Privacy and personal information policy

1. Who is responsible & Privacy Officer

The British Columbia Lottery Corporation (BCLC) is accountable for the personal data collected through this website. BCLC is a provincial Crown corporation and a public body under British Columbia's Freedom of Information and Protection of Privacy Act (FIPPA). FIPPA — not the private-sector Personal Information Protection Act — is the law that governs how BCLC may collect, use, disclose, retain and protect your personal data, and it is the law that gives you a right of access to it.

Privacy compliance is the responsibility of BCLC's Privacy Officer, who is an employee of BCLC:

• Privacy Officer, British Columbia Lottery Corporation
• Email: [email protected] — a BCLC-operated mailbox, monitored by the BCLC privacy team
• Post: Privacy Officer, British Columbia Lottery Corporation, 74 West Seymour Street, Kamloops, BC, V2C 1E2, Canada

The Privacy Officer handles access and correction requests under FIPPA, complaints and breach notification, and is BCLC's point of contact for the Office of the Information and Privacy Commissioner for British Columbia (OIPC).

A formal FIPPA access request may also be made directly to BCLC's Freedom of Information office. A request sent to the Privacy Officer at either address above is routed there and is treated as received on the day it arrives.

2. What this policy covers

This policy covers both BCLC domains for Daily Grand: dailyrewardcontest.com and play.dailyrewardcontest.com. It covers the personal data BCLC collects through them — enquiries and support messages, account and verification details submitted through this site's forms, marketing sign-ups, play and prize records shown to you here, and technical and cookie data from your visit.

This policy does not cover third-party websites we link to, which have their own privacy policies. Where the national game requires it, limited information is shared with the Interprovincial Lottery Corporation (ILC); that sharing is described in section 10.

3. What we collect

• Account details: name, date of birth, residential street address, city, province and postal code, email address, and your password (stored only as a one-way hash, never in readable form).
• Verification data: the image or PDF of the government-issued identification you upload to confirm age and residency, its type, a fingerprint (hash) of the file, and the result of the check (pending, approved or rejected).
• Orders and tickets: the game, draw, numbers, Extra, price and status of each order, and the ticket ID issued by BCLC's central gaming system.
• Payment information: the payment method type, the last four digits of a card, the cardholder name, transaction amounts, dates and reference numbers. See section 7 — we do not receive or store full card numbers, expiry dates or CVV codes.
• Play data: the lines associated with your account, results and prize records, where these are shown to you through this site.
• Responsible-gambling data: limits you have set, cooling-off periods, and any self-exclusion status. This is treated as sensitive.
• Communications: emails, support messages and form submissions, including anything you choose to put in them.
• Technical data: IP address, approximate location derived from it, device and browser type, operating system, referring page, pages viewed and timestamps — used to confirm you are in B.C., to keep accounts secure and to detect fraud.
• Cookie and consent data: your consent choices and the identifiers described in our Cookies Policy.

We do not knowingly collect health information, biometric templates, government identifiers beyond what verification requires, or information about race, religion, political opinion, sexual orientation or trade-union membership. Please do not send us any of it.

4. Why we may collect it — the authority under FIPPA

A public body may not collect personal data simply because it would be useful. FIPPA section 26 sets out the only permitted grounds: collection expressly authorised under an Act (s.26(a)), collection for the purposes of law enforcement (s.26(b)), information that relates directly to and is necessary for a program or activity of the public body (s.26(c)), and collection with your consent given in the manner FIPPA prescribes (s.26(d)). Once collected, use is limited by s.32 and disclosure by s.33. Where we collect information directly from you, s.27(2) requires us to tell you the purpose, the legal authority and who to contact about it — this section is that notice.

Any question about the authority for a particular collection can be put to the Privacy Officer at [email protected].

5. How we use it

Our site uses personal data to open and run an account; confirm you are eligible to play; process plays, payments and prizes; operate responsible-gambling tools; meet legal, regulatory and tax obligations; prevent and detect fraud, money laundering and unauthorised access; respond to support requests; keep the site secure and working; and — only with your consent — measure how the site is used and send you marketing.

We never sell personal data, and we do not disclose it for another organisation's independent marketing purposes.

6. Identity verification & automated decisions

Confirming your age and B.C. residency is a regulatory requirement. Identification you provide is used for that purpose, for AML obligations and for fraud prevention. It is not used for marketing and is not disclosed to advertisers.

Automated decision-making. Identity verification, geolocation checks and fraud and AML screening are partly automated: a system compares what you submit against reference data and risk rules, and can automatically pass a check, flag it for manual review, or decline it. An automated decline can prevent you from opening an account, playing or withdrawing.

Your right to a human review. If an automated check goes against you, you can ask for it to be reviewed by a person. Email [email protected], say what was refused and when, and we will have someone who was not involved in the automated outcome look at it and reply within 30 business days. We will explain the general reason for the outcome, except where telling you would compromise an investigation or breach a legal prohibition — as with AML reporting, where the law forbids us from telling you.

