Privacy Policy
This Privacy Policy explains how Casino Adrenaline, operated via the website adrenaline-ca.com, collects, uses, shares, and protects personal data of its players and website visitors. It applies to all users who access or use our services from Canada or otherwise interact with adrenaline-ca.com. By registering an account, placing bets, making payments, or browsing our website, you acknowledge this Policy. This Privacy Policy is effective as of 1 January 2026 and replaces all earlier versions relating to the Canadian-facing services of Casino Adrenaline.
Who We Are
OBSERVE: Identify the legal operator, registration, address, and contact for privacy matters.
EXPAND: Connect corporate structure (Curacao operator, Cyprus payment subsidiary) and designate a contact point for data protection queries.
REFLECT: Provide clear identity and contact details so Canadian users know who controls their data and how to reach us.
The services of Casino Adrenaline, available at adrenaline-ca.com, are operated by:
- Operator (Data Controller): Anden Online N.V., a Curacao limited liability company (Naamloze Vennootschap)
- Registration number: 155555
- Registered / legal address: Dr. H. Fergusonweg 1, Curacao
- Gaming licence: 8048/JAZ2014-035, issued to Antillephone N.V. and used by Anden Online N.V. as operating entity, authorized and regulated by the Government of Curacao, verified via validator.antillephone.com, valid through 31 December 2026
For certain fiat payment processing (including Canadian Interac transactions), we use a Cyprus-based subsidiary (legal name may differ), which acts as our payment processor and, where applicable, as our data processor on our instructions.
Data Protection Contact / Responsible Person
- Data protection contact department: Data Protection & Compliance, Anden Online N.V.
- Email: [email protected] (please indicate "Privacy" in the subject line)
- Postal contact (privacy correspondence): Anden Online N.V., Data Protection & Compliance, Dr. H. Fergusonweg 1, Curacao
At this time, we have not appointed an EU- or Canada-specific Data Protection Officer under mandatory law, but our Data Protection & Compliance team performs equivalent functions for privacy oversight.
What Personal Data We Collect
OBSERVE: Identify all data types processed in the course of offering online casino services to Canadian players.
EXPAND: Consider registration, gameplay, payments, security, marketing, and technical interaction (cookies, logs, devices).
REFLECT: Present categories rather than exhaustive lists, so users understand the scope of collection without unnecessary complexity.
Account and Identity Data
- Registration data: full name, date of birth, country of residence, address (where requested), email address, username, encrypted password, preferred language, and account settings.
- Contact data: email, phone number (if provided), communication preferences, proof of contact details (e.g., verification emails, SMS logs where applicable).
- KYC/AML data: identification documents (e.g., passport, ID card, driver's licence), proof of address (utility bill, bank statement), source of funds/source of wealth information, and internal verification notes in line with our AML & KYC Policy.
Technical and Usage Data
- Technical identifiers: IP address, device identifiers, browser type and version, operating system, language settings, time zone, connection type.
- Log and event data: login timestamps, session duration, clicked links, pages visited, gameplay events, error logs, security events (failed logins, suspected misuse), and referral URLs.
- Device and performance data: screen resolution, performance metrics, approximate location derived from IP address (city/region/country), and connection stability metrics.
Payment and Financial Data
- Transaction data: deposits, wagers, wins/losses, withdrawals, bonuses, applied wagering requirements, and payment method used (e.g., Interac, bank wire, card, cryptocurrency where applicable).
- Payment instrument details: limited card or account identifiers (e.g., tokenized card ID, truncated card number, Interac handle, wallet identifiers) as processed by our banking and payment service providers; we do not store full card details where our processors tokenize or otherwise mask them.
- Compliance-related financial data: transaction patterns, thresholds, risk scores and flags used for anti-money laundering (AML) and fraud prevention.
Behavioral and Profile Data
- Gameplay behavior: bet amounts, game preferences, session length, frequency of play, game outcomes, bonus usage, self-exclusion or cool-off choices, and limits set (deposit, loss, wager, session limits) as part of responsible gambling.
- Marketing and communication behavior: email opens and clicks, interaction with promotions, unsubscribe actions, and participation in surveys, feedback, or loyalty programs.
