At AllyBet, personal information collected from Canadian users is processed under specific, legally defined grounds. Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy statutes, every data processing activity must correspond to a lawful justification. Personal data is never processed without a designated operational or legal basis, nor is it retained beyond the timeframe required to fulfill these stated purposes.

A. Contractual Necessity

To open an account and provide active wagering services on our platform, certain personal data must be processed as a direct condition of our user agreement. Without this information, core functions of the sportsbook cannot be executed. Contractual processing encompasses:

• Account Set Up and Profile Maintenance: Processing full legal names, dates of birth, residential addresses, and email contact details to create and maintain secure user accounts.
• Transaction Settlement and Account Balance Management: Executing financial transactions including deposits, payout requests, and wager calculations. Personal and financial details are routed to approved partners across available payment processing options to verify transaction authenticity and complete account settlements.
• Customer Support Operations: Reviewing user account logs, bet tickets, and transaction records when resolving customer inquiries, technical bug reports, or service disputes through email or live chat systems.

B. Compliance with Legal and Regulatory Mandates

As a regulated sports betting provider operating in Canada, AllyBet is obligated by law to collect, verify, and report specific user information to maintain operating compliance. These mandatory legal duties include:

• Identity Verification and Age Validation: Conducting Know Your Customer (KYC) procedures prior to enabling withdrawals or account active status. This involves cross-referencing government-issued photo identification and proof of address against national identity databases to prevent underage access and identity impersonation.
• Anti-Money Laundering (AML) Monitoring: Complying with Proceeds of Crime (Money Laundering) and Terrorist Financing Act requirements monitored by FINTRAC. Financial transactions, deposit source validation, and large payout transfers are systematically audited for suspicious financial patterns.
• Responsible Gambling Enforcement: Monitoring wagering patterns and account activity to enforce mandatory safer gambling protections. Data is analyzed to identify risk indicators and implement account limits, cool-off periods, or self-exclusion directives in compliance with our legal commitments and stated responsible gaming policies.

C. Legitimate Business Interests

AllyBet processes non-sensitive transactional and technical data to protect, refine, and optimize sportsbook operations, provided these activities do not infringe upon individual privacy rights:

• System Security and Threat Mitigation: Monitoring IP addresses, device identifiers, and session metrics to protect our network against distributed denial-of-service (DDoS) attacks, unauthorized account access attempts, and automated bot scraping.
• Risk Management and Fraud Prevention: Analyzing betting patterns, syndicate wagering signatures, and payment anomalies to protect platform integrity and prevent illegal activity.
• Technical Performance and Platform Optimization: Aggregating software logs and platform load times to optimize server infrastructure and user experience across web browsers. More information about our organizational structure is detailed on our page about AllyBet.

D. Consent-Based Processing

Certain optional processing activities require explicit prior consent from the user before execution:

• Direct Marketing Communications: Email notifications, SMS alerts, and promotional announcements regarding event odds, deposit matches, or customized promotional offers are sent only when express consent is provided in accordance with Canada’s Anti-Spam Legislation (CASL). Users retain the right to withdraw marketing consent at any time via account settings or direct unsubscribe links.
• Non-Essential Cookies and Analytics: Analytical and performance cookies that track user navigation across site pages are deployed only after consent is granted through our site preference management tool.

AllyBet uses first-party and third-party cookies, pixel tags, web beacons, and local storage mechanisms across our digital platforms to ensure core technical operations, evaluate usage patterns, maintain player account security, and tailor our marketing outreach in compliance with applicable Canadian federal and provincial privacy standards. When you access our portal or mobile interfaces, these data objects are downloaded to your device browser to collect structured operational records.

