Woodbine Casino Privacy Policy

This Privacy Policy governs the collection, use, disclosure, retention, and protection of personal information by Woodbine Entertainment and its affiliates, including operations at Woodbine Casino facilities located in Toronto, Ontario. The policy applies to all guests, players, and visitors accessing casino gaming, hospitality, and entertainment services.

The company adopts principles from the Canadian Standards Association’s Model Code for the Protection of Personal Information and complies with applicable federal and provincial privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and relevant Ontario regulations.

1. Scope and Application

This Privacy Policy applies to personal information collected at land-based casino facilities, through websites including woodbine.com, and via any digital services operated by the company. It covers interactions related to the gaming floor, rewards programs, player accounts, hospitality services, and security systems.

Persons under 19 years of age are prohibited from entering gaming areas. Identification verification is required for all guests who appear to be under 30 years of age. Government-issued photo identification, including driver’s licenses, passports, or other valid documents, must be presented upon request.

2. Information Collected

Personal information is collected as necessary to operate a secure, compliant gaming facility and to fulfill regulatory obligations under Ontario gaming law. Categories of information collected include:

• Identifiers: Full legal name, date of birth, residential address, telephone number, email address, gender, and government-issued identification numbers.
• Security and access control information: Driver’s license details, passport information, vehicle license plate numbers, biometric data including fingerprints, photographic images, and video surveillance recordings from the premises.
• Financial and transaction data: Payment card information, banking details, transaction histories, and records of funds movement related to gaming activities.
• Gaming activity data: Play activity logs, wager histories, game preferences, win and loss records, and records of participation in player rewards programs.
• Account information: Registration details for player gaming accounts, loyalty program enrollment data, and communication preferences.

3. Methods of Collection

Personal information is collected primarily through direct interaction when you:

• Register for a player account or rewards program
• Present identification at entry points or gaming areas
• Engage in gaming activities on the casino floor
• Use payment services or conduct financial transactions
• Interact with VIP Casino Host services
• Communicate with guest services or support staff
• Access facilities that are under video surveillance

Information may also be collected indirectly through security systems, automated monitoring of gaming activity, and from regulatory bodies, including the Alcohol and Gaming Commission of Ontario, when required for compliance or enforcement purposes.

4. Purpose and Use of Personal Information

Personal information is used solely for legitimate operational, security, and regulatory purposes, including:

• Security and compliance: Monitoring for illegal activity, enforcing voluntary self-exclusion programs, identifying court-banned individuals, preventing fraud, and reporting suspicious transactions to law enforcement or regulatory authorities as required by law.
• Access control: Verifying age and identity, managing facility access, and maintaining records of persons prohibited from entry under provincial programs or court orders.
• Player services: Operating rewards programs, personalizing promotional offers based on demographic data and gaming preferences, providing VIP services to qualified players, and managing player gaming accounts.
• Regulatory obligations: Fulfilling reporting requirements to the Alcohol and Gaming Commission of Ontario and other applicable regulatory bodies, maintaining records as mandated by gaming regulations, and cooperating with investigations.
• Operational purposes: Processing transactions, maintaining accurate financial records, improving service quality, and administering the responsible gambling program “Know When to Take the Reins.”

5. Disclosure of Information

Disclosure of personal information is limited to circumstances required by law or essential to operations. Personal information may be disclosed to:

• Regulatory authorities: The Alcohol and Gaming Commission of Ontario and other provincial or federal regulators with jurisdiction over gaming operations.
• Law enforcement: Police services and investigative agencies when required by subpoena, court order, or legal obligations to report suspicious activity.
• Service providers: Third-party vendors performing functions on behalf of the company under confidentiality obligations, including payment processors, security consultants, and technology service providers.
• Legal proceedings: Courts, tribunals, or legal representatives when compelled by legal process or when necessary to establish, exercise, or defend legal claims.

Personal information is not sold to third parties. Information is not shared for marketing purposes outside the organization without explicit consent.

6. Consent and Opt-Out

By accessing casino facilities and services, you consent to the collection and use of personal information as described in this Privacy Policy. Consent is implied through voluntary participation in gaming activities, rewards programs, and use of the premises.

You may withdraw consent for promotional communications at any time by contacting guest services. Withdrawal of consent for security monitoring, regulatory reporting, or access control functions may result in denial of entry or services, as these functions are mandatory for legal compliance.

For rewards programs, you may opt out of demographic-based personalization while maintaining basic participation in the program.

7. Data Retention and Destruction

Personal information is retained only as long as reasonably necessary to fulfill the purposes for which it was collected and to satisfy legal and regulatory retention requirements. Gaming transaction records, surveillance footage, and regulatory reports are retained according to timelines mandated by Ontario gaming regulations.

Upon expiry of retention periods, personal information is de-identified or securely destroyed according to the company’s Data Retention and Destruction Policy. De-identified information may be retained indefinitely for statistical analysis and operational improvement.

8. Security Safeguards

Physical, administrative, and technical safeguards are implemented to protect personal information against unauthorized access, disclosure, copying, use, or modification, including:

• Physical controls: Restricted access to data storage areas, secure document disposal, and controlled entry to administrative systems.
• Administrative measures: Employee training on privacy obligations, privacy impact assessments for new systems, and confidentiality agreements with staff and service providers.
• Technical protections: Firewalls, encryption of sensitive data, access controls limiting information to authorized personnel, and regular security audits.

Surveillance systems operate continuously throughout facilities for security purposes. Video recordings are stored securely and accessed only by authorized security personnel or as required by law enforcement.

9. Generative AI and Chatbot Services

Generative artificial intelligence chatbot solutions may be used to assist with guest inquiries. Anonymized messaging history from chatbot interactions may be used to train and improve AI systems. Personal information disclosed through chatbot conversations is subject to the same protections as other collected data under this Privacy Policy.

10. Responsible Gambling and Self-Exclusion

The responsible gambling program “Know When to Take the Reins” includes privacy protections for participants in voluntary self-exclusion programs. Individuals enrolled in provincial self-exclusion are prohibited from entering gaming facilities. Confidential records of self-excluded persons are maintained solely for enforcement purposes.

Participation in self-exclusion programs is voluntary. Information related to self-exclusion is disclosed only to regulatory authorities and to security personnel responsible for access control.

11. Access and Correction

You may request access to personal information held about you by submitting a written request to the Privacy Officer. Responses will be provided within the timeframes required by applicable privacy legislation.

If inaccuracies are identified in your personal information, you may request correction. Records will be amended where appropriate, and relevant third parties will be notified if a correction affects previously disclosed information.

Certain information may be withheld from access requests where permitted by law, including information subject to solicitor-client privilege, information that would reveal confidential commercial information, or information collected for security investigations.

12. Contact Information

For privacy inquiries, access requests, or complaints regarding the handling of personal information, contact:

Email: [email protected]

Written correspondence may be directed to the Privacy Officer at the corporate office in Toronto, Ontario. Contact details are available on woodbine.com.

13. Policy Updates

This Privacy Policy was last revised in November 2023. The company reserves the right to modify this policy at any time to reflect changes in legal requirements, operational practices, or organizational structure. Material changes will be communicated through notices posted at facilities and on woodbine.com.

Continued use of services following policy updates constitutes acceptance of the revised terms. Periodic review of this Privacy Policy is recommended to remain informed of current practices.