DraftKings Canada Privacy Policy
DraftKings processes personal data to fulfill legal obligations and provide services. We implement security measures aligned with Canadian data protection standards.
This Privacy Policy establishes the framework for the collection, use, and protection of personal information by DraftKings Casino in its operations relevant to Canadian players. The document outlines our data handling practices to fulfill transparency obligations. It explains the types of personal information processed, the purposes for which it is used, the legal bases for processing, and the security measures employed. The policy also details data retention periods and describes the rights available to individuals regarding their personal information. This policy is designed to comply with applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and other provincial statutes where applicable. It is an administrative document that governs account management, transactional processing, and regulatory compliance.
Data Collection & Types of Information Processed
DraftKings Casino collects and processes personal information necessary to provide its services, operate accounts, and meet legal obligations. The collection occurs during account registration, gameplay, financial transactions, and through technical interactions with our platforms. We categorize the information as follows.
Registration and identity verification data includes information provided directly by the player. This encompasses full name, date of birth, residential address, email address, and telephone number. For verification purposes, we may process government-issued identification numbers, such as a driver's license or passport details, and may request supporting documentation.
Financial and transactional information is processed to facilitate deposits and withdrawals. This includes payment method details, such as credit card numbers, bank account information, e-wallet identifiers, and transaction history. We record the amounts, dates, and times of all deposits, wagers, winnings, and withdrawals.
Technical and usage data is generated automatically during interaction with our services. This includes IP address, device identifiers, browser type, operating system, page view history, and gameplay patterns. We also collect information through cookies and similar tracking technologies.
Compliance and communication records are maintained as part of our regulatory duties. This includes records of customer service interactions, responsible gaming settings, self-exclusion requests, and any documentation related to the investigation of suspicious or fraudulent activity. Records of marketing preferences and consents are also maintained.
Data Usage & Legal Basis for Processing
Personal information is processed for specific, explicit, and legitimate purposes. Each processing activity is conducted under a recognized lawful basis as required by applicable privacy law. The primary purposes and corresponding legal bases are outlined below.
Account administration and service delivery form the core of our processing. We use registration data to create and manage player accounts, verify identity and age, and provide access to gaming services. The legal basis for this processing is the performance of our contract with the player and compliance with legal obligations under gaming regulations.
Financial processing and security are critical functions. Transactional data is used to process deposits, honor withdrawals, and maintain accurate financial records. We process technical and behavioral data to monitor for security threats, fraudulent activity, and to ensure the integrity of our systems. This processing is based on our legitimate interests in securing our services and preventing fraud, as well as legal obligations to ensure fair play.
Regulatory compliance is a mandatory obligation. We process personal information to meet requirements set by regulatory bodies, including age and identity verification, reporting of certain transactions, and maintaining audit trails. We also process data to fulfill responsible gaming commitments and self-exclusion programs. The legal basis for this processing is compliance with a legal obligation.
Communication and service improvement are ongoing activities. We may use contact information to send essential service communications, such as updates to terms or policy changes. With separate consent where required by law, we may send promotional communications. Aggregated and anonymized data may be used for analytical purposes to improve website functionality and game offerings, under the legal basis of legitimate interest.
Data Storage, Security Measures & Retention Rules
DraftKings Casino implements technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. Data is stored on secure servers located in controlled facilities, which may be situated within Canada or in other jurisdictions with adequate data protection frameworks.
Security protocols include encryption technologies for data in transit and at rest. We employ firewalls, intrusion detection systems, and access controls to restrict internal access to personal information on a need-to-know basis. Regular security assessments and audits are conducted to evaluate and enhance our protective measures.
Data retention periods are determined by the purpose for which the information was collected and relevant legal or regulatory requirements. Retention schedules are applied as follows.
| Data Category | General Retention Principle |
|---|---|
| Account Registration Data | Retained for the duration of the account lifecycle and for a legally mandated period following account closure. |
| Financial Transaction Records | Retained for a minimum period as required by financial and gaming regulations, typically seven years. |
| Verification Documentation | Retained as long as necessary for regulatory compliance and fraud prevention purposes. |
| Communication Logs | Retained for a period sufficient to address inquiries and comply with regulatory audit requirements. |
Upon expiry of the applicable retention period, personal information is securely deleted or anonymized so it can no longer be associated with an identifiable individual. Archived data is subject to the same security protections as active data.
Player Rights & Data Access Procedures
Individuals located in Canada have rights regarding their personal information, as provided under PIPEDA and similar provincial laws. DraftKings Casino has established procedures to facilitate the exercise of these rights. To protect privacy, all requests are subject to a verification process to confirm the identity of the requester.
The rights available may include the right to access personal information we hold, the right to request correction of inaccurate or incomplete data, and the right to request deletion of personal information where there is no compelling reason for its continued processing. Players may also have the right to withdraw consent for processing based on consent, without affecting the lawfulness of processing based on consent before its withdrawal.
Additional rights under certain circumstances may include the right to restrict processing, the right to object to processing based on legitimate interests, and the right to data portability, which allows for the transfer of personal data provided to us to another organization in a structured format. Players also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial authority.
To submit a request related to any of these rights, individuals must contact our Privacy Officer using the designated contact method specified in the full policy document. Requests must include sufficient detail to identify the individual and specify the right being exercised. We will respond to requests within the timelines stipulated by law. There is typically no cost to exercise these rights, though we may charge a reasonable fee if a request is manifestly unfounded or excessive.