Who Is Responsible for Your Data
Your personal information is controlled by GBL Solutions N.V., the company that owns and operates TuffPuff under Curaçao Gaming Authority licence OGL/2024/589/0556. As the controller, the operator decides why and how your data is processed and is responsible for keeping it safe. Questions about this policy can be sent to the support team through live chat or the contact form on the site, and they will be passed to the staff responsible for data protection.
The Laws We Follow
For players in Canada, the main framework is the Personal Information Protection and Electronic Documents Act (PIPEDA), together with provincial privacy laws in Alberta, British Columbia and Quebec where they apply. These laws require that personal information is collected for clear purposes, used only for those purposes and protected with appropriate safeguards.
The operator also follows the data rules attached to its gaming licence and to anti-money laundering legislation. For players located in the European Economic Area (EEA), casino GDPR compliance applies on top of these rules, giving those players the rights set out in European law. In practice, the same high standard of care is applied to every account regardless of where the player lives.
Information We Collect
When you register, you provide your name, date of birth, email address, phone number, home address, province and chosen currency. During verification, you may also supply copies of a photo ID, a proof of address and documents showing ownership of your payment method.
As you use the site, further information is created. This includes your deposit and withdrawal history, game and betting activity, bonus usage, support conversations and any limits or exclusions you set. Technical data is recorded too, such as your IP address, device type, browser, operating system and the pages you visit, along with the time and length of each session.
Payment details are handled mainly by the payment providers you choose. The casino receives confirmation of each transaction and the information needed to match it to your account, but full card numbers are processed by the payment partner rather than stored on the casino's own systems.
How We Use Your Information
Personal information is used to open and manage your account, process deposits and withdrawals, run games and the sportsbook and deliver the promotions you sign up for. It is also used to confirm your age and identity, meet anti-money laundering and anti-fraud obligations and keep the records the licence requires.
Activity data helps the team spot patterns that may point to problem gambling, so that responsible gambling tools can be offered at the right moment. It is also used to fix technical problems, improve the site and understand which games and features players value. Where you have agreed to it, your email address and phone number are used to send news about promotions, and you can withdraw that consent at any time from your account settings or through the unsubscribe link in any message.
Who We Share Information With
Information is shared only where there is a clear reason. Payment providers receive what they need to process transactions, and identity verification services receive the documents and details needed to confirm who you are. Game studios and the sportsbook platform receive limited account identifiers so that your bets and results can be recorded correctly.
The operator may also share information with the Curaçao Gaming Authority, law enforcement agencies, financial intelligence units and courts when the law or the licence requires it. Professional advisers, auditors and hosting providers may have access to some data while working for the operator, and they are bound by confidentiality obligations. Personal information is never sold to third parties for their own marketing.
International Transfers
Because the operator is based in Curaçao and works with suppliers in several countries, your information may be stored or processed outside Canada. Where this happens, contractual and technical safeguards are used so that your data receives a level of protection comparable to that required by Canadian law. Information held abroad may be subject to the laws of the country where it is stored, including requests from authorities in that country.
How We Protect Your Data
Player data security is built into how the platform works. All traffic between your device and the site uses SSL encryption, and sensitive records are encrypted while stored. Access to personal information is limited to staff who need it for their role, and every access is logged. Data encryption in online casinos is now a basic expectation, and it is combined here with firewalls, regular security testing and monitoring for suspicious logins.
No system can promise complete security, so your own care matters as well. Keep your password private, use a unique password for your account and log out on shared devices. If you suspect that someone has accessed your account, contact support straight away so it can be secured.
How Long We Keep Information
Personal information is kept for as long as your account is open and for a period afterwards to meet legal and licence requirements. Anti-money laundering rules usually require identity and transaction records to be kept for several years after an account is closed. Once the retention period ends, data is deleted or anonymised so that it can no longer be linked to you. Marketing preferences are removed sooner if you withdraw consent.
Your Privacy Rights
Under Canadian law, you have the right to ask what personal information is held about you, how it has been used and who it has been shared with. You can ask for inaccurate information to be corrected and withdraw consent to optional uses such as marketing, though some processing must continue for legal reasons while your account exists. Requests can be made through support, and the team will respond within the time allowed by law, usually 30 days.
These player privacy rights also include the right to complain. If you are unhappy with how a request was handled, you can contact the Office of the Privacy Commissioner of Canada or the privacy regulator in your province. EEA residents may also contact the data protection authority in their own country.
Automated Checks and Profiling
Some checks on the platform run automatically. When you register, your details are compared against age, identity and sanctions databases, and payment activity is screened by fraud detection tools that look for patterns linked to stolen cards or account takeovers. Play data is also analysed to spot signs of risky gambling, such as rapid increases in deposits or very long sessions, so that the team can step in with limits or a check-in message.
These automated tools support decisions rather than replace people. If a check leads to a restriction on your account, such as a withdrawal hold or a request for more documents, a member of staff looks at the case, and you can ask support to explain the outcome and share any information that might change it. Profiling for marketing purposes, such as choosing which promotions to show you, only takes place where you have agreed to receive offers.
Cookies and Similar Technologies
The site uses cookies and similar tools to keep you signed in, remember your language and currency, measure traffic and understand which features are used most. Under the casino cookie policy, essential cookies are always active because the site cannot work without them, while analytics and marketing cookies are used only with your consent. You can change your choices in the cookie banner or your browser settings at any time, although blocking some cookies may affect how the site works.
Marketing Messages
Promotional emails and text messages are sent only to players who have agreed to receive them. Each message includes a way to opt out, and you can also switch marketing off from your account. Players who self-exclude stop receiving marketing for the length of the exclusion.
Minors
The site is not intended for anyone below the legal gambling age, which is 19 in most provinces and 18 in Alberta, Manitoba and Quebec. Information is not knowingly collected from minors, and any account found to belong to someone under age is closed and its data handled under the law.
Changes to This Policy
This policy may be updated when services, suppliers or the law change. The latest version is always available on the site with its effective date, and significant changes are announced by email or on screen when you next sign in.
Our Approach to Online Casino Privacy
Online casino privacy is about trust as much as compliance. Players hand over identity documents and financial details, and they deserve fair and transparent casino policies that explain exactly what happens to that information. As a TuffPuff secure online casino and a secure gaming platform, the brand aims to protect personal information at every step, from registration to account closure. If you have any questions about this TuffPuff privacy policy, the support team is available 24/7 to help.