Privacy policy

Written by Loraine Couturier Published: 19 August 2026 Last updated: 19 August 2026 ✓ Fact-checked against the Oxibet cashier

1. What we collect

Table 1 — Categories of personal information Oxibet collects, the purpose, legal basis and retention period.

We do not collect biometric data, and we do not buy personal information from data brokers.

2. How we use your information

We use personal information for six purposes and no others:

1. Running your account — registration, login, gameplay, cashier.
2. Legal and regulatory compliance — age verification, AML monitoring, sanctions screening, licensing obligations and record-keeping.
3. Payments — processing deposits and withdrawals and investigating failed transactions.
4. Security and fraud prevention — detecting duplicate accounts, enforcing self-exclusions, blocking account takeover.
5. Responsible gambling — applying your limits and identifying patterns that suggest a player may need support.
6. Marketing, with consent — offers and promotions, only where you opted in, withdrawable at any time.

We do not sell personal information. We do not use your gameplay data to build profiles for sale or for third-party advertising.

Automated processing. Some fraud, AML and responsible-gambling checks are automated. Where an automated decision materially affects you — a blocked withdrawal, a suspended account — you can request human review by emailing privacy@oxibetcanada.org.

3. Who we share it with

Personal information is shared only with parties that need it to deliver the service or where the law requires it:

• Payment providers — Interac, card acquirers, iDebit, Instadebit, MuchBetter, ecoPayz and others, to process your transactions.
• Identity and AML verification services — to confirm identity, age and sanctions status.
• Game studios — a pseudonymous player identifier only, to run the games and settle rounds. Studios do not receive your name or contact details.
• Regulators and law enforcement — where legally required, including suspicious-transaction reporting.
• Technology suppliers — hosting, email, analytics and live chat, under contract and limited to what the service requires.
• Professional advisers — auditors and lawyers, under confidentiality.

Cross-border transfer. Some processors operate outside Canada, including in the EU and the UK. Transfers are covered by contractual protections requiring a comparable standard of protection, and PIPEDA requires us to tell you this is the case.

4. Your rights as a Canadian player

Under PIPEDA, and under Québec's Law 25 if you are a Québec resident, you have the following rights:

Table 2 — Your data rights, what each covers and how to exercise it.

Deletion cannot override statutory retention. Identity, financial and gameplay records must be retained for five years under anti-money-laundering rules, and self-exclusion records are kept permanently precisely so that an exclusion cannot be circumvented.

5. Cookies and tracking

Oxibet uses four categories of cookie. Only the first is set without your consent, because without it the site does not function.

Table 3 — Cookie categories used by Oxibet, their purpose and lifespan.

You can change cookie preferences at any time from the cookie banner, or block cookies in your browser. Blocking strictly necessary cookies will prevent login and deposits from working. We honour Global Privacy Control signals for analytics and marketing categories.

6. Security, retention and breach notification

Security. TLS 1.3 in transit, encryption at rest for identity documents and financial records, role-based access control with logging, and least-privilege access for staff. Verification documents are visible only to trained verification staff.

Retention. Periods are set out in the tables above. Where a statutory period applies, it overrides a deletion request; where none applies, information is deleted or irreversibly anonymised once the purpose has ended.

Breach notification. If a breach creates a real risk of significant harm, we notify affected players and the Privacy Commissioner of Canada as soon as feasible, in line with PIPEDA's mandatory reporting obligation. Notification includes what happened, what data was involved, and what you should do.

Children. Oxibet is strictly 19+ (18+ in Alberta, Manitoba and Québec). We do not knowingly collect information from anyone below the legal age, and any such account is closed and its data deleted except where retention is legally required.

7. Contacting our privacy officer

Data protection questions, access requests, corrections and deletion requests go to our privacy officer at privacy@oxibetcanada.org. Please include the email address on your Oxibet account so we can locate your records — we will verify your identity before releasing or changing anything.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Québec residents may also contact the Commission d'accès à l'information du Québec.

This policy was last updated on 19 August 2026. Material changes are notified by email and in-account at least 14 days in advance.

Frequently Asked Questions

Keep reading

• Terms & conditionsAccount, bonus and payment rules
• About OxibetLicence and security measures
• Responsible gamblingLimits and free help