Privacy Policy

Who we are

Panda Casino is operated by TigerGen Limited, registered with the Alcohol and Gaming Commission of Ontario (AGCO) under registration No. OPIG1337313 (valid March 24, 2026 – April 3, 2027), offering online gaming in Ontario under an operating agreement with iGaming Ontario (iGO). In this policy, "we", "us" and "Panda Casino" mean TigerGen Limited. Registered office: Level 7, The Plaza Business Centre, Triq Bisazza, Sliema SLM 1640, Malta.

TigerGen Limited is the organization accountable for the personal information described here. We handle it in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) administered by FINTRAC, applicable Ontario law, and the Registrar's Standards for Internet Gaming issued by the AGCO.

Information we collect

We collect only what we need to open your account, keep it lawful and safe, and run the games.

• Registration & identity: first and last name, date of birth, residential street address, city, Ontario postal code, province, email address and mobile phone number.
• Verification (KYC): images or data from government-issued identification, proof of address, and the result of electronic identity checks. Where required, source-of-funds and source-of-wealth information.
• Geolocation: device location signals, IP address, Wi-Fi and GPS data processed by our geolocation provider to confirm you are physically in Ontario at registration and at every login and wager.
• Account & play: balances, deposits, withdrawals, bets, wins and losses, session times, games played, bonus claims and wagering progress.
• Responsible gambling: the deposit, loss and time limits you set, reality-check settings, cooling-off periods, self-exclusion registrations and any BetGuard status returned to us.
• Payment: the payment method type, the name on it, masked card or account identifiers, and transaction references. Full card numbers are handled by regulated payment processors and are not stored on our systems.
• Communications: live chat transcripts, emails, support tickets, and records of your marketing consent or its withdrawal.
• Technical: device type, operating system, browser, language, IP address, cookie identifiers and usage events — see our Cookie Policy.

How we use your information

• To open, operate and secure your account and provide the games and services you ask for;
• To verify your age, identity, address and physical location as required by the AGCO and iGO;
• To process deposits and withdrawals and to detect and prevent fraud and payment abuse;
• To meet our anti-money-laundering obligations, including client identification, record keeping, ongoing monitoring, and reporting to FINTRAC where the PCMLTFA requires it;
• To apply your responsible-gambling settings and enforce self-exclusion, including BetGuard;
• To provide customer support and handle complaints;
• To send you service messages you cannot opt out of (security alerts, limit confirmations, statements, changes to these terms);
• With your express consent, to send marketing and to measure how it performs;
• To improve site performance, game discovery and reliability, using analytics only where you have consented;
• To comply with legal, regulatory, tax and reporting obligations, and to establish or defend legal claims.

Consent & legal basis

Under PIPEDA we rely on your consent, which may be express (you actively opt in) or implied (reasonable from the circumstances), and on the limited exceptions the Act allows.

• Express consent is used for marketing communications (see CASL below), for non-essential cookies, and for any sensitive information such as identity documents.
• Implied consent covers processing that is obviously necessary to deliver the service you asked for — for example crediting a deposit to your balance.
• Without consent, as PIPEDA permits, we may collect, use or disclose personal information to detect or prevent fraud, to comply with a subpoena, warrant or court order, to meet FINTRAC and AGCO obligations, and to investigate a breach of an agreement or a contravention of law.

You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent to identity verification, geolocation or responsible-gambling processing means we can no longer offer you an account, because those uses are conditions of our AGCO registration.

Marketing & CASL

Commercial electronic messages — promotional emails, SMS and push notifications — are sent only where you have given express consent under Canada's Anti-Spam Legislation. Marketing consent is off by default, is requested separately from account registration, and is never a condition of opening an account.

• Every commercial electronic message identifies TigerGen Limited, gives our mailing address and contact details, and contains a working unsubscribe mechanism.
• Unsubscribe requests take effect within 10 business days, as CASL requires, and usually immediately.
• You can also withdraw consent at any time in My Account or by writing to our Privacy Officer.
• We keep a record of when and how you gave or withdrew consent, because CASL places the burden of proving consent on us.
• Transactional and regulatory messages — password resets, deposit-limit confirmations, verification requests, self-exclusion confirmations, changes to these terms — are not marketing and continue regardless of your marketing choices.
• If you self-exclude, all marketing to you stops immediately and your details are suppressed for the duration of the exclusion.

Who we disclose it to

We do not sell your personal information and we do not share it for anyone else's independent marketing. We disclose it only as set out below.

• iGaming Ontario (iGO), as the entity that conducts and manages internet gaming in Ontario, and the AGCO as regulator — including player, account, wagering and responsible-gambling data required under the Registrar's Standards, and complaint files you escalate.
• FINTRAC — the Financial Transactions and Reports Analysis Centre of Canada. Where the PCMLTFA requires it we file large cash transaction reports, large virtual currency transaction reports, electronic funds transfer reports, terrorist property reports and suspicious transaction reports. The law prohibits us from telling you that a suspicious transaction report has been made.
• BetGuard and Ontario self-exclusion registries — see the section below.
• Law enforcement, courts and regulators — where we are legally required to disclose, or where disclosure is necessary to investigate a suspected breach of law or of our terms.
• Payment providers and financial institutions — to process, trace, refund or dispute a transaction.
• Service providers acting on our behalf under written contracts — see the next section.
• Corporate transactions — a purchaser or successor in a merger, acquisition or reorganization, subject to confidentiality and to PIPEDA's business-transaction rules.

