Low Deposit Casino Privacy Policy (Canada)

This Privacy Policy explains how Low Deposit Casino collects, uses, shares, and protects personal information for players in Ottawa and across Ontario, Canada. We comply with PIPEDA, AGCO and iGaming Ontario standards, FINTRAC requirements, and CASL. It applies to our website, mobile experiences, and real‑money gameplay.

What personal data do we collect in Ontario and why?

We collect only the personal information necessary to register your account, verify identity and age, enable lawful play within Ontario, process payments, prevent fraud and money laundering, provide customer support, and meet our regulatory duties under PIPEDA, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) overseen by FINTRAC, and Ontario’s framework administered by the Alcohol and Gaming Commission of Ontario (AGCO) and iGaming Ontario (iGO). Non‑essential data uses (such as marketing cookies) occur only with your consent and in accordance with Canadian anti‑spam rules (CASL).

What account, identity, and age verification details are required for KYC/AML?

Casinos operating in Ontario must identify players, verify their age (19+), and maintain specific records to comply with the PCMLTFA and FINTRAC guidance, as well as AGCO/iGO standards. We collect only what is necessary to confirm who you are, your eligibility to play, and to prevent money laundering and terrorist financing.

Core identity data:

• Full legal name, date of birth, and residential address
• Contact details: email address and mobile/telephone number

Government‑issued identification (to verify identity and age):

• Document type (e.g., Ontario driver’s licence, Canadian passport, provincial photo card)
• Document number, issuing authority, and expiry date
• Front/back images or scans of the ID (where permitted and required)

Remote verification safeguards (when used):

• Liveness/selfie check to confirm the document matches the user
• Automated fraud signals (e.g., tampering detection, duplicate account checks)

Regulatory screening outputs:

• Sanctions and watchlist screening results, politically exposed person (PEP) flags (where legally required)
• Self‑exclusion and eligibility status as required by Ontario’s regulatory framework

Record‑keeping and audit trail:

• Timestamps, verification outcomes, and reference numbers to meet AML record‑keeping duties (many prescribed AML records must be retained for 5 years under the PCMLTFA)

What gameplay, transaction, and device data do we log to operate the service?

Operating a fair, secure, and compliant casino requires logging gameplay, payments, and technical events. These logs help us run games, resolve player support issues, meet regulatory reporting obligations, and protect accounts from fraud or misuse.

Gameplay and account activity:

• Game titles played, session start/end times, stakes, outcomes, bonuses, and promotions used
• Responsible gambling settings (e.g., deposit limits, time‑outs, self‑exclusion status) and changes to those settings
• Account actions such as logins, password changes, MFA enrollment, and security warnings

Payments and financial operations:

• Deposits and withdrawals: amounts, currency, method (e.g., card, e‑wallet), timestamps, transaction IDs
• Payment method tokens and limited card details (e.g., last 4 digits) provided by payment processors
• Anti‑fraud and AML signals (velocity checks, unusual patterns, source of funds declarations where required)

Device, network, and security telemetry:

• IP addresses, approximate location derived from IP, device identifiers, operating system, browser/app version
• Cookie IDs or authentication tokens to maintain secure sessions
• Security events (e.g., failed logins, suspected bot activity, session hijacking indicators) and diagnostic logs

Customer support and dispute resolution:

• Communications with support, tickets, chat transcripts, and attachments relevant to resolving issues
• Case notes and outcomes necessary for compliance reviews and audits

What cookies, geolocation, and tracking technologies are used?

We use essential cookies and similar technologies to operate the site and protect accounts. With your consent, we may use additional analytics or marketing cookies. We also use geolocation methods to ensure you are physically in Ontario when required by law and to prevent play from prohibited locations.

