SpinBlitz Privacy Protocol

Data We Collect and the Legal Basis for Each Field

SpinBlitz collects only the data categories necessary to run a compliant sweepstakes platform in Canada. There are no silent trackers, no advertising fingerprints resold to third parties, and no data broker relationships. The flow diagram below maps each collected data class through the platform end to end so you can see exactly where each field originates and where it eventually gets stored. If you would like to understand the sweepstakes framework that drives some of these obligations, the compliance framework unpacks the AMOE and KYC pipeline in depth.

Every data field is collected under one of three legal bases: contract performance (you cannot receive a service without providing the data), legal obligation (federal or provincial law requires the collection), or explicit consent (marketing communications, cookies beyond strict necessity). Every field we collect is tagged with its legal basis in the table below, and you can withdraw consent for the third category at any time from your account privacy centre.

The most important field to understand is the KYC identity document class. This category is legally required under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its associated regulations, which is why the platform cannot process an SC redemption without it. The retention window for this class is legally fixed at seven years post-account-close under federal recordkeeping rules — this is not a platform choice, it is a statutory requirement.

Retention Windows Across Every Data Class

Retention is where most privacy policies get vague, so we have committed to concrete numbers. The ring dials below map the retention window of each major data class against a common horizon of ten years post-account-close, giving you a proportional visual sense of how long each class is retained. Session telemetry — the most detailed and privacy-sensitive class — is retained the shortest window at thirteen months. Financial-metadata records are retained the longest at seven years, driven by federal AML statute. Marketing preferences are the only class that can be zeroed out on demand via the data-request support desk.

Retention is also actively enforced. A scheduled purge job runs quarterly and irreversibly deletes any record beyond its retention window across every storage tier — hot databases, warm archives, and offline backups. No shadow copies are preserved. If you request a Right-to-Erasure invocation under PIPEDA, everything except statute-locked classes is deleted immediately and the retained locked classes are documented in a written response so you know exactly what remains.

The three data classes commonly assumed to have short retention but actually held longer are payment metadata (seven years, AML statute), account chargeback history (seven years, banking-relationship compliance), and any dispute-related communication (three years, evidentiary requirements). Everything else falls into standard shorter windows and is deleted well within a year of account close.

Your Rights and How to Exercise Them Under PIPEDA

Canadian federal privacy law grants every player a set of enforceable rights: access to your personal data, correction of inaccurate data, withdrawal of consent, complaint to the Privacy Commissioner, and — for non-statute-locked classes — the Right to Erasure. The stat tiles below summarise the practical response windows we commit to for each right, all of which are shorter than the statutory maximum. If a request touches a class that is legally retained, we tell you which class and cite the statute; nothing is hidden.

The Right of Access — often called a Data Subject Access Request — is the most-invoked right. A machine-readable export of every field associated with your account is delivered within fifteen calendar days of a valid request. The export includes every data class, its stored value, its collection date, its legal basis, and its retention deadline. You can invoke this from your privacy centre without opening a support ticket, but you can also request it through the account creation form if you already have an account creation flow open.

Corrections are equally straightforward and are usually applied within seventy-two hours. The only category that requires additional identity confirmation before correction is the KYC identity class — legally we cannot amend a stored KYC record on request alone, we need supporting evidence such as an updated government document. That is a statutory requirement rather than a platform choice.

Cookies, Trackers, and What We Consciously Don't Do

The cookie footprint on SpinBlitz is deliberately minimal. The table below lists every cookie the platform sets, its purpose, its expiry, and its category classification. There are no third-party advertising cookies, no cross-site tracking pixels, and no fingerprinting scripts running in the background. If you enable a strict-blocking browser extension, the platform still works — every strictly-necessary cookie is a first-party session cookie that browsers keep even under strict blocking policies. If you would like to walk through the data collection categories separately, the earlier section on legal basis handles that dimension. You can also review the corresponding terms document for the corresponding contractual clauses.

The one commonly-requested feature we deliberately do not ship is a personalised advertising infrastructure. Some competing platforms build behavioural profiles that are then either used internally for lifetime-value modelling or sold onward to third-party advertising exchanges. SpinBlitz does neither. The internal analytics pipeline runs on anonymised behaviour aggregates only, and no data class touches an advertising exchange under any circumstances. This is a stronger posture than PIPEDA strictly requires and it is a deliberate business choice.

The second thing we do not do is silent device fingerprinting outside the session context. When you log in, the fingerprint anomaly detector reviewed earlier compares your active session to prior sessions on the same account — that is a security measure, not a marketing measure, and the fingerprint is not shared with any third party. When you are not logged in, no fingerprint is captured at all, which means the platform genuinely does not know who you are until you authenticate.

Finally, we do not sell derived data insights to sweepstakes-industry research firms. Aggregate metrics such as median RTP or median session length may appear in industry reports written from public sources, but no player-level or account-level derived data leaves the platform in any form. This is a hard commitment rather than a soft preference, and it is embedded in the operations agreement each vendor signs before receiving even anonymised access.

Frequently Asked Questions

Frequently asked questions about how the platform collects, stores, and processes your personal data under Canadian privacy law.

Ready to move on? the corresponding terms document covers what naturally follows this section.

How This Policy Interacts With Provincial Privacy Statutes

PIPEDA is the federal baseline for privacy law in Canada, but three provinces — British Columbia, Alberta, and Quebec — have deemed-equivalent provincial legislation that adds specific obligations on top of the federal framework. If you are a resident of one of those provinces, both statutes apply concurrently, and the platform honours the higher standard whichever way the two frameworks diverge. Reviewing the account creation form first is worthwhile because signup captures the province of primary residence, which anchors which statute set applies to your account.

Quebec's Loi 25 (Bill 64) introduces additional obligations around automated decision-making disclosure and mandatory data-breach notification, both of which are inherited into how SpinBlitz processes Quebec-resident accounts. British Columbia's PIPA and Alberta's PIPA impose parallel rules around consent granularity that are also honoured. The compliance officer is available through the standard support channel to walk through the specific interaction between federal and provincial law if a specific question arises.

One consequence of the multi-statute posture is that your rights are always the union of applicable statutes, never the intersection. If PIPEDA grants a fifteen-day access-request response window and Quebec's Loi 25 grants a shorter window, the shorter window applies to Quebec residents. Practically, this means your effective rights are stronger, not weaker, if you happen to live in a province with additional privacy legislation on the books.

A Closing Note on Trust

Privacy policies are contracts of trust as much as they are documents of legal obligation. This policy is written to be read, not to obscure — every commitment enumerated on this page is one we intend to keep in operational reality, not just on paper. If we ever change the policy in a way that materially alters your rights, you will hear about it through the notification pipeline documented earlier, and the change window will give you time to react. That is the deal we offer, and we intend to honour it consistently across the lifetime of your account.