7. Payment information & PCI DSS

Online payment on this site will be processed by BCLC's approved payment provider. Until that provider is connected, this site takes no payment and collects no card or bank details. When it is connected, card details will be entered with the provider, which is accountable for them under the PCI Data Security Standard; this policy will then name the provider and say exactly how card data reaches it before any payment is taken.

What we hold is the order record: the amount, the currency, the date, the status and the provider's reference.

8. Service providers & processors

Our site uses third-party providers to run the service. Under FIPPA they are our service providers: they handle personal data on our behalf, under written contract, only on our instructions, only for the purposes we set, with confidentiality and security obligations and no right to reuse the data. FIPPA's duty to protect personal data (s.30) applies to information in their hands as much as in ours, and the offences and duties in s.30.5 bind their employees too. The categories are:

We will name the specific providers in each category on request — email [email protected] and we will tell you who they are and where they process data. The named third parties currently used for cookies and tracking are listed in our Cookies Policy.

9. Storage & processing outside Canada

How the rules changed. Until 25 November 2021, FIPPA section 30.1 required a public body to store personal data in Canada and to access it only from Canada, with narrow exceptions. That section was repealed, together with section 30.2, which had required public bodies to report foreign demands for disclosure. Storage and access outside Canada are therefore no longer prohibited — but they are not unregulated either.

What still governs it. Three FIPPA duties continue to apply, and they are the ones that matter to you:

• Authority to disclose — s.33. Sending personal data to a service provider, in or outside Canada, is a disclosure. It is lawful only if a paragraph of section 33 authorises it — in our case, disclosure to a service provider performing services for BCLC, for the purpose the information was obtained for or a consistent purpose. Anything not authorised by s.33 does not leave, wherever the server is.
• Duty to protect — s.30. We must make reasonable security arrangements against unauthorised access, collection, use, disclosure or disposal. The OIPC's position is that this duty travels with the information: where a jurisdiction's legal protections are inadequate, sending personal data there is itself a breach of s.30. Choosing the country is part of securing the data, not separate from it.
• Assessment before the fact. BCLC assesses the privacy risk of an initiative, including where information will be stored and accessed, in a privacy impact assessment before the initiative proceeds, in line with the directions and guidance issued for public bodies. We do not add a new destination country first and assess it afterwards.

What that means in practice. While personal data is outside Canada, it is subject to the laws of the country it is in. That includes laws that can compel disclosure to foreign courts, law-enforcement agencies and security services — potentially without your knowledge and without a Canadian court being involved. Since the repeal of s.30.2 there is no longer a statutory duty on us to report such a foreign demand, so we tell you plainly: contractual protections do not override the local law that applies to the recipient, remedies in those countries may be weaker than in British Columbia, and we will not claim otherwise. Where we are lawfully able to tell you that a foreign authority has demanded your information, we will.

We retain information in Canada where a provider offers that option, limit what leaves to what the provider actually needs, and require encryption in transit.

For the current list of countries in which a specific provider stores or accesses your information, contact the Privacy Officer at [email protected].

10. Disclosure to government & law enforcement

FIPPA section 33 lists the only circumstances in which a public body may disclose personal data. Several of them do not depend on your consent, and in some cases the law forbids us from notifying you. Specifically:

• FINTRAC. Large cash transactions, large virtual-currency transactions and transactions with reasonable grounds for suspicion are reported to Canada's financial intelligence unit. The law prohibits telling you that a suspicious transaction report has been made, so you will not be notified.
• Police and law enforcement. Where there are reasonable grounds to believe an offence has been or may be committed, or in response to a lawful demand, warrant, production order or subpoena.
• The gambling regulator. The Independent Gambling Control Office (IGCO), for investigations, audits and compliance under the Gaming Control Act (B.C.).
• Tax authorities. The Canada Revenue Agency and provincial tax authorities where a legal obligation or lawful demand applies.
• Courts. Where required by court order, or where necessary to establish, exercise or defend a legal claim.
• Emergencies. Where there is an imminent risk to someone's life, health or safety.

We disclose only what the request or obligation actually requires, we check that a demand is lawful and falls within section 33 before acting on it, and we push back on requests that are overbroad. Where we are permitted to tell you about a disclosure, we will.

11. Self-exclusion data sharing

If you enrol in Game Break, B.C.'s voluntary self-exclusion program, that fact cannot be kept private within the gambling system — an exclusion that nobody can see cannot be enforced. Your identity and exclusion details are entered into our self-exclusion register and shared with the systems and, where facial-recognition or door-check processes are used, with the staff and venues that need to enforce the ban at gambling facilities and online. That sharing is a disclosure authorised by FIPPA s.33 for the purpose the information was collected for.