Essential (strictly necessary) technologies:

• Session and authentication cookies to keep you signed in and protect against CSRF
• Security and fraud‑prevention identifiers (e.g., device fingerprint signals used to detect bots and account takeover)
• Load‑balancing and availability cookies to deliver the service reliably

Preferences and functionality:

• Language, region, and UI settings so the site remembers your choices
• Accessibility preferences (e.g., font size, contrast) where supported

Analytics and performance (consent‑based):

• First‑party analytics cookies or SDKs to measure page/app performance and fix errors
• Aggregate usage metrics to improve game stability and user experience

Marketing (consent‑based and CASL‑compliant):

• Cookies or mobile advertising identifiers to measure campaign reach and frequency
• Email or push notification preferences stored to honor your opt‑in/opt‑out choices under Canadian anti‑spam law

Geolocation methods (for lawful play in Ontario):

• IP‑based location checks and network metadata to determine provincial jurisdiction
• Device‑level signals (e.g., GPS, Wi‑Fi triangulation) where enabled and necessary for precise geofencing
• Integrity checks to detect VPNs/proxies and prevent location spoofing as required by AGCO/iGO

Your choices and controls:

• Cookie consent tools let you accept or reject non‑essential cookies at any time
• Device settings can disable location services; however, precise geolocation may be required to access real‑money play within Ontario
• You can withdraw marketing consent consistent with PIPEDA and CASL; essential cookies remain necessary for service delivery

How do we use, share, and store your information?

We use your information to operate a legal, fair, and secure casino for players located in Ontario, to process payments, verify identity and age, support responsible gambling, comply with anti‑money‑laundering (AML) and gaming regulations, and provide customer support. We share data only with service providers and authorities necessary to deliver these services or meet legal duties under Canadian privacy law (PIPEDA), Canada’s AML law (PCMLTFA) overseen by FINTRAC, and Ontario’s framework led by the AGCO and iGaming Ontario (iGO). We do not sell personal information.

Who do we share data with (payments, KYC vendors, regulators), and why?

We disclose personal information to carefully selected third parties under contracts that restrict use of the data to our documented purposes, require strong security, and prohibit onward sale. Disclosures fall into the categories below.

All vendors are subject to due diligence and data processing terms requiring confidentiality, security, limited retention, and assistance with privacy requests. Disclosures to authorities are made only when legally required or to protect players and the integrity of gaming.

Do we transfer data outside Canada, and what safeguards apply?

Your information may be processed outside Canada by our service providers (for example, cloud infrastructure, anti‑fraud, or KYC providers). When data is stored or accessed in another country, it may be available to foreign authorities under that country’s laws. We mitigate these risks through contractual, technical, and organizational safeguards consistent with guidance from the Office of the Privacy Commissioner of Canada and PIPEDA.

Contractual safeguards:

• Data processing agreements requiring comparable protection to Canadian standards, purpose limitation, and breach notification
• Flow‑down obligations for sub‑processors and prior approval for any changes

Technical safeguards:

• Encryption in transit and at rest, strong key management, network segmentation, and access logging
• Data minimization and tokenization so vendors process only what is necessary

Organizational safeguards:

• Vendor risk assessments, security audits, and ongoing monitoring of compliance
• Clear data residency mapping and transparency to users about cross‑border processing

Your choices and transparency:

• We disclose material cross‑border transfers in this Privacy Policy and, where required, obtain consent
• You can contact our privacy team for details about specific processors and locations

How long do we retain different records under gaming and AML rules?

We retain personal information only as long as necessary to provide services, meet legal and regulatory obligations, resolve disputes, and enforce our agreements. Some retention periods are prescribed by law. After the applicable period, we securely delete or de‑identify data unless a longer retention is required to establish, exercise, or defend legal claims.

AML and KYC records (PCMLTFA/FINTRAC):

• Client identification and verification records, transaction records, and copies of required reports (e.g., suspicious transaction reports) are kept for at least 5 years, as required by the PCMLTFA and FINTRAC record‑keeping rules (FINTRAC record‑keeping guidance).
• For ongoing business relationships, identification information is retained for 5 years after the relationship ends or the last transaction, in accordance with FINTRAC guidance.

Tax and financial records (CRA):

• Business records needed to meet Canadian tax obligations are generally kept for 6 years from the end of the last tax year to which they relate, per the Canada Revenue Agency (CRA record retention).

Gaming operations and audit:

• Gameplay logs, account activity, and system logs are retained for the duration necessary to operate the service, investigate incidents, and meet audit/dispute resolution needs under AGCO/iGO standards.

Responsible gambling and self‑exclusion:

• Records related to self‑exclusion and limit settings are maintained for the period needed to enforce protections and as required by Ontario’s responsible gambling standards.

Customer support and security logs:

• Support tickets and security telemetry are retained for a period appropriate to resolve issues and protect accounts; where they form part of AML or audit evidence, the longer legal retention above applies.

