Spreee Privacy Policy

Spreee takes privacy seriously and the platform is built to collect only the data we actually need to run a safe, compliant social casino. This Privacy Policy is the full, plain English statement of what we collect, why we collect it, how we protect it, when we share it with third parties and what rights you have as a Canadian user under the Personal Information Protection and Electronic Documents Act, the equivalent provincial laws and the standard set by the Office of the Privacy Commissioner of Canada.

Wherever this policy gets technical, a plain English summary is included next to the formal language. If anything in this document is unclear or if you want to exercise any of the rights described below, the Spreee privacy team is reachable through the contact details at the end of this page and commits to a written response inside one business day.

When you create a Spreee account we collect your registered email address, your chosen username, your date of birth, your province of residence and a salted hash of your password. We do not collect your real name, your home address, your phone number or any government ID at the registration step. If you later choose to buy a Gold Coin pack in the Shop, the payment processor collects the payment details directly and returns only a token to Spreee, which means we never see your full card number.

For sweepstakes prize redemptions above the threshold set by Canadian law, the Spreee compliance team collects additional identity verification documents including a government issued photo ID and proof of address. These documents are reviewed by a trained agent, held only for the period required by anti money laundering law and then securely deleted in line with our data retention schedule.

Every page on Spreee is served over 256 bit SSL. Every account password is salted and hashed using industry standard algorithms. Two factor authentication is available on every account and strongly encouraged for any account with a meaningful Spreee Coin balance. Payment data is tokenised and never stored on Spreee servers. Identity verification documents are stored on encrypted infrastructure that is segregated from the general application database and accessible only to the compliance team for the specific purposes set out above.

Access to personal data inside the Spreee team is limited to the smallest possible group of employees on a need to know basis. Every access event is logged, audited monthly and reported to the privacy lead. Spreee runs annual third party security audits and the high level results are made available to any user who requests them. In the event of any data incident, the privacy team commits to notifying affected users inside the seventy two hour window set by Canadian and EU best practice.

Under PIPEDA and the equivalent provincial laws you have the right to access the personal data Spreee holds about you, the right to request correction of any inaccurate data, the right to withdraw consent to optional uses like marketing email and the right to request deletion of personal data subject to the legal retention requirements explained in our data retention schedule. All of these rights can be exercised by contacting the Spreee privacy team through the contact details at the end of this page.

The privacy team commits to a written acknowledgment of every request inside one business day and a substantive response inside thirty days, which is the timeline set by PIPEDA. If you are not satisfied with a response from the Spreee privacy team you have the right to complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or to the equivalent provincial privacy commissioner for your province.