Privacy Policy

This Privacy Policy explains how the online gaming service identified as Stake and operated via the domain stake-win.ca ("Stake", "we", "us", "our") collects, uses, discloses, and protects personal information of players and visitors who access stake-win.ca from Canada (excluding Ontario) and related web pages, content, and services. It applies to account holders, prospective customers, affiliates accessing our platform, and casual website visitors. By using stake-win.ca you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is effective as of 1 January 2026 and supersedes all previous versions for stake-win.ca.

Who We Are

The Stake environment on stake-win.ca is part of the global Stake brand operated online by:

Operator: Medium Rare N.V., trading as "Stake"
Legal form and jurisdiction: A company incorporated under the laws of Curaçao
Registered address: Scharlooweg 39, Willemstad, Curaçao
Gaming licence: Licensed and regulated by Antillephone N.V. under licence number 8048/JAZ

For Ontario residents, the Stake brand is operated separately by Stake Canada RH under an operating agreement with iGaming Ontario (iGO) and oversight of the Alcohol and Gaming Commission of Ontario (AGCO) via the domain stake.ca. In the United Kingdom, Stake is offered via TGP Europe Ltd through stake.uk.com under the supervision of the UK Gambling Commission. The present Privacy Policy applies only to Stake on stake-win.ca and not to stake.com, stake.ca, stake.uk.com or any other site.

Data Protection Contact / DPO-equivalent
For questions, requests, or complaints relating to privacy or this Privacy Policy, you may contact our dedicated privacy contact point:

Email: [email protected]
Postal address (privacy matters): Privacy Officer, Medium Rare N.V., Scharlooweg 39, Willemstad, Curaçao

We may also provide additional contact channels (such as secure messaging or online forms) within your account dashboard on stake-win.ca as they become available.

What Personal Data We Collect

We collect only the personal information that is reasonably necessary to operate an online gambling service, comply with legal obligations (including know-your-customer and anti - money laundering rules), and improve our products. This includes:

Identification and contact data

Full name, date of birth, and gender (where required)
Residential address and country of residence
Email address and phone number
Government-issued identification details (e.g., ID card, passport, driver's licence) and images or scans you upload for verification
Copies of utility bills, bank statements, or similar documents used to confirm your address and source of funds

Account and transactional data

Username, password (stored in hashed form), security settings, two-factor authentication data
Account status, verification status, self-exclusion or cooling-off flags
Deposit and withdrawal history, including payment method, amount, currency, timestamps, and status
Cryptocurrency transaction details, such as wallet addresses, transaction hashes, and associated payment service provider references

Technical and usage data

IP address, device identifiers, browser type and version, operating system, language settings
Log data such as login timestamps, session duration, pages visited, referring URLs, and error logs
Approximate location information derived from IP address for regulatory, security, and localisation purposes

Behavioral and gaming data

Game and betting history, including stakes, odds, outcomes, bets placed, game sessions, and time spent
Bonuses and promotions used, wagering progress, and rewards history
Clickstream data, interactions with banners, features used, and in-product messages opened or ignored

Financial and payment data

Details of payment instruments (e.g., partial card numbers, issuer country) where required and stored in tokenised or truncated form via payment providers
Information on chargebacks, disputes, refunds, and related correspondence

Communications and customer support data

Content of live chats, emails, support tickets, and phone (or VoIP) interactions
Internal notes added by our support, fraud, or compliance teams regarding your account

Cookies and similar technologies

Cookies, web beacons, pixels, local storage objects and similar technologies to recognise your browser or device, maintain sessions, personalise content, and conduct analytics and advertising (see "Cookies & Tracking Technologies" below).

Legal Basis for Processing

Our processing of personal information in relation to Stake on stake-win.ca is grounded in Canadian privacy laws, in particular the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws (e.g., Alberta, British Columbia, Québec). We also align our practices with international standards comparable to the EU General Data Protection Regulation (GDPR) and, where relevant, Mexican privacy law concepts, to facilitate consistent protection across markets. We process personal data only where we have a valid legal basis, including:

Consent

When you register an account, opt in to marketing communications, accept cookies beyond those strictly necessary, or provide optional profile information, you do so voluntarily.
You may withdraw your consent at any time (for example, by changing your communication preferences, cookie settings, or closing your account), subject to legal or contractual restrictions and reasonable notice.

