Cookie Policy

Who this policy is from

This Cookie Policy is issued by TigerGen Limited, a limited liability company registered in Malta, trading as Panda Casino, registered with the Alcohol and Gaming Commission of Ontario (AGCO) under registration No. OPIG1337313 and offering online gaming in Ontario under an operating agreement with iGaming Ontario (iGO). Registered office: Level 7, The Plaza Business Centre, Triq Bisazza, Sliema SLM 1640, Malta.

Privacy Officer, TigerGen Limited — privacy@pandacasino.example. This policy sits alongside our Privacy Policy, which explains everything else we do with personal information.

Effective date: March 24, 2026.

What cookies are

A cookie is a small text file that a website asks your browser to store on your device. When you come back, your browser sends the file back, so the site can recognise the session and remember what happened in it. Cookies cannot run programs, cannot read other files on your device, and cannot carry viruses.

First-party vs third-party

A first-party cookie is set by pandacasino.example itself. A third-party cookie is set by another domain whose code runs on our page — an analytics or advertising provider, for example.

Session vs persistent

A session cookie is deleted when you close the browser. A persistent cookie stays for a set lifetime, which we state for each cookie below.

Similar technologies

"Cookies" in this policy also covers the technologies below, which do similar things by different means. Your consent choices apply to all of them equally.

• Pixels and web beacons. A tiny invisible image or snippet embedded in a page or an email. Loading it tells the sender that the page was viewed or the email opened, and from roughly where. We use them in marketing emails only where you have given express consent.
• Local storage and session storage. Browser storage areas that hold more data than a cookie and are not sent with every request. We use localStorage to remember your age confirmation, your cookie choices, your favourites and your interface preferences.
• IndexedDB. A browser database used to cache game assets so tables and slots load faster on your next visit.
• Software development kits (SDKs). Provider code embedded in the game and geolocation clients, which can read and write device identifiers.
• Device fingerprinting. Building a probabilistic identifier from device and browser characteristics — screen size, time zone, fonts, hardware signals. We use fingerprinting for fraud prevention, multi-account detection and geolocation integrity, which our AGCO registration requires. We do not use fingerprinting for advertising.
• Server-side logging. Our servers record IP address, timestamp and request details for security and for proving Ontario boundary compliance. This is not a cookie, but it identifies a device, so we disclose it here.

The five categories

Everything we run falls into one of five categories. Two of them cannot be switched off while you use the site; three of them are entirely your choice and are off until you turn them on.

1. Strictly necessary — always on

Without these the site cannot be delivered. They keep you signed in, protect the session against hijacking and cross-site request forgery, balance traffic across servers, remember your consent choices, and hold your basket of account actions between pages. We rely on implied consent, because you cannot receive the service you asked for without them.

2. Geolocation & regulatory compliance — always on

These confirm that you are physically located in Ontario, that you are the account holder, and that you are not self-excluded. They support the age, identity and location checks that the AGCO's Registrar's Standards for Internet Gaming require, and the fraud and anti-money-laundering controls we owe under the PCMLTFA. They cannot be disabled while you hold an account, because we are not permitted to let you wager without them. If you refuse device location permission, wagering is blocked rather than the check being skipped.

3. Functional — your choice

These remember preferences that make the site nicer to use but are not needed to run it: your language, your game filters and sort order, your favourites list, whether you dismissed a notice, your preferred deposit amount, and reality-check display settings. Turning them off means you will set these again on every visit.

4. Analytics — your choice

These tell us, in aggregate, how the site is actually used: which pages load slowly, where people abandon registration, which categories get used, and what errors occur. Data is pseudonymous and we do not use it to make decisions about an individual player. Turning them off does not change anything you see.

5. Marketing — your choice

These are used only with your express consent to show you offers on and off our site, to avoid showing you the same offer repeatedly, and to measure whether a campaign worked. They may involve third-party advertising platforms, which can combine what they learn here with what they know about you elsewhere. Marketing technologies are never enabled for a player who is under 19, self-excluded, in a cooling-off period, or who has not opted in.

Cookies and storage we set

The list below reflects what runs today. Names and lifetimes can change as providers update their software; the categories and purposes do not change without notice.

Legal basis

Two Canadian statutes govern what we do here.

PIPEDA — Personal Information Protection and Electronic Documents Act

Cookie identifiers that can be linked to an identifiable individual are personal information, so PIPEDA applies. It requires meaningful consent: you must be told what is collected, why, who it is shared with, and what the consequences are, in language you can understand, before you agree. Consent may be implied where the purpose is obvious and non-sensitive — which is why strictly necessary and regulatory cookies run on implied consent — and must be express for sensitive purposes or where a reasonable person would not expect the processing. Functional, analytics and marketing technologies therefore run only on express, opt-in consent.

CASL — Canada's Anti-Spam Legislation

CASL governs commercial electronic messages and the installation of computer programs on someone else's device. Consent is implied for cookies, HTML code, JavaScript and similar programs that a person would reasonably expect a website to install when they visit it — provided their conduct shows that consent. For anything a reasonable person would not expect, and for programs that collect personal information, change settings or interfere with control of the device, CASL requires express consent with a clear description of the program's function and purpose. Our marketing tracking, and any commercial email or SMS we send you, run on express consent under CASL.

