1. Introduction and Scope

SportGate ("we," "our," or "us") operates the online sports wagering and gaming entertainment portal at sportbetgate.com. This Privacy Policy governs the collection, processing, storage, and transfer of personal information collected from users resident in Canada and other permitted operational territories. We structure our data handling practices in compliance with Canadian privacy legislation, specifically the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy acts, and international data protection standards including the General Data Protection Regulation (GDPR).

By accessing our services, creating a player profile, placing wagers across our online sports betting markets, or using payment interfaces, you acknowledge the data collection and processing methods detailed in this policy. If you do not agree with any element of this policy, you must discontinue platform use and request profile closure through customer support.

2. Personal Data We Collect

To operate a compliant sports wagering platform and satisfy statutory Anti-Money Laundering (AML) and Know Your Customer (KYC) obligations, SportGate collects distinct categories of personal data throughout your lifecycle on the site.

2.1. Directly Provided Registration and Identification Data

• Full Legal Identity: Legal first name, middle name, surname, date of birth, biological sex, and residential street address with postal code. Date of birth is validated at registration to enforce the legal age requirement (19+ in most Canadian provinces, 18+ in Alberta, Manitoba, and Quebec).
• Contact Credentials: Primary email address, mobile telephone number, and communication language preferences.
• Identity Verification Records: High-resolution digital scans or photographs of government-issued photo identification (provincial driver's licence, Canadian passport, or permanent resident card), accompanied by recent proof of residency documentation (utility invoices or bank account statements issued within the prior 90 days).
• Source of Wealth and Funds Documentation: Where cumulative deposit thresholds or statutory risk triggers are reached, notarized payslips, tax assessment notices, or verified bank account statements detailing the origin of deposited capital.

2.2. Financial and Transactional Records

• Payment Identifiers: Truncated payment card numbers (retaining only the first six and last four digits in accordance with PCI DSS Level 1 requirements), cardholder names, expiration dates, Interac e-Transfer transaction references, and cryptocurrency wallet destination hashes used across our cryptocurrency betting options.
• Ledger Records: Comprehensive logs of all financial transactions, including deposit timestamps, approved withdrawal requests, pending balances, wager stakes, betting ticket IDs, settle outcomes, promotional redemptions, and active wagering turnover tallies.

2.3. Automatically Collected Technical and Device Data

• Network and Hardware Identifiers: Internet Protocol (IP) address, Internet Service Provider (ISP), device hardware model, operating system build, browser family and version, screen resolution, time zone offset, and primary language settings.
• Geolocation Telemetry: Precise or approximate location data derived from IP lookups and cellular/Wi-Fi positioning interfaces to confirm physical presence within authorized Canadian jurisdictions and enforce geographic ring-fencing rules.
• Telemetry and Interaction Metrics: Session start and end timestamps, clickstream logs, pages viewed, time spent per betting category, and error diagnostics generated during active platform navigation.

3. Legal Grounds for Data Processing

SportGate processes collected information under four distinct legal justifications:

• Performance of Contractual Obligations: Processing your personal data is necessary to open and service your account, process financial deposits and payouts, settle wagers, and administer rewards according to our general terms.
• Compliance with Legal and Regulatory Mandates: Processing required under provincial gaming regulations, federal Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) requirements, Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) reporting obligations, and responsible gaming self-exclusion monitoring as outlined in our responsible gambling policies.
• Legitimate Business Interests: Maintaining platform infrastructure security, detecting multi-accounting fraud, auditing risk exposures, preventing syndicate wagering, optimizing server loads, and conducting anonymous statistical performance analytics.
• User Consent: We seek explicit consent before transmitting optional marketing newsletters, promotional SMS alerts, or activating non-essential third-party advertising cookies. Consent can be updated or revoked at any time via your account profile settings.

4. Cookie Policies and Tracking Technologies

Our website uses session cookies, persistent preference cookies, and security tokens to maintain session integrity and protect user accounts against cross-site request forgery (CSRF).