Deletion and de‑identification:

• When retention ends, we apply secure deletion or de‑identify data so it no longer relates to an identifiable individual, subject to any legal holds.

What are your privacy choices and rights in Canada?

Canadian privacy law (PIPEDA) gives you rights to know what personal information we hold about you, to access it, request corrections, withdraw consent for non‑essential processing, and complain if you are not satisfied with our response. Some data must be retained for legal, regulatory, fraud prevention, or security reasons; where deletion is not possible, we will restrict use or de‑identify it. We answer requests within the timelines set by law and will explain any lawful limitations that apply (for example, records we must keep under AML rules).

How can you access, correct, or delete your information?

You can review and update many account details directly in your profile. For broader access, correction, or deletion requests, we will verify your identity before acting, search our systems, and respond in writing. If we cannot meet your request in full (for example, due to legal retention requirements), we will explain the reasons and your options to challenge the decision.

• Access: Request a copy or description of the personal information we hold, including the categories of sources, uses, and disclosures.
• Correction (rectification): Ask us to fix inaccurate or incomplete records; we may request supporting documentation if appropriate.
• Deletion (erasure): Request deletion of data that is no longer necessary for the purposes collected and not subject to a legal hold or statutory retention.
• Identity verification: We may ask for limited information to confirm your identity before fulfilling your request, to protect your account.
• Fees and format: We generally respond free of charge and provide information in a readable format unless a reasonable fee is permitted by law for voluminous or repetitive requests.

How do you manage consent, marketing preferences, and cookies?

You control non‑essential uses of your data. Marketing communications are opt‑in where required by Canada’s Anti‑Spam Legislation (CASL), and every message includes an unsubscribe option. You can also adjust cookies and analytics through our consent tools and your device or browser settings.

Marketing preferences (CASL):

• Opt in or out of email, SMS, or push marketing in Account Settings.
• Use the unsubscribe link in any marketing email; we honor unsubscribes within 10 business days, as required by CASL.

Cookie and analytics choices:

• Use our cookie consent manager to accept or reject non‑essential cookies at any time.
• Adjust browser settings to block or delete cookies; essential cookies are needed for core functionality (e.g., login, security).

Geolocation and device permissions:

• Control location sharing in your device settings; precise location may be required to access real‑money play in Ontario.
• Manage push notifications via your operating system settings.

Withdrawing consent:

• You may withdraw consent for non‑essential processing at any time; this does not affect processing that is required by law or necessary to provide the service.

How can you complain to us or the Office of the Privacy Commissioner?

If you have a privacy concern, contact us first so we can investigate and resolve it. We will acknowledge receipt, assign a case number, and typically respond within 30 days. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC), which oversees PIPEDA for private‑sector organizations across Canada.

Contact us:

• Use the in‑account Help or Privacy Request tool to open a ticket with our privacy team.
• Include relevant details (account identifier, description of the issue, and any supporting documents) so we can investigate efficiently.

Contact the OPC (federal):

• Website and contact page: https://www.priv.gc.ca/en/contact-the-opc/
• Toll‑free: 1-800-282-1376; Local (Ottawa‑Gatineau): 819-994-5444
• Email (general inquiries): [email protected]
• You may submit a formal complaint through the OPC’s website forms and will receive guidance on next steps.

What to expect:

• We aim to resolve complaints within 30 days where possible; complex cases may require additional time, which we will explain.
• If the OPC investigates, we will cooperate with their office and follow any recommendations or findings.

How do we protect your data and support responsible gambling?

We apply layered security controls to keep your account and personal information safe and to maintain the integrity of Ontario internet gaming. Our safeguards align with Canadian privacy law (PIPEDA), the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) overseen by FINTRAC, and the technical and responsible gambling standards set by the Alcohol and Gaming Commission of Ontario (AGCO) and iGaming Ontario. We also support responsible gambling through player tools (limits, time-outs, self-exclusion) and eligibility checks designed to prevent underage play.

What security safeguards do we use (encryption, access controls, MFA)?

We protect data through administrative, technical, and physical controls proportionate to the sensitivity of the information and the risks of online gaming. Security is embedded into our software development lifecycle and vendor management, and we continuously monitor systems for threats and anomalies.