Third-party processors

Service providers process personal information only on our documented instructions, only for the purpose we engaged them for, and under contracts that impose confidentiality, security, audit and breach-notification obligations comparable to our own. We remain accountable for the information while it is with them.

To ask which specific providers are engaged at any given time, contact our Privacy Officer.

Where your data is stored, and cross-border transfers

Primary storage. Player accounts, gameplay records, verification records and financial transaction records are hosted in data centres located in Canada (Toronto and Montreal regions), with encrypted backups also held in Canada. Regulatory records required by the AGCO and iGO are kept in Canada.

Access from outside Canada. TigerGen Limited is established in Malta. Members of our compliance, risk, technical and support teams in Malta and in the European Union may access Canadian-hosted data remotely on a need-to-know basis, under access controls and logging.

Transfers to other countries. Some processors listed above operate in the United States and the European Union. PIPEDA permits transfers for processing, provided the organization uses contractual or other means to give the information a comparable level of protection. We use written data-processing agreements, encryption in transit and at rest, minimum-necessary data sharing, and vendor security assessments.

How long we keep it

We keep personal information only as long as needed for the purpose it was collected for, plus any period the law requires. When a retention period ends, records are securely deleted or irreversibly anonymized. Where several periods apply to the same record, the longest one governs.

Closing your account does not delete records we are legally required to retain. If a legal hold, investigation or regulatory request applies, retention is extended until it is resolved.

Self-exclusion and BetGuard data

BetGuard is Ontario's centralized self-exclusion program for the regulated internet gaming market. When you register for BetGuard — through your account with us or directly at betguard.ca — personal information is processed as follows.

• What is collected: your first and last name, date of birth, email address, mobile number, address, a photograph or identity document used to confirm who you are, and the exclusion period you choose.
• Who receives it: the BetGuard program operator, iGaming Ontario, the AGCO, and every operator registered in Ontario's regulated market. This is what makes the exclusion effective everywhere rather than just here.
• What we receive back: confirmation of your exclusion status and its end date, so we can block your account, refuse new registrations and suppress all marketing.
• What we do with it: we close play access immediately, stop all commercial electronic messages, exclude you from every marketing audience, and prevent a new account being opened in your name.
• Legal basis: processing is required by the AGCO's Registrar's Standards. Because it protects you and is mandated by the regulator, it cannot be switched off while the exclusion is in force.
• Retention: for the duration of the exclusion and then for 7 years, so that a permanent exclusion can be honoured permanently and so that we can prove to the AGCO that we honoured it.
• Your rights: you may ask us for a copy of the self-exclusion data we hold. You cannot ask us to delete it while the exclusion is running, and a permanent exclusion cannot be reversed.

Local tools that do not involve BetGuard — deposit limits, loss limits, time limits, reality checks and cooling-off periods — are processed by us alone and are not shared with other operators.

Cookies and similar technologies

We use cookies, pixels, software development kits, device fingerprinting for fraud and geolocation compliance, and browser storage such as localStorage. Strictly necessary and geolocation/compliance technologies run on implied consent because the service cannot be delivered lawfully without them; functional, analytics and marketing technologies run only on your express consent, which you give or refuse in our consent banner and can change at any time. Full detail, including category-by-category descriptions and how to control them in your browser, is in the Cookie Policy.

Security

We apply administrative, technical and physical safeguards proportionate to the sensitivity of the information: TLS encryption in transit, encryption at rest for identity documents and financial records, role-based access control with least privilege, multi-factor authentication for staff, segregated production environments, logging and monitoring, independent penetration testing, and staff training on privacy and AML obligations.

If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected players as soon as feasible, as PIPEDA requires, and will keep a record of every breach for 24 months.

No method of transmission or storage is completely secure. Keep your password confidential, use a unique password, and tell us immediately if you think someone else has used your account.

Your rights

Subject to PIPEDA and the exceptions it allows, you may:

• Access the personal information we hold about you and be told how it has been used and to whom it has been disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw consent to marketing at any time, and to other optional processing;
• Ask us to delete information we are no longer required to keep;
• Ask questions about how your information is handled, and complain if you are not satisfied.

Send requests to our Privacy Officer. We will confirm your identity first, and respond within 30 days as PIPEDA requires; if we need an extension we will tell you why within those 30 days. Access is free for a reasonable request; if a fee would apply we will tell you the cost before we proceed. We may refuse access where the law requires or permits it — for example where disclosure would reveal another person's information, would compromise an AML investigation, or would disclose that a FINTRAC report was made. If we refuse, we will tell you why and how to complain.

Under-19s

Our services are strictly for people aged 19 and over. We do not knowingly collect personal information from anyone under 19. Every visitor passes an age confirmation before entering the site, and every account is age-verified before play. If we learn that an account belongs to someone under 19 we close it immediately, void the play, return the deposited balance in accordance with our Terms & Conditions, and delete the personal information except what we must keep as evidence of the incident. If you believe a minor has used our site, contact our Privacy Officer immediately.

Privacy Officer & complaints

TigerGen Limited has appointed a Privacy Officer who is accountable for our compliance with PIPEDA and for handling access requests and complaints.

If you are not satisfied with our response, you may complain to the federal regulator:

Complaints about gambling conduct rather than privacy go to the AGCO — see Contact AGCO.

Changes to this policy

We review this policy at least annually. If we change it we update the "last updated" date above and post the new version here. Where a change is material — a new purpose, a new category of recipient, a new country of processing or a longer retention period — we will notify you by email or by an in-account notice before it takes effect, and where the law requires it we will ask for your consent again. Previous versions are available from our Privacy Officer on request.