The Data Controller
GBL Solutions N.V., which runs TuffPuff under licence OGL/2024/589/0556 from the Curaçao Gaming Authority, is the controller of your personal information. That means it decides the purposes for which your data is used and carries the responsibility for keeping it secure. Any question or request about privacy can be sent through live chat or the site's contact form, and support will route it to the people who handle data protection matters.
Legal Framework
For Canadian players the federal privacy statute, known by its abbreviation (PIPEDA), sets the baseline,, supported where relevant by the provincial private-sector laws in force in Alberta, British Columbia and Quebec. Together these laws require a clear purpose for each type of data collected, limit its use to that purpose and demand safeguards that match how sensitive it is.
The operator is also bound by the data obligations in its gaming licence and in anti-money laundering law. Residents of the European Economic Area (EEA) receive additional protection through casino GDPR compliance, which gives them the rights set out in European rules. In day-to-day practice, no account receives a lower standard of protection because of where its owner lives.
What We Collect
| Type of Information | Examples | When It Is Collected |
|---|---|---|
| Identity details | Name, date of birth, ID documents | Sign-up and verification |
| Contact details | Email, phone number, home address | Sign-up and profile updates |
| Financial records | Deposits, withdrawals, payment method ownership | Each cashier transaction |
| Gaming activity | Bets, game sessions, bonuses, limits set | Ongoing while you play |
| Technical data | IP address, device, browser, pages visited | Every visit to the site |
At registration you supply your name, birth date, email, phone number, address, province and currency. Verification adds copies of your ID, a document confirming your address and proof that the payment method is yours. Once you start playing, the platform keeps a log of payments in and out, wagers, bonus use, conversations with support and the responsible gambling settings you choose. Technical details such as the device you use and the length of each session are logged automatically.
Card and wallet data are processed mostly by the payment companies you select. The casino is told that a payment succeeded and gets the reference it needs to link the transaction with your profile, while complete card numbers remain with the payment partner and are not kept on the casino's own servers.
Why Your Data Is Used
Your information allows the operator to open and run your account, handle payments, deliver games and sports bets and apply the promotions you join. It is also needed to confirm your age and identity, prevent fraud, meet anti-money laundering duties and keep the records the licence demands.
Patterns in your play are watched for signs of harm, such as sudden jumps in deposits or very long sessions, so that support can suggest a limit or a break when it may help. Aggregated data shows which games and features players value and where technical issues appear. If you have opted in, your contact details are used to tell you about promotions, and you can opt out at any time in your account settings or with the link included in every message.
Automated Screening
Some checks run automatically. New registrations are compared with age, identity and sanctions databases, and payments pass through fraud filters that look for stolen cards or account takeovers. These tools help staff decide, but they do not make the final call alone. If a check results in a restriction, such as a paused withdrawal or a request for extra documents, a staff member looks at the case, and you can ask support to explain the decision and provide information that might change it. Marketing profiles, such as choosing which offers to show you, are only built when you have agreed to receive promotions.
Data Minimisation
The guiding principle is to collect only what is genuinely needed. The sign-up form asks for the details required by law and for running the account, nothing more, and optional fields stay optional. Documents uploaded for verification are used to confirm your identity and kept for the period the rules demand, not mined for unrelated purposes. When a supplier no longer needs access to certain records, that access is removed. Internal teams work with anonymised or aggregated figures wherever a task can be done without knowing who a player is, which reduces the harm if anything ever goes wrong.
Sharing With Third Parties
Data is passed on only for a clear reason. Payment providers get what they need to complete a transaction, identity checking services see the documents required to confirm who you are, and studios and the betting platform get only a pseudonymous player ID so results can be credited correctly.
The operator may also disclose information to the Curaçao Gaming Authority, police, financial intelligence units or courts whenever a legal duty or a licence condition obliges it to. Hosting providers, auditors and legal advisers can access limited data in the course of their work, and each of them is bound to keep it confidential. Your personal information is never sold for third-party marketing.
Transfers Outside Canada
With its head office in Curaçao and suppliers spread over several countries, the operator may need to move data abroad, meaning your details are not always stored on Canadian soil. In those cases, contracts and technical measures are used so that the protection your data receives is comparable to what Canadian law expects. Data stored in another country may still be subject to the laws there, including lawful requests from local authorities.
Keeping Data Secure
Player data security starts with the connection itself: every page is served over SSL, and sensitive records are encrypted at rest as well. Only staff whose role requires it can open personal files, and an audit trail records who opened what. Players rightly expect data encryption in online casinos, so on this site it is combined with firewalls, periodic penetration tests and alerts that fire on unusual sign-in attempts.
No technology is perfect, so your own habits also count. Choose a password you use nowhere else, keep it to yourself and sign out on shared devices. If you believe someone has got into your account, tell support straight away so the account can be locked and secured.
How Long Records Are Kept
Records stay on file for the life of your account and for some time once it has been closed, as the law and the licence require. Anti-money laundering rules generally oblige the operator to keep identity and transaction records for several years after closure. When that period ends, the data is deleted or anonymised so it can no longer identify you. Marketing preferences are removed earlier if you withdraw your consent.
Your Rights Over Your Information
Under Canadian law you may request a copy of the personal data the operator holds on you, along with an explanation of how it was used and which organisations received it. You can have inaccurate details corrected and withdraw consent for optional uses such as marketing, although processing required by law must continue while the account exists. Send requests through support, and you will receive an answer within the legal deadline, normally 30 days.
Among your player privacy rights is the ability to escalate. If you feel a request was mishandled, the federal Privacy Commissioner and your provincial privacy office both accept complaints, and EEA residents may approach the supervisory authority in their home country.
Cookies
Cookies and similar technologies keep you signed in, save your language and currency, measure visits and show which features get the most use. The casino cookie policy splits them into two groups: strictly necessary cookies, which the site needs to work and which cannot be switched off, and analytics or advertising cookies, which load only with your permission. Preferences can be adjusted later through the consent banner or browser settings, though turning off some cookies may affect parts of the site.
Promotional Messages
Promotional emails and SMS go out exclusively to players who opted in, and every message carries an unsubscribe option, and you can also turn marketing off in your profile. Anyone who self-excludes stops receiving promotional messages for the full period of the exclusion.
Under-Age Users
Nobody under the provincial gambling age may use the site; that age is 19 in most provinces and 18 in Alberta, Manitoba and Quebec. Data from minors is never collected on purpose, and if a profile turns out to be held by a minor, it is shut down and the information dealt with in line with legal requirements.
Updates to This Policy
The policy is revised when services, suppliers or legal requirements change. You can always find the latest text on the site, dated from the day it took effect, and a notice by email or at your next sign-in flags any substantial change.
Our Commitment to Online Casino Privacy
For us, online casino privacy is a matter of trust before it is a matter of law. Players share identity documents and financial information, and they are entitled to fair and transparent casino policies that say exactly what is done with them. Being a TuffPuff secure online casino means running a secure gaming platform that works to protect personal information at every stage, from the first form you fill in to the final payout. Questions about this TuffPuff privacy policy can be sent to support at any hour.