- Risk and segmentation data: internal risk profiles (fraud, AML, responsible gambling), VIP or loyalty status, and analytical segments for service improvement and, where allowed, marketing.
Cookies and Similar Technologies
- Cookies: small text files stored on your device, including session cookies, persistent cookies, and third-party cookies.
- Similar technologies: web beacons, pixels, local storage, and device identifiers used for security, analytics, and marketing where permitted.
- Data within cookies: session identifiers, authentication tokens, language preference, cookie consent choices, analytics identifiers (e.g., for measuring visits and performance), and advertising identifiers when you accept such cookies.
Legal Basis for Processing
OBSERVE: Identify the main legal grounds recognized in leading privacy frameworks (e.g., consent, contract, legitimate interests, legal obligations).
EXPAND: Map each category of processing (service delivery, security, marketing, AML/KYC) to at least one legal basis, considering international standards such as GDPR and comparable Canadian principles.
REFLECT: Clearly state that multiple legal bases may apply simultaneously and that certain processing is mandatory for using our services.
Contractual Necessity
- Purpose: To create, administer, and operate your player account, enable gameplay, process deposits and withdrawals, and provide customer support.
- Scope: We process registration data, account identifiers, transactional data, and core technical data that are necessary to:
- verify your eligibility to play (e.g., age and geographic checks);
- enable you to deposit funds, place bets, and withdraw winnings;
- provide requested support and manage your account settings.
- Consequence of refusal: If you do not provide the data needed for contractual purposes, we cannot offer or maintain your account and services.
Compliance with Legal and Regulatory Obligations
- Purpose: To comply with applicable AML/KYC, counter-terrorist financing, anti-fraud, taxation, accounting, and gambling regulatory obligations imposed by Curacao law and other relevant frameworks.
- Scope: We process identity documents, proof of address, source of funds information, detailed transaction history, and risk flags in line with our AML Policy and Curacao licensing conditions (including licence 8048/JAZ2014-035) and with internationally recognized AML standards.
- Retention and access: Such data is stored for minimum periods required by applicable law and may be shared with competent authorities and regulators where legally required.
Legitimate Interests
- Purpose: To secure our services, prevent fraud and abuse, improve and personalize user experience, perform analytics, and protect our legal rights.
- Typical activities based on legitimate interests:
- monitoring for suspicious transactions and account behavior beyond strict AML obligations;
- logging and investigating security incidents, chargebacks, and abuse of bonuses;
- conducting non-identifying or pseudonymized analytics to understand traffic, game performance, and service usage;
- defending and exercising legal claims, including cooperation with law enforcement where permitted.
- Balancing test: We implement safeguards (pseudonymization, access controls, minimization) and allow you to object to certain legitimate-interest processing where applicable and where no overriding interest or legal obligation exists.
Consent
- Purpose: To carry out optional processing that is not strictly necessary for the contract or for legal obligations, such as:
- sending marketing communications by email or other electronic means;
- using non-essential cookies and similar technologies for analytics or advertising;
- sharing data with certain advertising partners or affiliates for targeted campaigns.
- Characteristics of consent: Consent is requested in a clear and granular manner (e.g., separate marketing opt-ins, cookie banner choices). You may withdraw consent at any time via account settings, unsubscribe links, browser settings, or by contacting us.
- Effect of withdrawal: Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal but may limit your access to certain optional features.
Purpose of Processing
OBSERVE: Identify the main purposes for which Casino Adrenaline uses personal data.
EXPAND: Group similar activities (service operations, improvement, marketing, compliance, risk management, responsible gambling).
REFLECT: Provide a clear, purpose-based overview so players understand why their data is processed.
Provision and Operation of Casino Services
- Setting up and administering player accounts on adrenaline-ca.com.
- Verifying age and geographic eligibility and performing KYC checks.
- Processing deposits and withdrawals via Interac, bank wire, cards, cryptocurrency, and other available methods.
- Enabling access to games, recording bets, calculating outcomes, issuing payouts, and managing bonuses and promotions.
- Providing 24/7 customer support via live chat and email ([email protected]).
Service Improvement and Analytics
- Analyzing aggregated and pseudonymized usage patterns to improve website performance, game offering, and user interface.
- Testing new features, optimizing conversion paths, and measuring effectiveness of responsible gaming tools.