Contractual necessity

We process personal information to open, operate, and manage your account; verify your identity; process deposits and withdrawals; settle bets; credit winnings; provide customer support; and enforce our Terms and Conditions.
Without this information, we would be unable to provide you with real-money gaming services on stake-win.ca.

Legitimate interests / reasonable purposes

We use data to prevent fraud, abuse, bonus misuse, and money laundering; to maintain the security and integrity of our systems; to improve our products; and to perform statistical and performance analysis.
Where required by law, we balance these interests against your privacy rights and implement safeguards such as pseudonymisation, aggregation, and access controls.

Compliance with legal and regulatory obligations

We are subject to gambling, anti - money laundering (AML), counter-terrorist financing, and financial reporting rules in Curaçao and in the markets we serve, as well as Canadian AML requirements when engaging with Canadian payment institutions.
This includes know-your-customer (KYC) verification, transaction monitoring, sanctions screening, record-keeping, and reporting to competent authorities and regulators (for example, Antillephone N.V., and where relevant, Canadian regulators such as FINTRAC via partner institutions or iGaming Ontario/AGCO for Ontario users on stake.ca).

Purpose of Processing

We collect and process personal information exclusively for specified and legitimate purposes and do not use it for purposes that are incompatible with those outlined below:

Provision and operation of gaming services

Creating and managing your account and verifying your identity and eligibility to play.
Processing deposits, wagers, game play, and withdrawals, including cryptocurrency transactions.
Applying bonuses, promotions, loyalty rewards, and tracking wagering requirements.

Service quality, optimisation, and development

Monitoring site performance, detecting errors, and improving usability and stability.
Analysing aggregated behaviour (e.g., popular games, time of day) to improve our offering and product roadmap.
Testing new features and functionalities on a limited basis (for example, using A/B testing) while minimising privacy risks.

Marketing, personalisation, and relationship management

Sending service and transactional messages (e.g., account notifications, security alerts, changes to our policies).
Sending marketing emails, push notifications, or in-site messages about promotions, bonuses, tournaments, or new features, where permitted by law and your preferences.
Personalising content, recommendations, and offers based on your profile, player segment, and gameplay behaviour, subject to applicable consent requirements.

Fraud prevention, security, and AML/KYC

Validating identity documents and payment instruments to prevent identity theft.
Detecting suspicious activity (collusion, arbitrage, bonus abuse, money laundering, or account takeover attempts) using automated tools and manual review.
Maintaining technical and organisational measures to protect our systems, including logs and audit trails.

Legal, regulatory, and business purposes

Complying with legal obligations, responding to lawful requests from law enforcement or regulators, and defending or establishing legal claims.
Producing anonymised statistics and reports for internal governance and for regulators, where required.
Facilitating corporate transactions such as restructuring, mergers, or asset transfers, subject to appropriate safeguards.

Disclosure & Sharing

We do not sell your personal information. We may share personal data with carefully selected third parties strictly for the purposes described above, subject to confidentiality, data protection obligations, and, where required, your consent.

Group entities and brand partners

Our group companies and operational partners involved in running Stake-branded services, including Medium Rare N.V., Stake Canada RH (Ontario operations), and TGP Europe Ltd (UK white-label operations), to the extent needed for compliance, risk management, and technical operations.
These entities may act as data controllers or processors depending on the context and applicable law.

Payment and financial service providers

Banks, electronic money institutions, card schemes, cryptocurrency payment gateways, and fraud-prevention tools used to process your deposits and withdrawals.
We share only the information necessary to authenticate, execute, and reconcile transactions and to prevent fraud or chargebacks.

Service providers and technical vendors

Cloud hosting providers, content delivery networks, security providers (e.g., DDoS protection), analytics platforms, email and messaging providers, customer support tools, document verification services, and responsible gambling tools.
These parties process data on our behalf and in accordance with written contracts that limit their use of your data to our documented instructions.

