Information We Collect
We collect three categories of information, and each exists for a defined reason.
Personal information. When you register we collect your full name, date of birth, email address, country and province of residence, and a username and password. During identity verification we additionally collect a copy of a government-issued photo identification document, a proof of address such as a recent utility bill or bank statement, and in some cases a selfie holding your identification or documentation showing source of funds. We collect this because we are legally obliged to confirm your identity, your age and the legitimacy of funds entering your account. We cannot lawfully process a withdrawal without it.
Financial information. We collect records of your deposits, withdrawals, wagers and account balance, together with the payment instrument you use. For cards this includes a masked number and expiry; for e-wallets, your wallet identifier; for Interac and bank transfers, the details needed to route funds; for cryptocurrency, the wallet address used. Full card numbers are handled by our payment processors under PCI DSS standards and are not stored on our systems.
Technical data. When you use the site we automatically collect your IP address, approximate location derived from it, device type, operating system, browser, language setting, referring page, the pages you view and the actions you take. This is collected to keep the service working, to detect fraudulent or automated access, to confirm that you are accessing from a permitted jurisdiction, and to identify patterns that may indicate gambling harm.
We do not collect information we have no use for, and we do not ask for sensitive categories such as health or biometric data beyond what identity verification requires. Running a secure gambling platform depends on collecting less, not more.
How We Use Player Data
Account creation and login. Your registration details establish and secure your account, authenticate you at each login and allow us to contact you about it.
Payment processing. Financial data is used to credit deposits, process withdrawals, confirm that a payout is returning to an instrument you own, and maintain the transaction records that gaming and anti-money-laundering rules require us to keep.
Security and fraud prevention. We analyse technical and behavioural data to detect account takeover, payment fraud, bonus abuse, duplicate accounts and automated play. This is the basis on which we may pause an account pending review, and it protects honest players as much as it protects us.
Legal and regulatory compliance. We use personal and financial data to meet obligations under our Curaçao licence, anti-money-laundering law and applicable Canadian legislation, including confirming that you are of legal age and are not resident in a jurisdiction we are not permitted to serve.
Marketing and personalised promotions. With your consent we use your activity to send offers, tailor the promotions you see and recommend games. Consent is optional, it is separate from your account, and you can withdraw it at any time in account settings or through the unsubscribe link in any message without affecting your ability to play.
Responsible gaming monitoring. We review play patterns for indicators associated with gambling harm — sharply increasing deposits, extended sessions, chasing losses after a decline — and may contact you, suggest limits, or in some cases intervene directly. This is one of the few uses that does not depend on your consent, because the alternative is watching a problem develop and saying nothing.
Data Sharing Policy
We do not sell player data. Ever, to anyone, for any price. No exceptions, and no arrangements that amount to selling under another name.
We share information only in the following circumstances. With service providers who need it to deliver the platform: payment processors, identity verification and anti-fraud providers, game studios, hosting and email providers, and our customer support tooling. Each is contractually bound to process data only on our instructions, to protect it to a defined standard, and to delete it when the relationship ends.
With regulators and legal authorities, where we are required to do so by law, by our licence conditions, by a court order or by a valid request from a law enforcement or anti-money-laundering body. Where we are permitted to tell you, we will.
With other parties at your direction, for instance when you ask us to resolve a dispute through a mediation service.
We may also transfer records as part of a corporate transaction such as a merger or sale, in which case the acquiring entity remains bound by this policy.
Data Protection and Security
Player data safety is handled as an engineering problem rather than a policy statement. All traffic between your device and our servers is encrypted in transit using TLS, indicated by the padlock in your browser. Sensitive stored data, including identification documents, is encrypted at rest. Passwords are stored only as salted cryptographic hashes and cannot be read by our staff.
Access is restricted on a need-to-know basis, because the simplest way to protect personal information is to limit how many people can reach it. A support agent can see what they need to resolve your query and no more; access to verification documents is limited to the compliance team; administrative access requires multi-factor authentication and is logged. Staff are trained on data handling and are subject to confidentiality obligations that survive their employment.
Our infrastructure sits in secure data centres with physical access controls, and we maintain network monitoring, intrusion detection and regular backups. We carry out periodic security reviews and vulnerability testing, and game integrity is separately tested by an independent laboratory.
No system is perfectly secure, and any business claiming otherwise is overselling. What we commit to is this: if a breach affecting your personal information occurs, we will contain it, notify the relevant privacy authority as required, and notify you directly where there is a real risk of significant harm — promptly, and without waiting to see whether anyone notices.
Cookies and Tracking Technologies
Cookies are small text files stored by your browser. We use four kinds.
Strictly necessary cookies keep you logged in, maintain your session as you move between pages, and protect against cross-site request forgery. The site cannot function without them.
Preference cookies remember your language, currency, odds format and layout choices so you are not resetting them every visit.
Analytics cookies tell us which pages are used, where players abandon a process and which features go unused. This is aggregated and used to improve the site.
