Last updated: January 1, 2025. We are committed to protecting your personal information in compliance with Canadian privacy law (PIPEDA).
Zula Casino Canada ("we," "us," or "our") operating at zulacasino-official.ca is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our website, mobile application, and casino services. We operate in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
We collect the following categories of personal information:
Your personal information is used for the following purposes:
We do not sell your personal information to third parties. We may share your data with:
All personal data is protected by 256-bit SSL encryption during transmission. We store data on PCI DSS-compliant servers with restricted access controls, regular security audits, and intrusion detection systems. We conduct annual security reviews by independent certified security professionals. Employee access to personal data is limited to those who need it to perform their job functions.
We retain your personal information for as long as your account is active and for a period of 5 years after account closure, as required by Canadian anti-money-laundering regulations. You may request deletion of your data subject to our legal retention obligations.
Under PIPEDA, you have the right to: access your personal information held by us; correct inaccurate information; withdraw consent for non-essential processing; file a complaint with the Office of the Privacy Commissioner of Canada. To exercise any of these rights, contact our Privacy Officer at [email protected].
We use essential cookies for website functionality, analytical cookies to understand usage patterns, and (with your consent) marketing cookies for personalized advertising. You can manage cookie preferences through your browser settings or our cookie consent tool.
We may update this Privacy Policy periodically. Changes will be posted on this page with an updated effective date. Continued use of our services after changes constitutes acceptance of the updated policy.
For privacy-related inquiries: Privacy Officer, Zula Casino Canada, [email protected]. For complaints: Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, QC K1A 1H3.
Zula Casino Canada uses only essential cookies for authentication and session persistence by default. Optional analytics cookies (GA4 and Hotjar) are opt-in through the consent banner shown to every new visitor. You can revoke consent at any time via the cookie preferences link in the footer, and doing so immediately halts all analytics tracking.
Personal identifiers submitted during registration are retained for the lifetime of your account plus the seven-year post-closure period mandated by anti-money-laundering regulations. Anonymised play data used for RTP verification is stored for a rolling five years. Marketing preferences are wiped within 48 hours of any unsubscribe request.
Zula shares data only with (a) our licensed payment processors to complete deposits and withdrawals, (b) our KYC verification partner Jumio for identity confirmation, and (c) regulatory authorities on formal request. We never sell player data to advertisers or affiliate networks, and no third party uses your data for cross-site profiling.
Under PIPEDA and provincial equivalents including Québec's Law 25, you have the right to access, correct, delete, or export your personal data on request. Data subject requests are fulfilled within 30 days, and expedited to 72 hours for account closure with data erasure. Contact [email protected] to submit a request or file a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been infringed.
Because our payment and identity partners are based in the European Union and the United Kingdom, some of your data crosses the Canadian border under Standard Contractual Clauses approved by the European Commission and adequacy findings for Canada. All transfers use end-to-end encryption and access is restricted to named personnel with signed data processing agreements.
All customer data is encrypted at rest using AES-256 and in transit via TLS 1.3. Multi-factor authentication is required for every administrative account. We run continuous security scanning, monthly penetration testing, and annual SOC 2 Type II audits with independent verifiers. In the event of any breach that affects your data, we notify you within 72 hours as required by law and outline the exposure, remedial steps, and recommended actions.
Zula Casino Canada uses first-party attribution only. We do not embed third-party retargeting pixels, we do not share visitor lists with advertising networks, and we do not permit cross-site tracking cookies on our domain. Our marketing measurement uses server-side event forwarding to attribution partners with hashed identifiers and time delays that eliminate the possibility of cross-referencing to a specific player. This approach reduces the granularity of our marketing analytics but respects the intent of PIPEDA and Québec Law 25 far more thoroughly than the "compliance minimum" that most casinos follow.
Every access to your personal data by a Zula employee is logged in an immutable audit trail that captures the employee ID, the specific fields accessed, the timestamp, the business justification, and the ticket or system that triggered the access. Employees may only access personal data on demonstrable need — support agents can see contact details but not payment information, payment agents can see transaction history but not gameplay logs, and compliance officers can see everything under specific authorisation. You can request a summary of all access to your specific data over the previous 12 months by emailing [email protected].
Certain decisions at Zula are made partly by automated systems: bonus eligibility, KYC risk scoring for expedited verification, and responsible-gambling intervention triggers. In all three cases the system produces a recommendation, and a human reviews it before it takes effect on your account. You have the right to request a human review of any automated decision that materially affects your account, and to know which factors weighed most heavily in the automated model's recommendation.
Zula does not knowingly collect data from anyone under the age of 19. Our registration flow requires date of birth confirmation and cross-checks against age verification services on first deposit. If we become aware that a person under 19 has created an account, the account is closed within 24 hours, all deposits are refunded to the original payment method, and all personal data is deleted from active systems within 7 days.
Our Data Protection Officer is Riya Patel, reachable at [email protected]. The DPO is empowered to direct any data handling change necessary to protect player rights, up to and including halting new marketing campaigns, disabling analytics collection, or suspending a payment integration if a privacy risk is identified. The DPO reports directly to the Chief Executive rather than the marketing or product organisations to preserve independence.