We also apply the AGCO's Registrar's Standards for Internet Gaming, which require us to verify age, identity and location, and the PCMLTFA, which requires us to identify clients and monitor transactions. Where a regulator requires processing, we do not offer it as a choice — we tell you plainly that it is mandatory.

How we obtain and store your consent

• On your first visit you pass the 19+ age confirmation, then see the cookie consent banner. Nothing in the functional, analytics or marketing categories loads before you make a choice.
• The banner offers three equally prominent routes: Accept all, Reject non-essential, and Manage preferences. Rejecting is exactly as easy as accepting — we do not use pre-ticked boxes, we do not hide the reject option behind a second screen, and refusing costs you nothing beyond the features described.
• Under Manage preferences each category is listed separately with a plain-language description, and each optional category has its own switch. Always-on categories are shown as locked, with the reason stated.
• Your choice is stored in rp_cookie_consent in browser storage, together with a timestamp and the policy version it applied to, so we can show what you agreed to and when. It lasts 12 months, after which we ask again.
• We ask again sooner if we add a new purpose, a new category or a new third party, or if we materially change how an existing one works. Continuing to browse is never treated as consent to something new.
• Consent is per-browser and per-device. Clearing your browser data clears your choices, and the banner reappears.

Managing and withdrawing your choices

You can change your mind at any time, and withdrawing is as easy as giving consent in the first place.

• Select Cookie preferences at the bottom of any page — or open your cookie preferences now — to reopen the panel and change any optional category.
• Withdrawal takes effect immediately for future processing. Data already collected lawfully before you withdrew is not retroactively erased, but you can ask us to delete it under the Privacy Policy.
• Turning off analytics or marketing does not restrict your account, your bonuses or your ability to play in any way.
• Strictly necessary and geolocation/compliance technologies cannot be turned off while you use the site. If you do not want them, the only option is not to use the service.

Browser and device controls

Independently of our banner, you can control cookies in your browser. Blocking all cookies will break sign-in and stop you playing.

• Chrome: Settings → Privacy and security → Third-party cookies / Site data.
• Safari: Settings → Privacy → Manage Website Data; Prevent cross-site tracking.
• Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data; Enhanced Tracking Protection.
• Mobile: iOS Settings → Apps → Safari; Android Chrome → Settings → Site settings.

You can also reset your advertising identifier (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Privacy → Ads), use private browsing, and opt out at the industry level through the Digital Advertising Alliance of Canada at youradchoices.ca. Some browsers send a Global Privacy Control signal; where we receive one we treat it as a withdrawal of consent to marketing and analytics for that browser.

Opting out of marketing messages (CASL)

Cookie consent and marketing-message consent are separate. Turning off marketing cookies stops advertising tracking; it does not by itself unsubscribe you from email or SMS.

• Every commercial electronic message we send identifies TigerGen Limited, gives our mailing address and contact details, and carries a working unsubscribe link.
• Unsubscribing takes effect within 10 business days as CASL requires, and normally immediately.
• You can also withdraw consent in My Account, or by emailing our Privacy Officer.
• Service and regulatory messages — security alerts, verification requests, limit and self-exclusion confirmations, statements, changes to these terms — are not commercial messages and continue regardless.
• If you register with BetGuard, all marketing stops immediately and your details are suppressed for the whole exclusion period.
• We keep a record of your consent and its withdrawal for 3 years, because CASL places the burden of proving consent on us.

Third parties

Some technologies on this site are operated by other companies, which act as independent controllers of what they collect. Their handling of that data is governed by their own privacy policies, which we encourage you to read.

We do not sell cookie data, and we do not allow third parties to use data collected here for their own unrelated purposes beyond what their platform terms describe. Marketing tags load only after you have given express consent.

Cross-border transfers

Our own site data is hosted in Canada. Several of the third parties above process data in the United States and the European Union, and members of our team in Malta may access it.

PIPEDA permits transfers for processing provided the organization uses contractual or other means to give the information a comparable level of protection. We use written data-processing agreements, encryption in transit and at rest, data minimization, and vendor security assessments.

Supervisory authority

If you are not satisfied with how we handle cookies or your consent, contact our Privacy Officer first. If we do not resolve it, you may complain to the federal regulator:

Updates to this policy

We review this policy at least once a year and whenever we add or remove a technology.

• Minor changes — a renamed cookie, an updated lifetime, a clarified description — are published here with a new "last updated" date.
• Material changes — a new category, a new purpose, a new third party or a new country of processing — reset your stored consent. The banner reappears and asks you to choose again before the new technology loads.
• Where you hold an account and the change is material, we also notify you by email or an in-account message at least 14 days before it takes effect.
• Continuing to browse is never treated as agreement to a new purpose.
• Previous versions are available from our Privacy Officer on request.

Contact

General account questions go to Contact Us. Regulatory concerns go to Contact AGCO.