Privacy Policy

OBSERVE: This Privacy Policy explains how napoleon-casino on napoleon-ca.com collects, uses, discloses, and protects personal information. EXPAND: It applies to players and website visitors in Canada who interact with our services. REFLECT: Effective date: 1 January 2025.

Who We Are

OBSERVE: The data controller for the Canadian-facing website napoleon-ca.com is Napoleon Games NV, a company incorporated in Belgium and part of the Superbet Group. EXPAND: Napoleon Games NV operates online casino services under Belgian Gaming Commission licence A+8105 (verification available via the Belgian Gaming Commission). Corporate registration particulars are maintained with the Belgian Crossroads Bank for Enterprises. REFLECT: For privacy questions, contact our Data Protection Office via the contact options on napoleon-ca.com; we will route your request to the appropriate privacy team.

Legal name: Napoleon Games NV (Belgium; member of Superbet Group)
Regulatory reference: Belgian Gaming Commission licence A+8105
Controller for this site: Napoleon Games NV in relation to napoleon-ca.com
Primary contact for privacy: Data Protection Office (DPO) - reach us through the website contact options at napoleon-ca.com (we will provide a direct email channel upon request)

Regional note (Canada): We align our privacy practices with Canadian federal privacy law (PIPEDA) and, where applicable, substantially similar provincial laws (Quebec Law 25, Alberta PIPA, BC PIPA).

What Personal Data We Collect

OBSERVE: We collect information needed to provide and secure gaming services and to meet legal duties. EXPAND: Collection occurs when you register, verify your identity, transact, play, contact support, or use our site/app. REFLECT: We do not knowingly collect data from minors or self-excluded persons.

Identity and contact: full name, date of birth, address, email, phone, nationality, documents for KYC (ID, proof of address), verification images and metadata.
Account and usage: username, preferences, session logs, support tickets, consent settings.
Technical data: IP address, device identifiers, OS/browser details, language, time zone, referrer, network info, crash/error logs.
Payment and financial: deposit/withdrawal details, partial card or account identifiers, transaction timestamps, payment method, chargeback flags.
Behavioral and gameplay: game selections, bet amounts, outcomes, bonuses used, wagering progress, clickstream, fraud and risk scores.
Geolocation: coarse location derived from IP and, if enabled, device-based checks for eligibility and fraud prevention.
Cookies and similar tech: session and persistent cookies, SDKs, pixels, tags, and local storage for functionality, analytics, and (with consent) advertising.
Communications: marketing preferences, survey responses, complaint records, call/chat recordings where permitted by law.

Legal Basis for Processing

OBSERVE: We process data under Canadian privacy law (PIPEDA) on the basis of knowledge and consent and reasonable purposes. EXPAND: We also rely on contractual necessity and legal obligations, and on legitimate interests where appropriate and proportionate. REFLECT: You can withdraw marketing consent at any time without affecting service.

Consent: account creation choices, marketing communications, optional cookies/analytics, surveys, and certain location/device checks.
Contractual necessity: to open and operate your account, verify eligibility, provide games, process deposits/withdrawals, and deliver support.
Legitimate interests: secure our services, prevent fraud/abuse, ensure integrity of games, improve performance and UX, measure audience (balanced against your privacy rights).
Legal obligations: identity verification (KYC), anti-money laundering and anti-terrorist financing compliance, record-keeping, reporting to competent authorities, sanctions screening.

Note: Where we rely on legitimate interests, we apply safeguards and allow you to opt out of non-essential processing where feasible.

Purpose of Processing

OBSERVE: We use data to operate a compliant, fair, and secure service. EXPAND: Processing supports account lifecycle, financial operations, player protection, and service improvement. REFLECT: Non-essential uses (e.g., marketing) occur only with your consent or as permitted by law.

