Data Protection

Privacy Policy

Last updated: 1 May 2026

This Privacy Policy explains how Canadix Limited ("Zinx", "we", "us", "our"), the operator of zinx.com and related applications, collects, uses, discloses and protects the personal information of Canadian users of our gaming services. We are committed to handling your information in accordance with the PIPEDA and applicable Canadian provincial privacy laws, including Quebec's Loi 25, PIPA British Columbia and PIPA Alberta. By using Zinx Casino you confirm you have read and understood this Policy.

1Introduction & Scope

This Policy applies to all visitors and registered users of:

• The Zinx Casino website at zinx.com and any country sub-paths;
• The Zinx mobile-optimised web application and any native apps we publish;
• Customer-support channels operated by Zinx, including live chat and email.

It does not cover third-party sites we link to. By using Zinx you agree to the practices described here, which should be read together with our Terms & Conditions and Cookies Policy.

2Data Controller Information

The controller of your personal information is Canadix Limited, a company licensed by the Kahnawake Gaming Commission under permit KGC-LIC-CAN-2026.

• Registered address: Mohawk Internet Technologies, 1 Bayou Road, Kahnawake, QC J0L 1B0, Canada
• Data Protection Officer: [email protected]
• Regulator: Kahnawake Gaming Commission — gamingcommission.ca

3Personal Information We Collect

The types of information we process depend on how you interact with our services. We collect only what is necessary to operate the casino safely, comply with the law, and provide the experience you are signing up for.

Identification Data

To verify that you are who you say you are and that you are of legal age, we collect: full legal name, date of birth, country and province of residence, nationality, government-issued ID (driver's licence, passport, provincial ID card) and a self-taken photo or short video for liveness checks. We do not collect your Social Insurance Number unless we are required to by tax law for a specific reportable transaction.

Contact Data

• Email address;
• Phone number;
• Postal address (street, city, province, postal code);
• Preferred language of communication (en-CA or fr-CA).

Financial & Transactional Data

We collect deposit and withdrawal records, payment-method identifiers (tokenised), Interac e-Transfer reference data, transaction history, and crypto wallet addresses where applicable. We do not store full payment-card numbers — these are handled directly by PCI DSS-certified payment processors. We also retain the results of our anti-fraud and AML screening on each transaction.

Gameplay & Behavioural Data

To operate the platform and meet our responsible-gaming obligations, we record bet history, wager amounts, game preferences, session length, deposit/loss limits, reality-check usage, time-out and self-exclusion activations, and any account-control changes you make.

Technical Data

When you visit Zinx we automatically collect: IP address, device type, operating system, browser, screen resolution, time zone, language, geolocation at the province level, referring URL and clickstream data, plus the unique identifiers stored in cookies and similar technologies (see our Cookies Policy).

Marketing Preferences

If you have opted in, we record your consent status, the channels you accept (email, SMS, push), the time of consent and your response history. Under the Canadian Anti-Spam Legislation (CASL), we send commercial electronic messages only with your express consent (or implied consent in the limited situations CASL permits).

4How We Collect Your Information

We collect personal information in three ways:

• Directly from you — when you register, complete KYC, deposit, set limits, contact support, or respond to a survey;
• Automatically — through cookies, server logs, analytics scripts and fraud-screening tools as you interact with our services;
• From third parties — including identity-verification providers, payment partners, fraud-screening networks, regulators (where they share information with us), affiliate networks (if you arrived via a referring partner), and publicly available sources used for compliance checks.

5Legal Basis for Processing

Canadian privacy law is built on the concept of meaningful consent. The table below maps each main processing activity to its primary basis under PIPEDA, with Loi 25 nuances noted where Quebec residents are involved.

6How We Use Your Information

We use personal information for the following purposes:

• To create, administer and secure your Zinx account;
• To verify your identity, age and country of residence;
• To process deposits, payouts and other transactions;
• To detect, investigate and prevent fraud, payment chargebacks and account takeover;
• To screen for suspicious activity under our AML program and report where legally required;
• To deliver and personalise the gaming experience, including game recommendations;
• To operate responsible-gaming tools (limits, reality checks, self-exclusion);
• To respond to customer-support requests and resolve disputes;
• To send service messages (transaction confirmations, security alerts, policy updates);
• To send marketing messages where you have opted in (CASL);
• To meet legal, regulatory and tax obligations;
• To carry out aggregated analytics that help us improve the platform.

7Data Sharing & Third Parties

We never sell your personal information. We share it only with vetted third parties who need it to deliver our services, and only under contractual confidentiality and data-protection obligations.

8International Data Transfers

Zinx primarily hosts player data on servers located within Canada, with encrypted backups in the European Union for disaster-recovery purposes. Some service providers we work with operate from outside Canada, which means your personal information may be transferred to and processed in other jurisdictions. When this happens we rely on contractual safeguards (including binding processor terms and, where relevant, the European Standard Contractual Clauses) and on technical safeguards such as encryption in transit and at rest. Be aware that data hosted abroad may, in limited circumstances, be subject to foreign legal processes.

9Data Retention Periods

We keep personal information only as long as needed for the purposes for which it was collected, plus any additional period required by law. The table below shows our default retention windows.