- Producing internal reports and statistics for management and regulatory reporting where required.
Marketing and Promotions
- Sending newsletters, promotional offers, loyalty program information, and bonuses where you have not opted out and where consent is required, obtaining it in advance.
- Customizing offers based on your account status, gameplay history, and preferences, subject to applicable consent requirements.
- Measuring effectiveness of marketing campaigns (open rates, click rates, participation in promotions).
Fraud Prevention, Security, and Risk Management
- Monitoring accounts and transactions for suspicious activity, bonus abuse, money laundering risks, and other prohibited or harmful conduct.
- Maintaining logs and security tools (e.g., IP-based access controls, device fingerprinting) to prevent unauthorized access and attacks.
- Cooperating with regulators, payment providers, and, where lawful, law enforcement to investigate and resolve incidents.
Compliance and Legal Protection
- Complying with Curacao licensing conditions, AML and counter-terrorist financing laws, and other applicable legal frameworks.
- Responding to lawful requests from courts, regulators, and supervisory authorities.
- Establishing, exercising, or defending legal claims related to our business and services.
Disclosure & Sharing
OBSERVE: Identify all typical categories of recipients to whom personal data may be lawfully disclosed in the context of online gambling and Curacao-licensed operations.
EXPAND: Distinguish between processors acting on our behalf and independent controllers (e.g., regulators, payment providers), and mention conditions (legal requirement, consent, contractual safeguards).
REFLECT: Provide transparent, category-based disclosures and highlight that we do not sell personal data in the traditional sense.
Group Companies and Payment Subsidiaries
- Internal transfers: We may share data with our Cyprus-based subsidiary and other related entities that assist with payment processing, risk management, and support. These entities act as data processors or joint controllers, depending on the function, under appropriate intra-group data protection agreements.
Payment Service Providers and Banks
- We share necessary payment and identification data with:
- Interac and related gateway providers (e.g., third-party Interac processors such as Gigadat or similar, where applicable);
- card acquirers, e-wallet providers, crypto payment gateways, and banks involved in deposits and withdrawals;
- correspondent banks for international bank wires (including those handling CAD transactions).
- These partners receive only the data required to process your transactions, comply with their legal obligations, and prevent fraud.
Service Providers (Processors)
- We engage third-party vendors who process data on our behalf and under our instructions, such as:
- IT hosting and infrastructure providers;
- security and anti-fraud solution providers;
- analytics and business intelligence platforms;
- customer support tools (live chat systems, ticketing systems);
- email and communication delivery platforms.
- Each processor is bound by a written data processing agreement requiring confidentiality, security, and processing only for specified purposes.
Regulators, Authorities, and Dispute Bodies
- We may be required or permitted by law to disclose certain data to:
- Curacao regulatory authorities, including Antillephone N.V. and the Curacao Gaming Control Board;
- law enforcement bodies and courts where we receive lawful requests or need to protect our legal rights;
- tax and financial authorities in relevant jurisdictions.
- In any such case, disclosure is limited to what is legally required or strictly necessary for the relevant proceedings.
Affiliates and Advertising Networks
- We may share limited data (such as anonymized or pseudonymized identifiers, aggregated performance metrics, conversion data) with affiliate partners who promote adrenaline-ca.com and with advertising partners for:
- tracking the success of affiliate campaigns;
- capping and attribution of marketing costs;
- measuring the effectiveness of advertising campaigns.
- Where sharing involves personal data for targeted or interest-based advertising, we will rely on your consent obtained through our cookie and marketing interfaces, where applicable.
Corporate Transactions
- In the event of a merger, acquisition, reorganization, or sale of all or part of our business, customer data may be transferred as part of the transaction, subject to confidentiality obligations and, where required, appropriate legal safeguards.
No Sale of Personal Data
- We do not sell your personal data to third parties in the traditional sense of selling data for independent third-party marketing. Any sharing for advertising or affiliate purposes is subject to strict contractual controls and, where required, your consent.
International Transfers
OBSERVE: Note that the operator is based in Curacao, uses a Cyprus subsidiary, and serves Canadian players; therefore, cross-border transfers occur regularly.
EXPAND: Identify typical transfer routes (Canada -> Curacao -> Cyprus -> other service locations) and applicable safeguards.