Regulators, supervisory and law enforcement authorities

Gaming regulators and supervisory bodies such as Antillephone N.V. (Curaçao), and, in relation to other regulated markets served by the Stake brand, iGaming Ontario/AGCO (Ontario) or the UK Gambling Commission, where applicable.
Law enforcement agencies, courts, and government authorities in Canada, Curaçao, and other jurisdictions where we are legally obliged to disclose information, for example, for AML/CTF purposes, investigations, or enforcement actions (including, where applicable, communications to authorities such as the Australian Communications and Media Authority (ACMA) in relation to website blocking orders affecting Stake-branded domains).

Advertising, affiliates, and analytics partners

Third-party analytics services to understand website usage patterns and improve performance.
Advertising networks, affiliate networks, and tracking providers for attribution and, where permitted by law, personalised advertising. We will obtain your consent when this is required (for example, for non-essential cookies).

Corporate transactions and legal claims

Prospective buyers, investors, and professional advisers (lawyers, auditors, consultants) in connection with a merger, acquisition, restructuring, or sale of assets, subject to confidentiality and data minimisation.
Third parties involved in or assisting with the management or resolution of legal disputes, insurance claims, or debt recovery where necessary to protect our rights.

Whenever we share your data, we take steps to ensure that the recipient only receives what is strictly necessary and is bound by appropriate confidentiality and data protection obligations.

International Transfers

Because Stake on stake-win.ca is operated by Medium Rare N.V. and relies on a global infrastructure, your personal information may be transferred to and processed in countries outside your province or outside Canada, including in Curaçao, the European Economic Area (EEA), the United Kingdom, the United States, and other locations where our or our service providers' servers and offices are located.

Primary processing locations: Data is routinely processed in Curaçao (operator headquarters and licensing jurisdiction) and in data centres operated by reputable cloud providers, which may be located in the EEA, the UK, or other jurisdictions with robust security practices.
Transfers from Canada: When personal information is transferred from Canada to other countries, it is subject to the laws of those countries and may be accessible to foreign courts, law enforcement, and national security authorities. We use contractual and technical safeguards to protect your information in line with PIPEDA requirements.
Standard contractual or equivalent safeguards: Where required by applicable law (for example, if EU or UK residents access our services and their data is transferred out of the EEA/UK), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or other recognised transfer mechanisms and implement supplementary technical and organisational measures.
Vendor due diligence: We select service providers that implement robust security and privacy controls aligned with recognised frameworks (e.g., ISO/IEC 27001, SOC 2) and we regularly review their performance.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to protect our legitimate interests (such as establishing or defending legal claims). Retention periods may differ based on the type of data and applicable law. Typical retention periods for Stake on stake-win.ca are:

Category of data	Typical retention period
Account profile and identification data (KYC documents, identity checks)	Up to 7 years after account closure or final transaction, to meet AML, counter-terrorist financing, and regulatory record-keeping obligations.
Transaction and betting history	Up to 7 years from the date of the relevant transaction or game session, for financial reporting, dispute resolution, and regulatory compliance.
Customer support communications	Up to 5 years after the issue is resolved, depending on the nature of the query and related regulatory needs.
Marketing preferences and communications logs	Until you withdraw consent or opt out, plus up to 2 years to maintain evidence of your preferences and compliance with anti-spam laws.
Technical logs and security data	Between 6 months and 5 years, depending on the log type and our security and compliance requirements.
Cookies and similar identifiers	From end of session (for session cookies) up to 24 months for persistent cookies, unless you delete them earlier via your browser or our cookie settings.

We will securely delete, anonymise, or aggregate data once retention periods have expired or the information is no longer needed. If you request deletion of your personal data, we will honour your request where permitted by law, but may retain certain information where we have a legal obligation or overriding legitimate interest to do so (for example, regulatory record-keeping or defence of legal claims).

Your Rights

As a user of Stake on stake-win.ca and a resident of Canada, you have important rights regarding your personal information under PIPEDA and substantially similar provincial laws. We also structure our practices to be broadly consistent with GDPR-style rights and with the principles found in Mexican privacy regulations to facilitate a high level of protection across jurisdictions. These rights are subject to certain legal limitations and exemptions:

Right to access

You may request confirmation of whether we hold personal information about you and obtain access to a copy of such information, along with an explanation of how it is used and with whom it is shared.

Right to rectification (correction)

You may request correction of inaccurate, incomplete, or outdated personal information we hold about you. In some cases, you can update certain details directly via your account settings on stake-win.ca.