Service delivery: registration, verification, access to games, account management, payouts, and customer support.
Safety and integrity: fraud and AML screening, bot and collusion detection, geolocation compliance, self-exclusion enforcement.
Analytics and improvement: troubleshooting, performance monitoring, A/B testing, product development.
Marketing and personalization: newsletters, promotions, bonuses, and recommendations subject to your preferences.
Legal and regulatory: audits, reporting, dispute handling, tax and accounting, risk management.

Disclosure & Sharing

OBSERVE: We share information with trusted parties to provide services and comply with law. EXPAND: We use contracts requiring confidentiality, security, and lawful processing. REFLECT: We do not sell personal information.

Payment partners and banks: to process deposits/withdrawals, verify ownership, prevent fraud and chargebacks.
KYC/AML and risk providers: identity verification, sanctions/PEP screening, fraud scoring, device intelligence.
Technology vendors: hosting/cloud, content delivery, security, analytics, communications, customer support platforms.
Regulators and authorities: lawful requests, regulatory reporting, audits, enforcement of legal rights.
Affiliates and group companies: limited intra-group processing for support, compliance, and consolidated reporting, under appropriate safeguards.
Advertising networks: only with your consent for targeted advertising; identifiers may be shared/pseudonymized.
Corporate transactions: if we undergo a merger, acquisition, or reorganization, data may transfer under continued protections.

International Transfers

OBSERVE: We may transfer and store data outside your province or outside Canada, including in Belgium and other EEA countries, the United Kingdom, the United States, and jurisdictions where our group or vendors operate. EXPAND: PIPEDA requires a comparable level of protection for cross-border processing. REFLECT: We implement legal, technical, and organizational safeguards.

Safeguards: data processing agreements, standard contractual clauses (where applicable), vendor due diligence, access controls, encryption, and minimization.
US transfers: where feasible, vendors participate in the EU-US Data Privacy Framework (and UK/Swiss extensions) or are bound by equivalent contractual safeguards.
Your options: you may contact us to obtain copies of relevant transfer safeguards subject to confidentiality.

Data Retention

OBSERVE: We retain data only as long as necessary for the purposes described or as required by law. EXPAND: Retention varies by category and legal obligations. REFLECT: Upon expiry, we securely delete or anonymize data.

Account and identity (KYC): for the life of the account and 5 years after closure to meet AML/ATF requirements.
Transactions and financial records: at least 6 years after the end of the fiscal year to meet tax and accounting obligations.
Gameplay and risk logs: typically 5 years after account closure for fraud prevention and dispute handling.
Support communications: 3 years after resolution unless needed for ongoing claims.
Marketing data: until consent is withdrawn or after 24 months of inactivity, whichever is earlier.
Cookies/analytics identifiers: session up to 24 months; advertising cookies per your consent and cookie settings (often up to 13-24 months).

Deletion criteria: purpose fulfilled, legal retention met, consent withdrawn (for optional processing), or successful objection where applicable.

Your Rights

OBSERVE: You have rights regarding your personal information. EXPAND: We provide simple processes to exercise these rights and respond within statutory timeframes. REFLECT: Requests are free of charge unless manifestly excessive or unfounded.

Canadian residents (PIPEDA and substantially similar provincial laws)

Access: obtain confirmation whether we hold your data and receive a copy, including a list of types of third parties to whom it has been disclosed.
Correction: request correction/completion of inaccurate or incomplete data.
Withdrawal of consent: withdraw marketing and other optional consents at any time.
Challenge compliance: raise concerns about our compliance with privacy obligations.
Information on practices: request information about our policies and procedures, including cross-border transfers.

Process: Submit your request via the contact options on napoleon-ca.com, specifying the right you wish to exercise. We may request identity verification. We aim to respond within 30 days; if we need more time (e.g., complexity), we will notify you of the extension and reasons. If we refuse a request, we will explain why and inform you of recourse options.

EU/UK residents (if you use napoleon-ca.com from the EEA/UK)

We endeavor to honor GDPR-style rights where applicable: access, rectification, erasure, restriction, objection (including to direct marketing), and portability, and to provide information about automated decision-making.