Encryption and key management:

• Transport: TLS 1.2+ with modern cipher suites for web and app connections; HSTS enabled on supported domains.
• Storage: Strong encryption (e.g., AES‑256 class) applied to databases and backups that hold personal or financial data.
• Keys: Segregated key management, rotation, and access logging.

Access controls and authentication:

• Least‑privilege, role‑based access control (RBAC) for staff and systems; periodic access reviews.
• Multi‑factor authentication (MFA) enforced for privileged staff access; MFA available for players where supported.
• Strong password policies, credential hashing with modern algorithms, and session management with secure cookies.

Network and application security:

• Segmentation between environments, firewalls, WAF, and DDoS protection.
• Secure SDLC with code review, dependency scanning, and regular penetration testing.
• Continuous logging, SIEM alerting, and anomaly detection to identify suspicious activity.

Payment security:

• We work with PCI DSS‑certified payment processors and tokenize payment instruments; we do not store full PAN or CVV.
• Fraud controls including velocity limits, device intelligence, and manual review where warranted.
• See PCI Security Standards Council: https://www.pcisecuritystandards.org/

Resilience and data lifecycle:

• Regular, encrypted backups; tested disaster recovery with defined RPO/RTO objectives.
• Data minimization, retention schedules, and secure deletion or de‑identification at end‑of‑life.
• Vendor due diligence and contractual security requirements for all processors and sub‑processors.

Responsible gambling controls:

• Account‑level tools: deposit, loss, and session limits; time‑outs; self‑exclusion, consistent with AGCO/iGO standards.
• Risk and play‑pattern monitoring to help identify and support safer play.
• Links to help resources via iGaming Ontario Responsible Gambling.

When and how will we notify you about a security breach?

If a breach of security safeguards results in a real risk of significant harm (RROSH) to you, we will notify you directly and report the incident to the Office of the Privacy Commissioner of Canada (OPC) as required by PIPEDA. We also maintain internal breach records and inform any third parties that can help reduce risk (e.g., law enforcement, financial institutions). Guidance on reporting is available from the OPC: OPC breach response.

Threshold and timing:

• We assess RROSH considering the sensitivity of the data, probability of misuse, and mitigation steps.
• Notices to affected individuals and reports to the OPC are made as soon as feasible after determining a breach occurred.

How we notify you:

• Primary methods include email to your registered address and secure in‑account messaging; we may also use SMS or postal mail if appropriate.
• Content of notice includes what happened, when it occurred, what information was involved, steps we have taken, recommended actions, and how to get more information.

Record‑keeping and coordination:

• We keep a record of all breaches for at least 24 months, as required by PIPEDA.
• Where appropriate, we notify third parties (e.g., payment providers) that can mitigate harm, and we cooperate with regulators.

What are the age limits in Ontario, and how do we handle minors’ data?

In Ontario, the legal age for internet casino gaming is 19+. We do not permit individuals under 19 to open accounts or gamble for real money on our platform. While some gaming activities in Ontario (such as certain lotteries) may have an 18+ age limit, our services require you to be at least 19 years old. We use identity and age verification to prevent underage access and have procedures to close and remediate any account suspected to be used by a minor.

Eligibility and age checks:

• Age threshold: 19+ is required for iGaming in Ontario (AGCO/iGO framework).
• We verify age and identity during registration and may conduct additional checks if risk indicators appear.
• Geolocation is used to confirm you are physically in Ontario when required.

Handling minors’ data:

• We do not knowingly collect personal information from individuals under 19 for iGaming services.
• If we learn a minor has provided information, we will close or block access and delete the data, except where retention is required for legal, security, fraud prevention, or regulatory reasons.
• We respond promptly to verified reports of underage use from parents/guardians or regulators.

Responsible gambling protections:

• Self‑exclusion and account‑level limits are available and are enforced in line with AGCO/iGO standards.
• We provide links to independent help and support resources via iGaming Ontario Responsible Gambling.

Why did this policy evolve in Ontario iGaming, and how will updates work?

Ontario launched a regulated internet gaming market to give players safe, fair, and lawful access while protecting privacy and combating financial crime. Our Privacy Policy reflects evolving obligations under federal privacy law (PIPEDA), Canada’s anti‑money‑laundering law (PCMLTFA) overseen by FINTRAC, and Ontario’s iGaming framework administered by the Alcohol and Gaming Commission of Ontario (AGCO) and conducted and managed by iGaming Ontario (iGO). As standards, guidance, or technologies change, we update this policy to remain accurate, transparent, and protective of your rights.