10Data Security Measures

We implement reasonable physical, technical and organisational safeguards to protect your information. These include:

• Industry-standard encryption in transit (TLS 1.2+) and at rest;
• PCI DSS Level 1 compliance via our payment processors;
• Role-based access control with the principle of least privilege;
• Multi-factor authentication on all internal systems handling personal data;
• Continuous fraud and intrusion monitoring;
• Mandatory privacy and security training for all personnel;
• An incident-response plan with breach-notification procedures aligned to PIPEDA and Loi 25;
• Alignment with the controls of ISO/IEC 27001 where applicable.

No system is perfectly secure. While we make every reasonable effort to protect your data, we cannot guarantee absolute security and ask that you do your part by using a strong, unique password and enabling two-factor authentication on your Zinx account.

11Cookies & Similar Technologies

We use cookies, tracking pixels, software development kits and similar technologies to keep you logged in, remember your preferences, measure performance and (with your consent) deliver relevant marketing. For a full breakdown and consent-management instructions, see our Cookies Policy.

12Your Rights under PIPEDA

PIPEDA is built around ten Fair Information Principles. As a Zinx user you can rely on each of them as a right or expectation against us:

1. Accountability — we are responsible for the personal information under our control.
2. Identifying purposes — we tell you why we collect each item of information at or before collection.
3. Consent — we obtain your knowledge and consent for collection, use and disclosure (with limited exceptions defined by law).
4. Limiting collection — we collect only what is necessary for the identified purposes.
5. Limiting use, disclosure and retention — we do not use or disclose information for new purposes without consent, and we retain it only as long as necessary.
6. Accuracy — we keep your information as accurate, complete and up-to-date as the purposes require.
7. Safeguards — we apply security measures appropriate to the sensitivity of the information.
8. Openness — we make our privacy practices readily available to you (this document does that).
9. Individual access — you can request access to the personal information we hold about you and ask for corrections.
10. Challenging compliance — you can challenge our practices and complain to the Office of the Privacy Commissioner of Canada.

Quebec residents (Loi 25 / Law 25)

If you reside in Quebec, you benefit from additional rights under An Act respecting the protection of personal information in the private sector (Loi 25), including:

• The right to data portability for digitised personal information you provided to us;
• The right to de-indexation / cessation of dissemination in qualifying cases;
• The right to express, granular consent for sensitive processing;
• The right to be informed of automated decision-making that significantly affects you;
• The right to mandatory breach notification where the incident poses a risk of serious injury.

British Columbia & Alberta residents (PIPA)

If you reside in British Columbia or Alberta, your provincial Personal Information Protection Act applies in addition to PIPEDA. The substantive rights largely mirror PIPEDA, with provincial commissioners (OIPC BC and OIPC AB) acting as the local supervisory authorities.

13How to Exercise Your Rights

Send a written request to our Data Protection Officer at [email protected]. To protect your data, we may ask for proof of identity before we disclose information.

• Response time: we aim to respond within 30 days, in line with PIPEDA practice. Complex requests may be extended once, with notice to you.
• Fees: access requests are free in most cases. PIPEDA permits a reasonable cost-recovery fee for unusually large requests, with prior notice.
• Refusals: we may decline part of a request only on the narrow grounds set out in PIPEDA (for example, where releasing information would reveal another individual's personal information). We will explain any refusal in writing.

14Children's Privacy

Zinx Casino is not intended for anyone under the legal gambling age of their province (19+ in most of Canada, 18+ in Alberta, Manitoba and Quebec). We do not knowingly collect personal information from minors. If we become aware that a minor has registered, we will close the account, return verified deposits to source after fraud checks, and delete the data we are not legally required to retain.

15Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or the law. Material changes will be communicated through a notice on your account or by email at least 14 days before they take effect, except where shorter notice is required by law. The "Last updated" date at the top of this page always reflects the current version.

16Contact Us & How to Complain

For any privacy-related questions, please contact our Data Protection Officer:

• Email: [email protected]
• Postal: Canadix Limited — Data Protection Officer, Mohawk Internet Technologies, 1 Bayou Road, Kahnawake, QC J0L 1B0, Canada

If you are not satisfied with our response, you have the right to escalate:

17Frequently Asked Questions

How long do you keep my personal information?

Retention varies by data type. KYC and transaction records are kept for at least 5 years after account closure to meet our obligations under the PCMLTFA. Marketing preferences are kept until you withdraw consent. The full breakdown is in section 9.

Can I request a copy of all data you hold about me?

Yes. Send a written request to [email protected] from the email registered on your account, with a copy of your photo ID. We will respond within 30 days. Complex requests may be extended once, with notice.

Do you sell my personal information?

No. Zinx does not sell personal information. We share data only with the categories of recipients listed in section 7, and only under confidentiality and data-protection contracts.

Where is my data stored?

Primarily on servers in Canada, with encrypted backups in the European Union for disaster recovery. International transfers are protected by contractual and technical safeguards as described in section 8.

How do I delete my account and personal data?

Email [email protected] with a deletion request. We will close your account and delete the data we are not legally required to retain. KYC and AML records are kept for the minimum statutory period (5 years) before deletion.

What additional rights do Quebec residents have?

Quebec residents benefit from Loi 25, which adds rights to data portability, de-indexation in qualifying cases, and express granular consent for sensitive processing. You can also lodge a complaint with the CAI. See the Quebec residents subsection above for the full list.