REFLECT: Explain that, although no single data protection regime governs all transfers, we apply industry-standard contractual and organizational measures.
Locations of Processing
- Your data may be processed and stored in:
- Curacao - by Anden Online N.V. as the main operator and data controller;
- Cyprus - by our payment processing subsidiary and certain service providers;
- European Economic Area and other jurisdictions - by selected IT, payment, and analytics providers;
- Other countries - where specific service providers or cloud infrastructure are located, subject to contractual and security safeguards.
Protection Measures for International Transfers
- Where we transfer personal data across borders, we implement measures such as:
- contractual safeguards consistent with standard contractual clauses or equivalent protections where appropriate;
- strict access controls and role-based permissions to limit which staff and providers can access your data;
- encryption in transit and at rest to reduce the risk of unauthorized access;
- due diligence on our processors' security and privacy practices.
- By using adrenaline-ca.com, you understand that your data may be processed in countries that may not offer the same level of data protection as your home jurisdiction, but we will take reasonable steps to protect your information as described in this Policy.
Data Retention
OBSERVE: Identify practical retention needs driven by AML/KYC rules, licensing requirements, and operational needs, as well as user expectations.
EXPAND: Differentiate between categories (account, KYC, payment, logs, marketing) and link them to typical retention periods.
REFLECT: Provide indicative durations and criteria for deletion or anonymization, within legal and regulatory constraints.
General Principles
- We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including meeting legal, accounting, AML/KYC, and reporting obligations, and to resolve disputes.
- Where data is no longer required in identifiable form, we will either securely delete it or irreversibly anonymize it.
Indicative Retention Periods
- Account and profile data: Kept for the duration of your active account and, following account closure, typically for up to 5 years to address potential legal claims and comply with AML/KYC rules, unless longer retention is required by applicable law.
- KYC and AML-related data: Identification documents, proof of address, and enhanced due diligence records are typically retained for a minimum of 5 - 7 years after the end of your relationship with us, in line with AML obligations and Curacao licensing conditions.
- Transaction and gameplay records: Stored for at least 5 years from the date of the relevant transaction or account closure, whichever is later, to meet regulatory, accounting, and dispute-resolution needs.
- Technical logs and security data: Security logs and connection data are usually kept for 1 - 3 years, depending on risk and legal considerations.
- Marketing data: Data used for marketing is generally kept until you withdraw consent or object to marketing, after which we retain minimal information (e.g., email address on a suppression list) to respect your choice.
Deletion and Anonymization Criteria
- We regularly review our databases and apply the following criteria:
- expiry of statutory or regulatory retention periods;
- account inactivity for a prolonged period, where legally permissible;
- user-initiated account closure and validated erasure requests, to the extent compatible with legal obligations;
- replacement of data with anonymized statistical information that no longer identifies you.
Your Rights
OBSERVE: Consider core rights found in modern data protection frameworks (such as GDPR) and align them with comparable rights and best practices relevant to Canadian players and, where referenced, Mexican regulations in the prompt.
EXPAND: Cover access, rectification, erasure, restriction, objection, portability, and withdrawal of consent, including procedures and timeframes (30 days) and cost-free exercise.
REFLECT: Provide a harmonized rights framework that we apply globally as a matter of policy, even where not strictly mandated in every jurisdiction.
Overview of Rights
- Right of access: You can request confirmation whether we process your personal data and obtain a copy of such data, together with relevant information about the processing.
- Right to rectification: You can request correction of inaccurate or incomplete personal data we hold about you.
- Right to erasure ("right to be forgotten"): You can request deletion of your personal data where:
- the data is no longer necessary for the purposes collected; or
- you have withdrawn consent and no other legal basis applies; or
- you have objected and there are no overriding legitimate grounds; or
- the data was processed unlawfully.
- Right to restriction of processing: You can request that we restrict processing of your data where:
- you contest its accuracy, for the period necessary for us to verify it; or
- processing is unlawful and you oppose erasure; or
- we no longer need the data but you require it for legal claims; or
- you have objected and verification of our overriding interests is pending.
- Right to object: You may object at any time to:
- processing based on our legitimate interests, on grounds relating to your particular situation; and
- processing for direct marketing, including profiling related to such marketing. In this case, we will stop marketing to you without undue delay.