• Essential Cookies: Required for secure login authentication, cart preservation for bet slips, and load balancing across operational servers. These cannot be disabled in platform settings.
• Performance and Analytics Cookies: Anonymous telemetry tools (including self-hosted analytics engines) that aggregate interaction flows to identify performance bottlenecks and broken links without tracking personally identifiable user profiles.
• Preference Cookies: Store localized site selections, including odds format preferences (American, Decimal, or Fractional) and regional event feeds.

5. Third-Party Data Disclosures and Transfers

SportGate does not sell, trade, or rent personal user databases to external commercial entities. Disclosures are limited strictly to certified service providers operating under executed Data Processing Agreements (DPAs):

• Identity Verification and Fraud Detection Vendors: Third-party KYC verification platforms used to confirm identity legitimacy and cross-reference international sanction databases and Politically Exposed Persons (PEP) registries.
• Payment Gateways and Financial Institutions: PCI-certified payment processing partners, Canadian Interac settlement networks, and blockchain verification nodes necessary to facilitate fund transfers.
• Regulatory Authorities and Law Enforcement: Provincial gaming regulators, FINTRAC, or judicial bodies when formal discovery orders or statutory reporting thresholds require disclosure.

6. Data Retention and Security Architecture

All sensitive personal documents and database records are secured using TLS 1.3 cryptographic transport protocols in transit and AES-256 encryption at rest. Multi-factor access controls and network firewalls restrict internal employee data access to authorized compliance and security personnel on a strict need-to-know basis.

In accordance with statutory gaming and AML record-keeping obligations, basic account identity, financial logs, and transaction records are retained for a minimum of five (5) to seven (7) years following account closure. Upon expiration of mandatory retention horizons, associated database records and document scans are permanently purged using secure cryptographic erasure protocols.

7. User Privacy Rights

Subject to statutory limits imposed by gaming regulations and AML reporting duties, users in Canada and other applicable jurisdictions hold specific rights regarding their personal data:

• Right to Access: You may request a machine-readable export of all personal data currently stored in our active database tables.
• Right to Rectification: You may correct inaccurate or outdated residential addresses, contact numbers, or payment identifiers via the account dashboard or compliance support.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of non-essential profile data, provided mandatory regulatory retention periods for financial transaction records have expired.
• Right to Object or Restrict Processing: You may opt out of automated profiling algorithms and promotional communications at any point.

8. Contacting the Data Protection Officer

For inquiries regarding this Privacy Policy, formal data access requests, or regulatory privacy concerns, contact our Data Protection Officer directly via email at [email protected]. All formal access and correction requests are processed within thirty (30) calendar days of identity verification.

4. Security Protocols and Technical Safeguards

SportGate employs multi-layered technical, physical, and administrative measures engineered to protect personal records against accidental loss, unauthorized access, destruction, and unlawful disclosure. Every interactive session across our web platform and mobile services is secured through Transport Layer Security (TLS 1.3) protocols utilizing 256-bit cryptographic keys, ensuring complete encryption of transmitted credentials, financial instructions, and session tokens.

Internal access controls strictly compartmentalize all stored information. Direct database inspection is restricted to authorized personnel operating under verified operational necessity and legally binding non-disclosure agreements. Infrastructure perimeters are monitored continuously via automated intrusion prevention systems, rate-limiting layers, and audited logging architectures. Payment processing relies entirely on Level 1 PCI-DSS-compliant transaction gateways, preventing raw payment card details from persisting on non-essential operational servers.