We classify the tracking instruments deployed across our systems into four primary operational categories:

• Strictly Necessary Cookies: Essential for standard platform functionality. These tokens authenticate active login sessions, verify user identity against session tokens, facilitate secure cashier interactions including deposits through our listed payment methods, and enforce compliance routines such as verifying access locations against provincial regulatory boundaries. Because these records are vital to security and site stability, they cannot be deactivated within our preference settings.
• Performance and Analytics Cookies: Used to monitor aggregated traffic patterns, identify platform errors, track page loading latencies, and assess navigation routes across sports markets and betting slips. We process telemetry data through internal server logs and verified analytics partners, gathering anonymized statistics such as browser versions, operating system builds, visit durations, and outbound referral channels without linking this metrics data to identifiable personal profiles.
• Functional Cookies: Retain user-selected settings and custom operational parameters across visits. These cookies preserve odds display preferences (such as decimal, fractional, or American formats), default regional time zones, language toggles, and customized slip configurations so that individual selections do not require manual reconfiguration during subsequent sessions.
• Targeting and Marketing Pixels: Deployed in collaboration with accredited advertising networks to evaluate promotional campaigns, measure user conversion rates, and limit redundant banner exposures across third-party websites. These tracking tags identify returning visits from external digital networks and verify whether specific affiliate campaigns led to user registrations or transaction completions.

Users can manage cookie permissions at any time through our on-site Preference Center or by adjusting standard controls within their browser settings (including Chrome, Safari, Firefox, and Edge). Disabling performance or marketing cookies will not restrict platform access; however, blocking functional or session-critical cookies may disrupt account authentication, bet placement confirmations, cashier workflows, or access to our responsible gambling self-exclusion controls.

For technical inquiries regarding cookie deployment or our compliance with Canadian data retention rules, review our platform overview on the about page or contact our designated Data Protection Officer via our verified customer support desk.

AllyBet maintains strict internal protocols governing the disclosure of player records. Personal and financial data is never rented, monetized, or sold to third-party commercial entities. Transmission of personal details occurs strictly within operational frameworks required to maintain player accounts, process financial transactions via our supported deposit and withdrawal methods, fulfill regulatory mandates, and protect platform integrity across Canada.

External disclosures are restricted to the following authorized parties:

• Operational Service Providers: Trusted third-party vendors who provide infrastructure, identity verification, Know Your Customer (KYC) screening, geolocation validation, customer communication channels, and automated fraud-prevention tools. Each vendor operates under binding Data Processing Agreements (DPAs) requiring adherence to equivalent data security standards.
• Financial Institutions and Gateways: Payment processors, banking networks, and digital transfer providers facilitating deposits and payouts, verifying account ownership, and resolving payment disputes.
• Regulatory Authorities and Law Enforcement: Provincial gaming regulators, federal agencies such as the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), and judicial bodies where disclosure is required by statute, court subpoena, or enforceable legal proceedings.
• Corporate Reorganizations: Successor entities in the event of an asset sale, corporate restructuring, merger, or acquisition, under standard confidentiality provisions aligning with this policy.

In accordance with Canadian privacy legislation (including PIPEDA) and applicable international standards such as the GDPR, registered players hold defined statutory rights regarding their stored information:

• Right to Access: You may request an itemized digital copy of all personal records, transaction logs, and platform activity currently associated with your account profile.
• Right to Rectification: You are entitled to update or correct inaccurate, outdated, or incomplete personal details directly through your account profile or via administrative assistance.
• Right to Erasure: You may request the permanent removal of your personal information, subject to overriding statutory record-retention obligations imposed by anti-money laundering (AML) and responsible gaming regulations.
• Right to Restrict or Object to Processing: You may request limitations on specific data processing activities or object to processing carried out under legitimate interest provisions, including direct marketing communications.
• Right to Data Portability: You may receive your structured personal data in a commonly used, machine-readable format for transfer to another digital operator.
• Automated Decision-Making Safeguards: You retain the right to human intervention and review regarding automated risk-scoring or transactional integrity assessments. Players managing account limits or self-exclusion options can also review our responsible play tools at any time.

Platform data is encrypted in transit using TLS 1.3 cryptographic protocols and stored at rest using industry-standard AES-256 encryption within secure, access-controlled data centres. Under Canadian AML mandates, core identification records and transactional ledgers must be retained for a mandatory statutory period (typically five to seven years following account closure) before scheduled, automated purging occurs.

To submit a formal data subject access request (DSAR), challenge data accuracy, or contact our Data Protection Officer regarding privacy compliance, please direct written inquiries to [email protected]. Verification of identity is required prior to processing formal data requests.