Right to deletion / erasure

You may request that we delete personal information where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and there is no other lawful ground for processing), or where deletion is required by law.
We may need to retain certain data despite your request where we have legal obligations (e.g., AML record-keeping), regulatory obligations, or overriding legitimate interests.

Right to restriction and objection

You may request that we restrict processing of your information in specific circumstances, such as while we verify its accuracy or assess an objection.
You may object to certain types of processing, particularly where we rely on legitimate interests (for example, some analytics or profiling for marketing), and we will cease such processing unless we have compelling legitimate grounds or legal obligations.

Right to data portability (where applicable)

In line with GDPR-aligned best practices, we will, where technically feasible and appropriate, provide you with certain personal information in a structured, commonly used, and machine-readable format upon request so that you can reuse it or transmit it to another organisation.

Right to withdraw marketing consent

You may withdraw your consent to receive marketing communications at any time by using the "unsubscribe" link in emails, adjusting preferences in your account settings, or contacting us at [email protected].
Withdrawal of marketing consent will not affect service messages necessary for your account (e.g., security alerts, policy updates).

Exercising your rights

Submit your request: Contact us via email at [email protected] clearly indicating your identity, the right you wish to exercise, and relevant details (for example, "access request for all data associated with my stake-win.ca account").
Verification: To protect your privacy, we may request additional information to verify your identity before acting on your request (e.g., login confirmation, security questions, or additional ID).
Response time: We aim to respond within 30 days of receiving a complete request. Where permitted by law and if the request is complex, we may extend this period once by up to a further 30 days; if so, we will notify you of the extension and reasons.
Fees: We generally handle requests free of charge. If a request is manifestly unfounded or excessive, especially due to its repetitive character, we may charge a reasonable fee or refuse to act on the request, as allowed by law.

If you are located in a jurisdiction that grants additional rights (for example, in the European Union under the GDPR or in Mexico under applicable data protection regulations) and those laws apply to our relationship with you, we will honour those rights in accordance with the relevant legal requirements.

Cookies & Tracking Technologies

We use cookies and similar technologies on stake-win.ca to ensure the site functions properly, to enhance your experience, to perform analytics, and, where permitted, to support marketing and affiliation activities relevant to Stake.

Types of cookies we use

Strictly necessary (session) cookies: Essential for the functioning of the website and core features (e.g., maintaining your login session, processing transactions, and ensuring security). These are typically session cookies that expire when you close your browser and cannot be disabled through our systems, though you may block them via your browser (which may impair site functionality).
Functional (preference) cookies: Remember your preferences such as language, region, or display settings, and may be stored for a limited period after your session to improve user experience.
Analytics and performance cookies: Collect aggregated information about how visitors use stake-win.ca (pages visited, time spent, error messages) to help us improve performance and usability. These may be provided by first-party tools or trusted third parties.
Advertising and affiliate cookies: Used to track the effectiveness of our marketing campaigns and affiliate partnerships, and, where permitted, may support personalised offers or promotions. These may be persistent and set by third-party partners, subject to your consent where required.

Managing cookies

You can manage or disable cookies using your browser settings. Most browsers allow you to refuse all or some cookies, delete existing cookies, and receive a warning before cookies are stored.
We may also provide an internal cookie or privacy settings panel on stake-win.ca allowing you to manage certain categories of cookies (for example, turning off analytics or advertising cookies while keeping essential cookies).
If you disable or delete certain cookies, some features of stake-win.ca may not function as intended, and your experience may be degraded.

Data Security

We take the security of your personal information extremely seriously and employ technical and organisational measures designed to protect it against unauthorised access, disclosure, alteration, or destruction.

Technical measures

Encryption in transit and at rest: Data transmitted between your browser and stake-win.ca is protected using TLS (Transport Layer Security) version 1.2 or higher. Sensitive data is encrypted at rest using modern encryption standards.
Access controls: Access to personal data is strictly limited to authorised personnel on a need-to-know basis, enforced by role-based access controls, strong authentication, and logging of administrative activities.
Network and application security: We utilise firewalls, intrusion detection/prevention systems, DDoS protection, secure coding practices, and regular vulnerability assessments to reduce security risks.