5. Data Retention Schedules

Personal data is retained solely for the duration necessary to deliver authorized account services, resolve dispute procedures, enforce platform rules, and satisfy mandatory legal obligations applicable within Canada and international jurisdictions. Key retention windows include:

• Active Account Information: Registration details, profile identifiers, and communication logs remain active throughout the operational lifecycle of your user account.
• Financial and Transaction Records: Deposit verifications, withdrawal logs, crypto transaction hashes, and payment confirmations are archived for a minimum period of seven (7) years to comply with statutory accounting and financial audit requirements.
• Anti-Money Laundering (AML) and Identity Verification Files: Government-issued identification, utility documentation, and verification results processed under FINTRAC standards are maintained for five (5) to ten (10) years following account termination.
• Responsible Gaming Exclusion Registers: Records concerning mandatory cool-off periods, deposit caps, and permanent self-exclusions established under our responsible gaming framework are preserved indefinitely or across defined operational periods to enforce player safety measures.
• Marketing and Behavioural Telemetry: Anonymized interaction metrics and analytics telemetry are purged or fully aggregated into non-identifiable statistics within twenty-four (24) months of collection.

6. Individual Privacy Rights

Under Canadian federal privacy regulations (PIPEDA), provincial privacy legislation, and corresponding global data standards, registered users and site visitors hold distinct statutory rights regarding the management of their personal data:

• Right of Access: You may request formal confirmation regarding whether your personal records are being processed, alongside an itemized digital transcript detailing the categories of collected data, associated processing purposes, and authorized recipients.
• Right to Rectification: If profile details, addresses, or contact information contain inaccuracies or omissions, you hold the right to request swift correction. Basic profile elements can also be updated directly inside your account settings.
• Right to Erasure (Right to be Forgotten): You may request the irreversible deletion of your personal records. Please note that erasure requests cannot override statutory obligations requiring data retention under AML, fraud prevention, or financial compliance mandates.
• Right to Lodge a Complaint: Beyond direct engagement with our Data Protection Officer, you may escalate unresolved concerns to the Office of the Privacy Commissioner of Canada or the applicable provincial regulator without first exhausting our internal review process, though we encourage contacting us first so concerns can typically be resolved faster through direct correspondence.
• Right to Restrict Processing: Where you contest the precision of specific personal data or the legitimacy of ongoing processing, you may demand temporary operational suspension while verification is conducted.
• Right to Data Portability: You are entitled to receive your personal data in a structured, commonly used, and machine-readable format (such as JSON or CSV), with the option to transmit these records directly to an alternative provider where technically feasible.
• Right to Withdraw Consent: Where data handling relies exclusively on explicit consent (such as voluntary marketing communications), consent may be rescinded at any moment via automated profile settings or direct notification to our privacy team.

7. Cross-Border Data Transfers

Because SportGate operates distributed cloud server architectures and collaborates with specialized international analytics, fraud-detection, and hosting vendors, your personal records may be processed or stored outside your home province or country. When information crosses territorial borders, we execute formal contractual guarantees, including standardized data protection clauses and stringent technical verifications, to guarantee that recipient facilities maintain protective standards equivalent to Canadian privacy principles.

7a. Breach Notification Procedures

Should a security incident occur that compromises the confidentiality, integrity, or availability of personal data in a manner creating a real risk of significant harm, SportGate will notify affected individuals and the Office of the Privacy Commissioner of Canada without unreasonable delay, in keeping with the breach reporting obligations under PIPEDA. Notifications describe the nature of the incident, the categories of data involved, the mitigation steps undertaken, and practical measures individuals can take to limit resulting exposure, such as monitoring account activity or updating payment credentials. Internal incident logs documenting every reportable breach are retained for a minimum of twenty-four (24) months to support regulatory audits.

8. Contacting the Data Protection Officer

Inquiries, access requests, rectification demands, or formal complaints regarding our data governance policies should be directed to our dedicated Data Protection Officer (DPO). All formal privacy requests are acknowledged within forty-eight (48) hours and processed within thirty (30) calendar days:

• Direct Privacy Email: [email protected]
• Operational Inquiries: Accessible via our secure support portal reviewed on the about our platform overview.
• Regulatory Escalation: If you believe your privacy concerns have not been adequately resolved, Canadian residents retain the right to submit a formal inquiry to the Office of the Privacy Commissioner of Canada (OPC) or relevant provincial oversight commissioners.