Controller of Your Information
GBL Solutions N.V., which runs the site under Curaçao Gaming Authority licence OGL/2024/589/0556, decides how and why player information is processed. In this TuffPuff privacy policy, "we", "us" and "our" refer to that company.
We have appointed a privacy contact who handles requests, questions and complaints about personal data. Requests reach that person through the chat window or the written enquiry form, and your message will be logged and answered within the periods set by law.
The Legal Framework
Because our players live in Canada, we follow the Personal Information Protection and Electronic Documents Act, known as PIPEDA, together with any provincial privacy laws that apply where you reside. These laws require us to obtain meaningful consent, collect only what we need, keep information accurate and protect it with appropriate safeguards.
Our licence in Curaçao adds its own obligations, including identity checks and anti-money laundering controls, and these shape some of the processing described below. Casino GDPR compliance becomes relevant only if a person located in the European Economic Area interacts with our services, in which case the rights granted by that regulation apply to them as well.
Details We Collect
We collect personal information in three ways. Some comes directly from you, some is generated automatically while you use the site, and some is supplied by trusted third parties.
At sign-up you provide your legal name, birth date, email, mobile number, street address and province. During verification you upload copies of identity documents and proof of address, and in certain cases evidence of where your funds come from. When you contact support, we keep the content of chats, emails and any attachments.
Information generated through your use of the site covers deposits, withdrawals, bets, game sessions, bonuses claimed and responsible gambling settings. Technical details such as your IP address, browser type, device model, operating system and approximate location are recorded when you log in or navigate between pages.
Information from third parties includes confirmation from payment providers that a transaction succeeded, results from identity and age verification services, and alerts from fraud prevention databases.
We do not intentionally collect sensitive categories of information such as health data, religious beliefs or political opinions. Please avoid including them in messages to support.
Why We Use Your Information
Each use of personal data has a defined purpose, and we do not process information in ways that are incompatible with the reason it was collected.
| Purpose | Information Involved | Basis |
|---|---|---|
| Opening and running your account | Contact details, login records, settings | Performance of our agreement |
| Confirming age and identity | ID documents, birth date, address | Licence and legal duties |
| Processing payments | Transaction history, payment method details | Performance of our agreement |
| Preventing fraud and money laundering | Device data, transaction patterns, third-party checks | Legal duties and legitimate interests |
| Supporting safer play | Session length, deposit trends, limits | Licence duties and player protection |
| Sending offers | Email, phone, promotion history | Your consent, which you can withdraw |
| Improving the site | Anonymised usage statistics | Legitimate interests |
Some of these checks run automatically. For example, our systems may flag unusual deposit activity or repeated logins from different countries for manual investigation. A member of staff always looks at a flagged case before any decision with significant effects, such as closing an account, is taken.
Sharing Information With Others
We never sell player data. We share it only where it is needed to run the service, to meet legal obligations or with your permission.
Payment processors and banks receive the details required to complete deposits and withdrawals. Identity verification and fraud prevention services receive what they need to establish your identity. Suppliers of games and betting software get only limited data, such as a player identifier and bet history, so they can deliver games and settle wagers. Hosting providers and IT contractors store and maintain our systems under strict confidentiality agreements.
Where a legal obligation exists, we will hand information to our regulator in Curaçao, to the police or to a court. Professional advisers, including auditors and lawyers, may access records when providing services to us, always under a duty of confidentiality.
Every external partner is bound by a written agreement that restricts how they may use the information and requires them to protect it to a standard at least equal to ours.
Transfers Outside Canada
Some of our partners operate servers in other countries, which means some records can end up on computers located beyond Canadian borders. When that happens, we use contractual safeguards to ensure the data remains protected. Please be aware that information held abroad may be accessible to authorities in that country under local law.
Security Measures
Player data security is built into the way we operate. All connections to the site use SSL encryption, and data encryption in online casinos also extends to sensitive records stored on our servers. Only staff whose job requires it can open player records, and our systems keep a log each time they do.
Our infrastructure is protected by firewalls, intrusion detection and regular vulnerability testing. Payment card details are handled by certified payment providers rather than kept in our own database. Staff receive training on confidentiality and on recognising phishing attempts.
Together these steps define the TuffPuff secure online casino approach and keep this a secure gaming platform. No technology can promise perfect protection, so if an incident could seriously hurt the people concerned, we will inform the people affected and report it to the proper regulators within the legal deadlines.
You can help protect your account by choosing a strong password, keeping it private and signing out after using a shared device.
How Long We Keep Records
We keep personal information only for as long as necessary. Licensing and anti-money laundering obligations mean that account, payment and verification files normally stay on record for five years or more following closure. Chat transcripts and support emails are kept for as long as needed to resolve the issue and to defend potential claims. Marketing preferences are removed as soon as you opt out, apart from a suppression record that prevents us from contacting you again.
When the retention period ends, records are securely erased or stripped of anything that could point back to you.
Player Privacy Rights
Under PIPEDA and applicable provincial laws, you have meaningful player privacy rights. You can ask what personal information we hold about you and how it has been used. You can request corrections if anything is inaccurate or incomplete. You can withdraw consent for optional processing such as marketing, and you can ask us to explain how a particular decision involving your data was reached.
Some requests may be limited by legal obligations. For example, we cannot delete verification records before the mandatory retention period ends. Where we refuse a request, we will explain why.
To exercise these rights, contact our privacy contact through live chat or the form on casinos-tuffpuff.ca. We may ask for proof of identity first to protect your information from unauthorised access. Should our answer leave you dissatisfied, the federal Privacy Commissioner can examine your complaint.
Casino Cookie Policy
Cookies are small files saved on your device that help the site work and remember your choices. Essential cookies keep you logged in, protect the cashier and remember your language. Analytics cookies tell us which pages are used most so we can improve navigation, and marketing cookies measure how players reach us through partner sites.
Our casino cookie policy gives you control. Optional cookies load only after you agree, and you may adjust that choice whenever you like using the consent banner or the settings in your browser. Turning off essential cookies may prevent parts of the site, such as the cashier, from working correctly.
Marketing Communications
We send promotional emails, text messages or push notifications only to players who opted in. Every message carries an unsubscribe link, and you can also update your preferences in the account section. Players who self-exclude or set a cooling-off break automatically stop receiving marketing for the full duration.
Service messages, such as verification requests, security alerts and changes to our terms, are not marketing and will still be sent while your account is open.
Underage Users
Play is reserved for adults of legal gambling age, meaning 19 in the majority of provinces and 18 in Quebec, Alberta and Manitoba. We never aim to gather details from anyone younger. Should an underage registration come to light, we shut the account and erase its records unless a legal duty obliges us to hold them.
Updates to This Policy
We may revise this policy when our services, partners or legal obligations change. The date of the latest version is shown on this page, and significant updates are announced by email or a notice on the site before they take effect.
Our Commitment to Online Casino Privacy
Online casino privacy is part of the trust between a player and a gaming site. Our goal is to protect personal information as carefully as we protect balances, and to follow fair and transparent casino policies that anyone can read and understand. TuffPuff Casino data protection is checked regularly against legal changes and new security threats, so that the rules on this page always match what happens in practice.