- Right to data portability: Where technically feasible and legally required, you may request that we provide certain data you have provided to us in a structured, commonly used, machine-readable format, or transmit it to another controller.
- Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails, non-essential cookies), you may withdraw that consent at any time, without affecting prior lawful processing.
Procedures to Exercise Your Rights
- Submission of request: You may exercise your rights by:
- emailing us at [email protected] with "Privacy Request" in the subject line; or
- contacting us via the live chat on adrenaline-ca.com and asking to file a privacy request; or
- sending a written letter to Anden Online N.V., Data Protection & Compliance, Dr. H. Fergusonweg 1, Curacao.
- Verification: To protect your data, we may request additional information to verify your identity before acting on your request (e.g., confirmation via your registered email, or limited KYC information).
- Response timeframe: We aim to respond to all valid requests within 30 days of receipt. If your request is complex or we receive numerous requests, we may extend this period by an additional 30 days; in such cases, we will inform you of the extension and reasons.
- Costs: We provide information and act on requests free of charge. If a request is manifestly unfounded or excessive (e.g., repeated), we may charge a reasonable fee or refuse to act on it, as permitted by law.
- Limitations: Certain rights may be restricted by applicable law, especially where processing is required for:
- compliance with legal obligations (e.g., AML/KYC, regulatory retention);
- the establishment, exercise, or defence of legal claims;
- important public interests laid down by law.
While this Policy is tailored primarily to our operations towards Canadian players under a Curacao licence, we strive to align our practices with internationally recognized privacy principles, including those reflected in the EU General Data Protection Regulation (GDPR) and comparable Latin American frameworks. Where specific national rules (including Mexican data protection regulations) formally apply to you, we will take them into account on a case-by-case basis.
Cookies & Tracking Technologies
OBSERVE: Recognize that cookies are central to authentication, security, analytics, and marketing.
EXPAND: Categorize cookies (session, persistent, third-party) and explain purposes and management options.
REFLECT: Enable users to make informed choices while preserving essential functionality.
Types of Cookies We Use
- Strictly necessary / functional cookies:
- Session cookies that enable login, account functionality, transaction processing, and navigation.
- Cookies storing your language, region, and cookie preferences.
- These cookies are essential; the website cannot function properly without them.
- Analytics and performance cookies:
- Persistent and third-party cookies used to measure traffic, page performance, game loading times, and user interaction patterns.
- Help us improve our services and user experience.
- Advertising and affiliate cookies:
- Cookies and pixels used to track campaign performance, affiliate attribution, and, where consented, to show relevant ads on third-party sites.
- May be placed by our advertising partners or affiliates.
Managing Cookies
- Browser controls: Most browsers allow you to:
- view which cookies are stored;
- delete cookies;
- block cookies from specific sites or all sites;
- configure notifications when a site wants to set a cookie.
- On-site preferences: Where available, our cookie banner or settings panel on adrenaline-ca.com allows you to accept or reject specific cookie categories (except strictly necessary cookies).
- Impact of disabling cookies: If you disable or refuse certain cookies, some parts of the website may not function correctly (for example, you may be unable to log in, place bets, or view certain content).
Data Security
OBSERVE: Identify main security layers - encryption, access control, authentication, organizational measures.
EXPAND: Detail technical and procedural safeguards that are appropriate for an online gambling operator with cross-border operations.
REFLECT: Communicate robust protection while clarifying that absolute security cannot be guaranteed.
Technical Measures
- Encryption in transit: Data exchanged between your browser and adrenaline-ca.com is protected with TLS (Transport Layer Security) version 1.2 or higher, using industry-standard encryption protocols.
- Encryption at rest: Sensitive data (including passwords and certain financial data) is stored using strong cryptographic methods, such as hashing, salting, and encryption of selected databases or fields.
- Access controls: Production systems and databases are protected by firewalls, network segmentation, and strict access control lists. Only authorized personnel with a legitimate need have access to personal data.
- Multi-factor authentication (MFA): Administrative and sensitive internal systems used by our staff require multi-factor authentication wherever feasible.