Organisational measures

Security governance: We maintain internal policies and procedures for information security, data protection, and incident response, and we seek to align our controls with recognised industry frameworks such as ISO/IEC 27001 and SOC 2, where appropriate.
Staff training and confidentiality: Employees and contractors with access to personal data receive regular training on privacy, security, and responsible gambling obligations and are subject to confidentiality commitments.
Vendor management: Service providers are selected and monitored based on their security posture, and we require appropriate data protection and security commitments in our contracts.

Incident detection and response

We maintain procedures for promptly detecting, investigating, and responding to suspected or actual security incidents involving personal information.
Where a data breach presents a real risk of significant harm to you, we will notify you and, where required, the relevant data protection or privacy regulators in accordance with applicable law.

Complaints & Contacts

If you have questions about this Privacy Policy, concerns about how your personal information is handled, or wish to lodge a complaint, you can use the following channels:

Contacting us

Email (primary channel): [email protected]
Postal mail: Privacy Officer, Medium Rare N.V., Scharlooweg 39, Willemstad, Curaçao
In-account support: You may also contact customer support via the help or chat functionality on stake-win.ca, which can forward privacy-related matters to our privacy team.

Internal complaint procedure

Submit your complaint: Provide a clear description of your concern, including relevant dates, account identifiers, and any supporting evidence, via email or postal mail.
Acknowledgement: We will acknowledge receipt of your complaint within 5 business days where possible.
Investigation and response: We will investigate your complaint and provide a substantive response within 30 days of receipt. If we cannot respond within that time, we will inform you of the delay and the expected resolution date.
Escalation: If you are not satisfied with our response, you may ask for an internal review by a senior member of our compliance or privacy team.

External supervisory authorities

If you remain dissatisfied or believe your privacy rights have been infringed, you may have the right to lodge a complaint with a competent supervisory authority. Depending on your place of residence and the circumstances, this may include:

Canada - Office of the Privacy Commissioner of Canada (OPC)
Website: https://www.priv.gc.ca
Phone (general information): 1-800-282-1376
Canada - Provincial privacy commissioners (for residents of Alberta, British Columbia, Québec, and other provinces with their own regulators). Contact details are available through the OPC website or official provincial government sites.
Mexico - National Institute for Transparency, Access to Information and Personal Data Protection (INAI), if Mexican data protection law applies to our processing of your data.
Website: https://home.inai.org.mx
European Union / EEA - Data Protection Authorities (DPAs), if you are in the EU/EEA and GDPR applies. Contact details for national DPAs are available via the European Data Protection Board: https://edpb.europa.eu/about-edpb/about-edpb/members_en.
Gaming regulator-specific channels relevant to Stake-branded operations, such as:
- The iGaming Ontario player support portal for Ontario users of stake.ca: https://igamingontario.ca/en/player/player-support
- The Antillephone N.V. complaints portal for Curacao-licensed operations: https://gaminglicensing.com/complaints/

Please note that while we will cooperate with any competent authority, the primary framework for Stake on stake-win.ca is Canadian privacy law combined with our Curacao licensing obligations.

Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments affecting Stake on stake-win.ca.

How we notify you of changes

Minor changes: For non-material updates (clarifications, editorial changes, or updates that do not significantly affect your rights), we will post the revised Privacy Policy on stake-win.ca with an updated "Last updated" date.
Material changes: For significant changes (for example, new types of personal data collected, new purposes of processing, or substantial changes to your rights or our sharing practices), we will provide additional notice by:
- sending an email to the address associated with your account, and/or
- displaying a prominent notice or banner on stake-win.ca or in your account dashboard.
Advance notice: Where feasible and required by law, we will provide at least 30 days' advance notice before material changes take effect, so you have time to review them.

Your choices regarding updates

If you continue to use stake-win.ca after the effective date of an updated Privacy Policy, your continued use will be deemed acceptance of the updated terms, to the extent permitted by law.
If you do not agree with material changes, you may choose to stop using our services and request account closure. We will then process your personal information in accordance with this Privacy Policy as in effect immediately prior to the changes, to the extent necessary to close your account and comply with legal requirements.

Last updated: January 2026. Material changes in this version include clarified descriptions of international data transfers, expanded information on user rights aligned with Canadian and comparable international standards, and more detailed explanations of retention periods and security measures for Stake on stake-win.ca.