Marketing cookies measure the performance of our advertising and, where you have consented, allow relevant offers to be shown to you elsewhere.
You control all but the strictly necessary category. Our cookie banner lets you accept, reject or configure them on first visit, and you can change your choice at any time through the cookie settings link in the site footer. Your browser also allows you to block or delete cookies, though blocking necessary cookies will prevent you from logging in. We honour recognised browser-level opt-out signals where applicable law requires it.
Player Rights
The privacy rights players hold under Canadian law and, where applicable, the GDPR give you meaningful control over your information. Questions about casino GDPR compliance reach us most often from players who have moved between jurisdictions, and the answer is that the stronger of the applicable regimes governs your account.
Access. You can ask what personal information we hold about you, why we hold it and who it has been shared with, and receive a copy.
Correction. You can require us to correct information that is inaccurate or incomplete. Some details, such as your name and date of birth, can only be amended with supporting documentation, because changing them after verification is a common fraud pattern.
Deletion. You can ask us to delete your personal information. We will do so unless we are legally required to retain it — which, for financial and identity records held by a licensed gaming operator, we usually are for a defined period after account closure.
Restriction and objection. You can object to processing based on our legitimate interests, and ask us to restrict processing while a dispute about accuracy or lawfulness is resolved.
Withdrawal of consent. Where processing rests on consent, chiefly marketing, you can withdraw it at any time without penalty and without affecting the lawfulness of what came before.
Portability. Where the GDPR applies, you can receive the data you provided to us in a structured, machine-readable format, or have it sent to another controller.
To exercise any of these, contact us using the details below. We will confirm your identity first, and respond within 30 days as PIPEDA requires, or within one month under the GDPR. There is no charge. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, to your provincial commissioner, or to your EEA supervisory authority.
Data Retention
We keep personal information only as long as we have a reason to.
Account, transaction and verification records are retained for five years from the date you stop using our services. This is not our preference; it reflects the record-keeping obligations that apply to licensed gaming operators and to businesses subject to anti-money-laundering rules, and it applies even if you close your account or ask for deletion.
Self-exclusion records are retained for the duration of the exclusion and afterwards, because their entire purpose is to prevent a new account being opened. Marketing consent records are kept until consent is withdrawn, plus a short period evidencing the withdrawal. Technical logs are retained for shorter periods, typically months rather than years.
When a retention period expires, data is securely deleted or irreversibly anonymised so it can no longer be linked to you.
Underage Users and Data Protection
Bossy Casino is strictly for adults. Registration requires that you have reached the legal gambling age in your province of residence — 19 in most of Canada, and 18 in Alberta, Manitoba and Quebec.
We do not knowingly collect personal information from anyone below that age, and we do not market to minors or advertise through channels aimed at them. Age is checked at registration and confirmed during identity verification, and any account that cannot be verified as belonging to an adult is closed with deposits returned and winnings void.
If we learn that a minor has created an account, we close it immediately and delete their personal information except the minimum record needed to prevent re-registration. If you believe a young person has accessed our site using your device or payment details, contact us at once. We also recommend parental control software, and we support the use of blocking tools such as Gamban and Net Nanny on shared devices.
International Data Transfers
We are an international operation. Our operating entity is incorporated in Curaçao, payment processing is handled from Cyprus, and our service providers and infrastructure are located in several countries. Your personal information will therefore be transferred outside Canada and stored or processed in jurisdictions whose privacy laws differ from your own.
Where that happens, we rely on appropriate safeguards: contractual commitments requiring each recipient to protect your information to a standard comparable to Canadian law, European Commission standard contractual clauses where the GDPR applies, and transfers to jurisdictions recognised as providing adequate protection where available. We remain accountable for your information regardless of who is holding it or where. You can request details of the safeguards applied to a specific transfer using the contact details below.
Changes to This Privacy Policy
We may update this policy to reflect changes in our services, our providers or the law. The version published on our website is always the current one, and the last updated date appears near the top.
Where a change materially affects how we use your information or your rights, we will notify you by email and with a notice on the site before it takes effect, giving you time to review it and, if you disagree, to close your account. Minor corrections are made without individual notice. Continuing to use your account after a change takes effect indicates acceptance of the updated policy.
Contact Information
For any question about this policy, about the information we hold, or to exercise any of the rights described above, contact our data protection team at support@casinosbossy.ca, or write to Neroblanko Tech B.V., Zuikertuintjeweg Z/N, Landhuis Zuikertuin, Curaçao.
Our 24/7 live chat can also route a privacy request to the right team, though anything requiring identity confirmation will move to email. Tell us what you are asking for and we will confirm receipt, tell you what we need, and respond within the statutory deadline.
If you are not satisfied with how we have handled your request, you have the right to complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, to your provincial privacy commissioner, or where the GDPR applies, to the supervisory authority in your country of residence. We would prefer the chance to put it right first, but that route is always open to you.