Privacy Policy

1. General Provisions

Casino de Charlevoix data protection policy establishes standards for personal information handling. This document outlines procedures implemented since October 2023, covering both physical and digital operations. The policy scope extends to all user interactions across gaming platforms, hotel services, and loyalty programs.

1.1 Document Purpose

These regulations govern personal data processing within Canadian jurisdictions. Implementation follows Quebec Privacy Act requirements and federal data protection standards. Policy updates occur quarterly, maintaining alignment with current privacy legislation.

2. Key Terms

Personal data definitions align with Canadian privacy legislation requirements. Data categorization follows Quebec Privacy Act specifications for gaming operators. Policy implementation addresses both digital and physical data collection points across Casino de Charlevoix operations.

2.1 Core Data Categories:

• Government identification
  
• Contact information
  
• Financial records
  
• Gaming activity
  
• Location data

2.2 Financial data encompasses transaction records spanning 24 months. Banking information includes payment methods, transaction history, and credit assessments. Currency reporting follows FINTRAC requirements for transactions exceeding $10,000.

2.3 Location verification implements multiple security layers. IP address logging ensures jurisdictional compliance. Mobile access points verify Quebec residence requirements. Geolocation services activate during platform usage.

2.4 Data retention follows regulatory timeframes. Identity documents maintain 24-month post-account storage. Transaction records preserve seven-year history. Gaming activity retains 24-month accessibility.

2.5 Access protocols scale with data sensitivity. Staff permissions limit information accessibility. Enhanced encryption protects financial and identity records. Security measures adapt to data classification requirements.

2.6 Classification systems define protection levels. Standard data receives base encryption. Financial records implement advanced security. Behavioral analysis maintains anonymized processing. Technical data supports optimization without identification.

3. Operator Rights and Obligations

Casino de Charlevoix maintains comprehensive data protection responsibilities. Security measures implement 128-bit encryption across all data channels. Storage systems hold ISO 27001 certification, ensuring international security standards compliance.

3.1 Core Requirements

Protection measures encompass multiple safeguards:

• Real-time monitoring
  
• Intrusion detection
  
• Encryption protocols
  
• Access controls
  
• Incident response

3.2 Staff Management

Personnel undergo monthly security training. Department protocols establish handling procedures. Certification requirements mandate annual renewal for data access.

3.3 Technical Operations

System maintenance includes weekly security assessments. Third-party audits verify protection quarterly. Support teams maintain 24/7 availability for security concerns.

4. Data Subject Rights

Members maintain complete control over personal information. Access requests process within 72 hours through secure channels. Data modification procedures allow immediate information updates.

5. Data Processing Principles

Information collection follows minimization principles. Systems gather only essential data for service provision. Regular audits verify necessity of stored information.

Processing standards require:

• Purpose specification
  
• Data minimization
  
• Storage limitation
  
• Processing security
  
• Usage transparency

6. Data Processing Conditions

Data processing adheres to explicit consent requirements established by Quebec privacy regulations. Member authorization implements clear opt-in mechanisms for each data category. Processing notifications provide detailed information about data usage purposes and storage duration.

6.1 Authorization Requirements

Processing requires specific approval for:

• Personal identification
  
• Financial data
  
• Location tracking
  
• Marketing communications
  
• Third-party sharing

6.2 Control Options

Consent management enables direct preference modification. Support channels process withdrawal requests within 24 hours. Data deletion initiates automatically following consent removal.

6.3 Processing Updates

System modifications require renewed consent confirmation. Policy updates notify members 30 days in advance. Documentation remains accessible through account portals.

7. Collection and Storage Procedures

Data retention policies implement systematic collection and storage protocols. Information gathering occurs through secured channels with 128-bit encryption standards. Storage systems maintain ISO 27001 certification for information security management.

7.1 Retention Periods

Active account information maintains specific timeframes:

• Identity documents: 7 years
  
• Transaction records: 5 years
  
• Gaming history: 24 months
  
• Login records: 90 days
  
• Chat logs: 30 days

7.2 Archive Management

Inactive account protocols follow structured timelines. Account inactivity triggers notifications after 6 months. Data archiving initiates at 12-month inactivity. Complete deletion processes after 24-month inactivity verification.

7.3 Backup Systems

Security protocols maintain triple redundancy storage. Daily incremental and weekly full backups preserve data integrity. Recovery procedures specify 4-hour maximum restoration time for critical information.

8. Data Confidentiality

Security infrastructure implements multiple protection layers across data storage systems. Encryption protocols utilize AES-256 standards for data at rest and in transit. Network segmentation isolates sensitive information through dedicated secure zones.

8.1 Authentication

Multi-factor authentication requires three verification steps: Hardware security keys, biometric verification, and time-based codes rotating every 30 seconds. Login attempts limit to three before temporary account lockout.

8.2 Access Control

Permission levels segment staff access based on operational requirements. Department-specific protocols restrict data visibility. Administrative actions require dual authorization for sensitive operations. System logs maintain 90-day audit trails.

8.3 Security Testing

Monthly penetration tests evaluate system vulnerabilities. External security firms conduct quarterly audits. Automated scanning tools perform daily assessments. Response protocols test through simulated breaches every 60 days.

8.4 Data Isolation

Storage systems maintain physical and logical separation. Sensitive data occupies dedicated servers with enhanced security. Backup systems implement end-to-end encryption. Data transfer occurs only through secured channels.

8.5 Incident Response

Security teams operate continuous monitoring systems. Alerts trigger on suspicious activities within 5 minutes. Response procedures initiate within 15 minutes of detection. Member notifications process within one hour of confirmation.

9. Final Provisions

Policy updates notify members 30 days before implementation. Communication channels include email notifications and platform announcements. Documentation remains accessible through account privacy settings.

Contact methods include:

• Privacy office email
  
• Dedicated phone line
  
• Support chat
  
• Written requests
  
• In-person inquiry