Who oversees us in Ontario, and how do we align with AGCO, iGO, FINTRAC, and PIPEDA?

Multiple authorities oversee different aspects of Ontario iGaming. We align by maintaining documented privacy and security programs, conducting risk assessments, implementing technical controls (encryption, access management, geofencing), and fulfilling reporting and record‑keeping duties (e.g., AML reports to FINTRAC and breach reporting to the privacy regulator when required). We also enter into operating agreements with iGO and follow AGCO’s Registrar’s Standards for Internet Gaming.

When will we update this policy, and how will you be informed?

We review this Privacy Policy at least annually and whenever there are material changes in law, regulatory guidance, our services, or our data practices. We post the “Last updated” date at the top of the policy and use clear notices for significant changes. Where a change introduces new purposes that require consent, we will request your opt‑in before proceeding.

Triggers for updates:

• Regulatory changes or new guidance from AGCO, iGO, FINTRAC, or the OPC
• New features affecting personal information (e.g., additional analytics or identity checks)
• Vendor or data residency changes that affect transparency obligations

How we inform you:

• In‑product banners or notices and a link to the updated policy
• Email to your registered address for material changes
• Consent prompts when changes require your opt‑in (e.g., new marketing uses)

Your options:

• Review, manage preferences, or withdraw consent for non‑essential processing at any time
• Contact our privacy team if you have questions about the changes

Devil’s advocate: What is the strongest concern about casino data collection, and how do we address it?

The strongest concern is the breadth and depth of data collected by online casinos—identity documents, geolocation, device fingerprints, gameplay and financial telemetry—which could enable intrusive profiling or increase harm if breached or misused, especially when data may be processed outside Canada. We address this by building privacy into design, strictly limiting purposes, and proving compliance through controls and oversight.

Minimization and purpose limitation:

• Collect only what is necessary for lawful play, security, and compliance; no sale of personal information
• Separate AML/security data from marketing systems; marketing is consent‑based and optional

Strong safeguards and governance:

• Encryption in transit/at rest, access controls, vendor due diligence, and continuous monitoring
• Documented retention schedules; default to 5‑year AML retention where required, then delete or de‑identify

Transparency and user control:

• Clear disclosures about cross‑border processing and the vendors involved
• Self‑service tools to access, correct, delete where possible, and manage cookies and marketing preferences

Independent oversight and accountability:

• Subject to AGCO/iGO controls and audits; AML program examined against FINTRAC requirements
• Breach reporting to the OPC when the RROSH threshold is met; internal breach logs retained for at least 24 months

Frequently Asked Questions

Do you use biometric data (selfie/liveness) for KYC, and can I refuse it?

We may use one-time facial liveness or selfie matching strictly to verify identity and age; it is not used for marketing. If you decline biometric checks, we offer manual verification that may take longer, and we retain KYC verification outcomes and timestamps for at least 5 years where they are part of AML records under the PCMLTFA/FINTRAC framework.

Why am I blocked by the geolocation check even when I’m in Ontario?

Typical causes include an active VPN/proxy, disabled device location, corporate or hotel networks that mask location, inconsistent IP versus GPS data, or location-spoofing apps. Disable VPNs and proxies, allow precise location in your browser/app and OS, use a standard home/mobile network, and ensure your device time and region are accurate; AGCO/iGO rules require us to block play when signals suggest spoofing or an out‑of‑province location.

Will you tell me if you filed a suspicious transaction report (STR) about me to FINTRAC?

No. We are legally prohibited from confirming or denying whether a suspicious transaction report was filed (anti‑tipping‑off). AML records related to such reviews are typically retained for at least 5 years, and while you can submit a PIPEDA access request, certain AML investigation details may be lawfully withheld.

In what format can I get a copy of my data and how fast will you respond?

We aim to respond within 30 days under PIPEDA, with a possible extension of up to 30 days if the request is complex. Where feasible, we provide transactions and gameplay data in CSV or JSON, identity document copies as images or PDFs, and a written summary of risk or eligibility decisions with dates and outcomes.

Can I delete my account data even though AML rules require retention?

