Version 1.0 — [date]
1. Who is responsible & Privacy Officer
the British Columbia Lottery Corporation (BCLC) is responsible for personal information collected through North Grand Royale. A named Privacy Officer handles access and correction requests, complaints and breach notification.
Email privacy@northgrandroyale.com, or write to the Privacy Officer, the British Columbia Lottery Corporation (BCLC), 74 West Seymour Street, Kamloops, BC V2C 1E2, Canada.
2. What this policy covers
This policy covers personal information collected through this site and its player area, including enquiries, account and verification details. It does not cover third-party sites we link to. Limited information may be shared where the national game requires it.
3. What we collect
We do not seek sensitive categories beyond what verification needs, so please do not send them.
- Account details such as name, date of birth, address and email; passwords are stored only as hashes.
- Verification data: uploaded identification, its type and the result of the check.
- Order and ticket records.
- Payment details limited to method type, last four digits, amounts and references.
- Play, result and prize records.
- Responsible-gambling data such as limits and exclusion status, treated as sensitive.
- Messages you send us.
- Technical data such as IP address, approximate location, device and pages viewed.
- Cookie and consent choices.
4. Why we may collect it — the legal basis for collection
Collection must rest on a lawful ground under applicable provincial privacy legislation: legal authority, a direct operational need, law enforcement purposes, or your consent. In summary:
- Account, play and payment data are needed to operate the service; without them an account cannot work.
- Identity checks and gaming records are required by law.
- Responsible-gambling data supports regulatory duties and your own limits.
- Fraud, security and anti-money-laundering monitoring is not optional.
- Analytics, advertising cookies and marketing rest on your opt-in consent, and the site works without them.
5. How we use it
We use information to run accounts, confirm eligibility, process plays, payments and prizes, operate player-protection tools, meet legal duties and prevent fraud. We do not sell it or pass it on for other organisations' marketing.
6. Identity verification & automated decisions
Identification is used only for age and residency checks, anti-money-laundering duties and fraud prevention, never for marketing. Some checks are partly automated and can pass, flag or refuse a result.
If an automated check goes against you, you can ask for a person to review it by contacting the Privacy Officer.
7. Payment information & PCI DSS
Card details are entered with an approved payment provider that meets industry card-security standards. We keep only the order record: amount, currency, date, status and reference.
8. Service providers & processors
Providers act on our behalf under written contract and our instructions. Categories include identity verification, payment processing, fraud screening, hosting, email delivery, and (with consent) analytics and advertising measurement. We will name specific providers on request.
9. Storage & processing outside Canada
Some providers store or access information outside Canada, where foreign laws may allow authorities to demand it. We limit what leaves the country, prefer Canadian storage where offered and require encryption in transit.
Some information is stored or accessed outside Canada
Any such transfer must still be lawfully authorised, protected by reasonable security and assessed for privacy risk beforehand. Ask the Privacy Officer for the countries involved with a particular provider.
10. Disclosure to government & law enforcement
Disclosure can happen without your consent in limited cases, and sometimes we may not tell you:
- reports to the financial intelligence authority;
- police, on reasonable grounds or lawful demand;
- the Independent Gambling Control Office (IGCO), for audits and compliance;
- tax authorities;
- courts, where ordered or needed for legal claims;
- emergencies involving risk to life or safety.
11. Self-exclusion data sharing
If you join a self-exclusion programme, your details are entered in an exclusion register so it can be enforced. We then stop marketing to you and block play for the exclusion period, and treat the records as sensitive.
12. Marketing & anti-spam rules
Marketing messages follow Canadian anti-spam rules:
- You must opt in with a separate, unticked box, and we record consent.
- Every message identifies the sender and gives contact details.
- Each message has a simple unsubscribe, actioned promptly.
- Nothing is sent to excluded or under-age people.
- Service messages continue after you unsubscribe.
14. How long we keep it
Retention is tied to purpose and legal duty. In summary:
- Account, order and prize records: about five years, to meet record-keeping rules.
- Copies of identification files: about twelve months, after which only the result is kept.
- Responsible-gambling records: about five years.
- Support requests: about three years.
- Login attempts and one-time links: about thirty days.
- Server and security logs: about twelve months.
- Consent record and analytics data: twelve to fourteen months.
15. Your rights & how to exercise them
You hold statutory rights over your information, enforceable through the privacy regulator.
Access
You may request the personal information we hold about you; responses follow statutory deadlines and there is no charge for your own data.
Correction
You may ask us to fix inaccurate information. If we decline, we attach your requested correction to the record.
Withdrawing consent
Where we rely on consent, such as marketing and non-essential cookies, you can withdraw it at any time. Legally required records have no consent to withdraw.
Deletion
You may ask for deletion. We delete what we are not required to keep and explain what must be retained.
Portability
There is no statutory portability right, but on request we provide your data in a common machine-readable format.
Human review of an automated decision
See section 6.
How to make a request
Email privacy@northgrandroyale.com or write to the Privacy Officer at the address in section 1, saying what you want and giving enough detail to find the records.
16. Security
We use encrypted connections, hashed passwords, expiring sessions and restricted storage for documents. No system is perfectly secure, so use a strong unique password and tell us promptly if you suspect compromise.
17. If there is a breach
Where a breach meets the legal threshold we will, without unreasonable delay:
- report it to the privacy regulator;
- tell affected people directly, or by a notice on the site;
- inform other organisations where that reduces risk;
- keep a record of every breach for at least 24 months.
18. People under 19
This service is not for anyone under 19. We do not knowingly collect their information and delete it promptly if we find any.
19. Changes to this policy
The current version is always posted here with its version and date. Material changes get at least 30 days' notice on the site and, where possible, by email.
20. Complaints
Raise concerns with the Privacy Officer first; we acknowledge quickly and reply in writing. If unsatisfied, you can go to the privacy regulator for British Columbia without our permission, either to review a decision on a request or to investigate a privacy complaint.
21. Contact
Privacy Officer, the British Columbia Lottery Corporation (BCLC), 74 West Seymour Street, Kamloops, BC V2C 1E2, Canada. Email privacy@northgrandroyale.com.
For other matters, email support@northgrandroyale.com.
22. Version history
Version 1.0 — [date] — reference draft