held for no longer than thirteen (13) months before aggregation or deletion.

Once retention periods expire, data is securely deleted or irreversibly anonymised. If you request erasure before a mandatory retention period ends, we will explain which data must be retained and why.

9. Your Rights

Depending on your province of residence and applicable privacy legislation — including the Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy laws — you may hold some or all of the following rights with respect to your personal data. We are committed to honouring these rights promptly and transparently.

9.1. Right of Access

You have the right to request confirmation of whether we hold personal data about you, and if so, to receive a copy of that data along with information about how it is processed. Requests will be fulfilled within thirty (30) days of receipt, subject to identity verification. Where a request is unusually complex or involves a high volume of data, we may extend this period by a further thirty (30) days and will notify you accordingly.

9.2. Right to Rectification

If you believe that personal data we hold about you is inaccurate or incomplete, you have the right to request correction or completion. You may update basic account details directly in your profile settings; for other corrections, please contact our privacy team.

9.3. Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing based on legitimate interests and your interests override ours. We will assess each request individually. Where legal obligations require us to retain certain data, we will explain the applicable limitation and delete all data not subject to such obligations.

9.4. Right to Restrict Processing

You may request that we limit our use of your data in specific circumstances — for example, while we verify the accuracy of data you have contested, or while we assess an objection to legitimate-interests processing. During a restriction, we will continue to store the data but will not actively process it beyond what is necessary to comply with the restriction itself.

9.5. Right to Data Portability

Where processing is based on your consent or on performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transmit that data directly to another service provider where technically feasible.

9.6. Right to Object

You have the right to object to processing based on legitimate interests, including profiling carried out on that basis, at any time. You also have an absolute right to object to direct marketing, including profiling conducted for marketing purposes, and we will cease such processing immediately upon receiving a valid objection.

9.7. Rights Related to Automated Decision-Making

We may use automated processes to detect fraud or to apply responsible gaming interventions. Where a purely automated decision produces a significant legal or similarly significant effect on you, you have the right to request human review of that decision, to express your point of view, and to contest the outcome. To exercise this right, contact us at privacy@theiriscasinos.com.

9.8. How to Exercise Your Rights

To submit a rights request, please email privacy@theiriscasinos.com with the subject line "Privacy Rights Request," your full name, your registered email address, and a clear description of the right you wish to exercise. We may ask you to verify your identity before processing the request. All requests are free of charge unless they are manifestly unfounded or excessive. You also have the right to lodge a complaint with your provincial privacy commissioner or the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been infringed.

10. International Data Transfers

To deliver our services, we may transfer your personal data to service providers or infrastructure located outside Canada. Such transfers occur only where appropriate safeguards are in place to ensure that your data receives a level of protection equivalent to that afforded within Canada.

Safeguards we rely on for international transfers include contractual clauses that impose data-protection obligations on the receiving party, verification that the destination country provides an adequate level of protection, and, where required, the explicit consent of the data subject. We maintain a record of all cross-border data flows and review the adequacy of safeguards on a regular basis. If you would like further details about the specific mechanisms used for any particular transfer, please contact us at privacy@theiriscasinos.com.

11. Minors

The Platform is strictly intended for individuals who are at least 19 years of age, which is the minimum legal gambling age in the majority of Canadian provinces. We do not knowingly collect or process personal data from any person under this age. During registration, all users are required to confirm their age, and we apply identity-verification procedures to validate this declaration.

If we discover or are notified that personal data has been collected from a minor, we will promptly close the relevant account, delete all associated data, and refund any remaining balance in accordance with applicable law. If you are a parent or guardian and believe that a minor has registered on the Platform, please contact us immediately at support@theiriscasinos.com so we can take corrective action. We also encourage the use of parental control tools to prevent minors from accessing gambling platforms.

12. Changes to This Policy

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. When we make material changes, we will post the revised Policy on this page with an updated version number and effective date, and we will provide prominent notice — such as an on-screen notification or email — at least fourteen (14) days before the changes take effect, where practicable.

Minor or non-material corrections may be made without advance notice, though the updated date will always reflect the most recent revision. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you disagree with any revised terms, you must discontinue use of the Platform and may request account closure by contacting support@theiriscasinos.com.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, you may reach us through the following channels:

13.1. General Support

• Email: support@theiriscasinos.com
• Website: theiriscasinos.com

13.2. Privacy and Data Protection Enquiries

• Email: privacy@theiriscasinos.com

For dedicated privacy matters — including rights requests, data-breach notifications, and questions about specific processing activities — please direct correspondence to our privacy team at the address above. We aim to acknowledge all privacy-related enquiries within five (5) business days and to provide a substantive response within thirty (30) days. If your concern relates to responsible gaming, please also review our Responsible Gaming Policy or contact the relevant support organisations listed therein.

Frequently Asked Questions

Does Iris Casino sell my personal data to third parties?

No. We do not sell, rent, or trade your personal data to any third party for their own commercial purposes. Data is shared with service providers only to the extent necessary to operate the Platform, and all such providers are contractually obligated to protect your information.

How do I request deletion of my account and personal data?

You may submit an erasure request by emailing privacy@theiriscasinos.com. Please note that certain data — particularly transaction records and identity verification documents — must be retained for legally mandated periods even after account closure. We will delete all data not subject to such obligations and will confirm the outcome of your request in writing.

What payment data does Iris Casino store?

We store metadata related to your transactions, such as amounts, dates, method type, and processing status, for accounting and AML purposes. Full payment card numbers are never stored on our systems; card data is handled exclusively by our PCI-DSS-compliant payment processors, which include providers supporting Interac e-Transfer, Visa, Mastercard, PayPal, Skrill, Neteller, iDebit, Instadebit, MuchBetter, Paysafecard, Apple Pay, and bank transfers.

Can I opt out of marketing emails?

Yes. Every marketing email we send includes an unsubscribe link. You may also withdraw your marketing consent at any time by logging into your account settings or by contacting support@theiriscasinos.com. Processing of your data for non-marketing purposes — such as account management and legal compliance — will continue regardless of your marketing preferences.

What should I do if I believe Iris Casino has mishandled my data?

Please contact our privacy team at privacy@theiriscasinos.com in the first instance. If your concern is not resolved to your satisfaction, you have the right to escalate your complaint to the Office of the Privacy Commissioner of Canada or to your applicable provincial privacy commissioner. We take all privacy complaints seriously and will cooperate fully with any regulatory enquiry.