We delete or de‑identify non‑essential data on request, but KYC and transaction records must be kept for at least 5 years under PCMLTFA/FINTRAC, and certain tax records are generally kept for 6 years per CRA rules. During any mandatory retention, we restrict use to compliance, security, and fraud prevention only.

Are deposits, withdrawals, or account actions decided solely by algorithms?

We use automated risk scoring for fraud, geolocation, and sanctions/PEP screening, but material adverse actions are reviewed by trained staff when law or policy requires. You can request a human review through support, and we maintain dated decision logs to support audits and dispute resolution.

After I unsubscribe from marketing, what messages will I still receive under CASL?

You will continue to receive transactional or safety communications such as receipts, account security alerts, and self‑exclusion confirmations. We process marketing unsubscribes within 10 business days as CASL requires and record your opt‑out to prevent future campaigns.

How do you stop game studios and other suppliers from seeing my full profile?

We share only what is necessary to deliver content, typically a pseudonymous player ID, game session parameters, and technical error details. Supplier contracts prohibit onward use or sale, mandate security controls and limited retention, require sub‑processor approvals, and we log and review access.

What happens to my personal information when I close my account?

Your account is immediately locked, marketing is stopped, and we move your data to restricted storage. AML/KYC and financial records are retained for 5 years, tax records generally for 6 years, and remaining data is deleted or de‑identified once legal and audit holds expire.

Can I use a nickname publicly while my legal name stays private?

You may use a display username in the app, but your legal name collected for KYC must match your payment and withdrawal details. Name mismatches can trigger verification holds or rejected payouts to meet PCMLTFA and AGCO/iGO eligibility requirements.

Do you ever need my Social Insurance Number (SIN)?

We typically do not require a SIN to open or use an account. If a specific legal obligation or identity clarification requires it, we will explain the purpose, limit use to that requirement, apply heightened safeguards, and retain it only for the period necessary under applicable law.

Can I see a log of my recent logins, devices, and IP addresses?

Yes. On request we can provide a summary of sign‑in history, device fingerprints, IP locations, and relevant security events within the standard 30‑day PIPEDA response window, subject to redactions that would reveal security controls or third‑party information.

How do you ensure device fingerprinting for fraud prevention complies with PIPEDA consent rules?

We confine device fingerprinting to security and compliance purposes, minimize the data collected, and apply strict retention and access controls. We do not repurpose these identifiers for marketing without your consent, and any non‑essential tracking honors your cookie consent choices.

What proof will you share in a gameplay or payout dispute without exposing other players’ data?

We can share your session logs, bet and outcome records with timestamps, relevant RNG certification references, and support case notes. We redact personal information about other individuals and conceal security‑sensitive fields to comply with PIPEDA and preserve game integrity.

What source‑of‑funds or source‑of‑wealth documents might you ask for, and how long are they kept?

Depending on risk, we may request recent bank or e‑wallet statements, payslips, employer letters, or other corroborating evidence. When used for AML, copies and verification records are retained for at least 5 years in line with PCMLTFA/FINTRAC requirements.

How is self‑exclusion enforced across systems and communications?

Self‑exclusion status is synchronized to block logins, deposits, and gameplay, and to suppress marketing to zero during the exclusion period. We may share the status with iGaming Ontario or AGCO as required, and retain related records only to enforce protections and satisfy audits.

If Low Deposit Casino is sold or merges, what happens to my data under PIPEDA?

PIPEDA allows transfers during a business transaction without consent when safeguards and limited use are in place. Any successor must protect the data to comparable standards, use it only for the same purposes, and notify you of material Privacy Policy changes that affect your rights.

Can I request the list of third‑party processors and their data locations?

Yes. You can contact our privacy team to obtain a current list of key processors and regions; we disclose material cross‑border transfers and provide details subject to security and confidentiality constraints.

Why do you sometimes ask for a live video call to verify my identity?

A supervised video check confirms liveness, matches your ID to you, and deters document tampering when automated checks flag risk. Verification outputs such as pass or fail, reference numbers, and timestamps may become part of KYC records retained for at least 5 years for AML compliance.

What counts as a “real risk of significant harm” that would trigger a breach notice to me?

We consider the sensitivity of the data and the probability of misuse; exposure of ID documents, financial data, or passwords can create a real risk of significant harm such as identity theft or financial loss. When that threshold is met, we notify you and report to the OPC as soon as feasible, and we keep breach records for at least 24 months.