Mexico residents (LFPDPPP - ARCO rights)

If you are in Mexico, you may exercise your ARCO rights (Access, Rectification, Cancellation, Opposition) and withdraw consent as provided by the Federal Law on Protection of Personal Data Held by Private Parties. We will process such requests in line with applicable Mexican requirements.

Cookies & Tracking Technologies

OBSERVE: We use cookies and similar technologies to make our services work and improve them. EXPAND: Some cookies are essential; others require your consent. REFLECT: You can manage preferences at any time.

Session cookies: strictly necessary for login, bet placement, security; expire when you close your browser.
Persistent cookies: remember preferences and improve performance; remain for a defined period.
Third-party cookies/SDKs: analytics, anti-fraud, and (with consent) advertising and attribution.

Purposes: functional (site operation, security, accessibility), analytics (usage measurement, error diagnostics), advertising (frequency capping, personalization with consent).

Controls: use your browser/device settings to block or delete cookies; adjust preferences via our on-site cookie controls (where available). Blocking essential cookies may impact functionality.

Data Security

OBSERVE: We apply layered security to protect personal information against loss, misuse, and unauthorized access. EXPAND: Measures cover encryption, access control, monitoring, and resilience. REFLECT: No system is 100% secure, but we continually enhance our controls.

Encryption: TLS 1.2+ for data in transit; strong encryption for data at rest; HSM or key management with role separation.
Access controls: least-privilege, MFA for privileged access, strict approvals, and logging.
Monitoring and testing: vulnerability management, penetration testing, fraud/abuse detection, SIEM alerting.
Secure development: code reviews, dependency scanning, change management, environment segregation.
Vendor oversight: security reviews and contractual requirements for processors, including breach notification duties.
Training and awareness: mandatory staff privacy and security training, background checks as appropriate.
Incident response: documented procedures, prompt assessment, notification to users and authorities where required by law.

Standards: Our program aligns with widely recognized frameworks (e.g., ISO/IEC 27001 and SOC 2 controls) without asserting formal certification unless explicitly stated on napoleon-ca.com.

Complaints & Contacts

OBSERVE: We provide clear channels to contact us or raise concerns. EXPAND: We acknowledge and resolve privacy complaints in a timely, fair manner. REFLECT: You may escalate to a supervisory authority if unsatisfied.

How to contact us

Online: use the contact options on napoleon-ca.com to reach our Data Protection Office (DPO) or privacy team.
Postal: You may write to "Data Protection Office (DPO), Napoleon Games NV, Belgium." We will publish a full mailing address on napoleon-ca.com upon availability.

Complaint process

Submit: send your concern and any supporting details via our website contact options.
Acknowledgement: we aim to acknowledge within 5 business days.
Investigation: we review and may request clarification or evidence.
Response: we provide a written outcome within 30 days where possible; if more time is needed, we will inform you.
Escalation: if unresolved, you may escalate internally to our DPO for further review.

Supervisory authorities

Canada (PIPEDA): You can contact the Office of the Privacy Commissioner of Canada (OPC) via priv.gc.ca to file a complaint or learn more about your rights.
EU/UK (if applicable): Contact your local Data Protection Authority.
Mexico (if applicable): Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) - inai.org.mx.

Updates

OBSERVE: We may update this Privacy Policy to reflect changes in law, technology, or our operations. EXPAND: Material changes will be communicated in advance. REFLECT: Your continued use after notice indicates acceptance; you may object or close your account if you disagree.

Notice methods: email notifications (where available), on-site banners, and account dashboard alerts.
Advance notice: at least 30 days before material changes take effect, unless immediate updates are required by law or security.
Versioning: we maintain a change log describing material updates.

Last updated: October 2025

Changelog (October 2025): clarified Canadian legal bases and retention periods; added cross-border transfer safeguards summary; expanded rights section for Quebec Law 25 alignment and optional GDPR/Mexico references.

If you have questions about this Policy or how we handle personal information, please contact us via the privacy contact options on napoleon-ca.com.