Organizational Measures
- Policies and training: We maintain internal policies on information security, data protection, AML/KYC, and acceptable use. Staff with access to personal data receive training on confidentiality, privacy, and security practices.
- Vendor due diligence: We perform due diligence on third-party service providers, requiring appropriate technical and organisational measures, and we monitor their compliance where possible.
- Segregation of duties: Access to player data is limited and controlled. Different teams (support, risk, payments, IT) have distinct permissions to minimize the risk of unauthorized or accidental access.
Monitoring and Incident Response
- Monitoring: We monitor our systems for unusual activity, attempted intrusions, or indicators of compromise, using logs and security tools.
- Incident handling: In case of a suspected or actual personal data breach, we:
- investigate and take immediate steps to contain and mitigate the incident;
- assess the risk to players' rights and interests;
- where required by applicable law, notify relevant authorities and affected individuals without undue delay.
While we take all reasonable steps to protect your data, no system can be completely secure. You are encouraged to use strong, unique passwords, keep your login details confidential, and log out after each session.
Complaints & Contacts
OBSERVE: Identify communication channels for privacy queries and complaints, and the route to supervisory authorities.
EXPAND: Provide step-by-step internal complaint handling and external escalation options.
REFLECT: Encourage direct resolution while recognizing users' right to contact authorities.
How to Contact Us
- Email (primary contact): [email protected]
- Live chat: Available 24/7 on adrenaline-ca.com for general support and to route privacy-related questions to our Data Protection & Compliance team.
- Postal address: Anden Online N.V., Data Protection & Compliance, Dr. H. Fergusonweg 1, Curacao.
Internal Complaint Procedure
- Submission: Send your complaint or concern to us using one of the above channels, describing the issue clearly and providing relevant details.
- Acknowledgment: We endeavour to acknowledge receipt of your complaint within 5 business days.
- Investigation: Your complaint will be reviewed by our Data Protection & Compliance team, which may contact you for clarification or additional information.
- Response: We aim to provide a substantive response within 30 days from acknowledgment. If we cannot meet this timeline due to complexity, we will inform you of the delay and provide an updated estimate.
- Escalation: If you remain dissatisfied after our response, you may request further internal review and/or consider external avenues as described below.
Escalation to Supervisory or Regulatory Authorities
- Regulatory authorities: As an operator licensed in Curacao, we are subject to Curacao regulatory oversight (including Antillephone N.V. and, under the evolving framework, the Curacao Gaming Control Board). Information about Curacao regulations is available at gamingcontrolcuracao.org.
- Data protection and privacy authorities: Depending on your place of residence, you may have the right to lodge a complaint with your local data protection or privacy authority. For example, Canadian residents may contact the Office of the Privacy Commissioner of Canada (OPC) for guidance on privacy rights:
Where privacy laws of other jurisdictions formally apply to your situation, you may also have the right to contact the relevant supervisory authority in that jurisdiction. We will cooperate with competent authorities as required by law.
Updates
OBSERVE: Recognize that our services, legal obligations, and best practices evolve.
EXPAND: Define how users will be notified of changes, how versions are documented, and what options users have if they disagree.
REFLECT: Provide predictable and transparent update mechanisms with reasonable notice for significant changes.
Changes to This Privacy Policy
- We may update this Privacy Policy from time to time to reflect:
- changes in our services or business model;
- updates to legal or regulatory requirements (including Curacao or other relevant laws);
- improvements in our privacy and security practices.
- Each version of this Policy will be identified by the "Last updated" date indicated below.
Notification of Material Changes
- For material changes that significantly affect how we process your personal data or your rights, we will provide additional notice, which may include:
- email notifications to the address registered in your player account;
- prominent banners or pop-up notices on adrenaline-ca.com;
- alerts within your account dashboard.
- Where reasonably possible, we will provide such notice at least 30 days before the changes take effect, so that you have time to review them.
Your Options in Case of Changes
- If you do not agree with the updated Privacy Policy, you may:
- adjust your privacy settings (e.g., marketing preferences, cookie choices) where available; and/or
- stop using our services and request account closure and, where applicable, deletion of data to the extent permitted by law.
- Your continued use of adrenaline-ca.com after the effective date of any updated Policy will constitute your acknowledgment of the changes.
Last updated: January 2026