We record and act on your exclusion status so that we do not send you marketing, do not target you with advertising, and do not process play through this site during the exclusion period. Self-exclusion records are treated as sensitive, are retained for the term of the exclusion and for 5 years after it ends, for audit and enforcement, and are not used for any purpose other than administering and enforcing the exclusion and meeting regulatory obligations.

12. Marketing & CASL

We send commercial electronic messages only in accordance with Canada's Anti-Spam Legislation (CASL), which applies to us regardless of FIPPA. In practice, that means:

• Express opt-in consent. We do not add you to a marketing list because you opened an account, made an enquiry or bought something. Consent is a separate, deliberate action: an unticked box you tick yourself. We record what you consented to, when, and how.
• Sender identification. Every marketing message identifies who is sending it and on whose behalf, and includes a valid postal address and a working email address or web link, kept valid for at least 60 days after the message is sent.
• Unsubscribe in every message. Every commercial message contains a clearly set out unsubscribe mechanism that works for at least 60 days and takes no more than two clicks. We action unsubscribes without delay and in any event within 10 business days, with no requirement to log in, give a reason or contact support.
• No marketing to excluded or under-age individuals, and none to anyone enrolled in Game Break.
• Transactional messages continue. Unsubscribing from marketing does not stop service messages — security alerts, verification requests, payment confirmations, changes to terms and legally required notices — because those are not commercial electronic messages.

To withdraw marketing consent, use the unsubscribe link in any message or email [email protected].

13. Cookies & tracking

Our site uses essential cookies to run the site, and — only with your consent — analytics and advertising cookies. You choose through the consent banner on your first visit, and you can change or withdraw your choice whenever needed using the "Cookie settings" control in the footer. Full details, including the named third parties, the identifiers used and their lifetimes, are in our Cookies Policy.

14. How long we keep it

We retain personal data only as long as we need it. For each type of record, this table gives the period, when it starts and why. Where a federal anti-money-laundering rule applies, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations set a minimum of five years for the prescribed records, counted from the date the regulations specify; a longer period is kept only where another law, an open investigation or a legal hold requires it — never as a blanket rule.

Deletion runs on a schedule: identification files, support requests, login attempts and expired links are removed automatically when their period ends. Where a record is under legal hold — an open investigation, a regulatory review, a complaint or litigation — it is kept until that ends. Anonymised statistics that can no longer identify anyone may be kept indefinitely.

15. Your rights & how to exercise them

FIPPA gives you the following rights over the information we hold about you. They are statutory rights against a public body, enforceable through the OIPC — not a courtesy.

Access — FIPPA Part 2

You can ask for the personal data we hold about you, and for the other records FIPPA gives a right of access to. Make the request in writing (email is fine) and give enough detail to identify the records.

We must respond within 30 business days of receiving the request — FIPPA section 7. FIPPA counts in days that exclude Saturdays and statutory holidays, so this is a working-day deadline, not a calendar month. Section 10 lets us extend by up to a further 30 business days where the request does not give enough detail to identify the records, where it covers a large number of records and meeting the deadline would unreasonably interfere with operations, or where we must consult another public body or a third party. A longer extension needs the Commissioner's permission. If we extend, we will tell you before the first deadline passes, why, and when to expect a reply.

There is no charge for access to your own personal data. Where FIPPA permits a fee for other records, we give you a written estimate first and you may narrow or withdraw the request, or ask for the fee to be waived.

Access can be refused or limited only on the grounds FIPPA sets out in Part 2, Division 2 — for example where disclosure would be an unreasonable invasion of a third party's privacy, would reveal information supplied in confidence or harm a third party's business interests, is subject to solicitor-client privilege, would harm a law-enforcement matter, or where another Act prohibits disclosure (as with AML reporting). If we refuse, we will say so in writing, cite the section relied on, sever and release what we are able to, and tell you how to ask the OIPC to review the decision.

Correction — FIPPA s.29

You can ask us to correct personal data about you that is inaccurate or incomplete. Where we agree, we correct it. Where we do not, FIPPA requires us to annotate the record with your requested correction, so that anyone who later reads it sees your position, and to tell you why we did not make the change. Either way, we notify any public body or third party to whom the information was disclosed in the year before the correction request.

Withdrawing consent

Where we rely on your consent — marketing, and analytics and advertising cookies — you can withdraw it whenever needed, and we stop. Withdrawal takes effect going forward and does not undo anything already done lawfully.

Most of what we hold is not held on the basis of consent: it is collected under the statutory authorities in section 4 above, and there is no consent to withdraw. Identity verification, AML records and gaming records fall in that category. The way to end that processing is to close the account, after which the retention periods in section 14 apply.

Deletion

You can ask us to delete personal data. We will delete what we are not required to keep, and tell you plainly what we must retain and for how long — see the retention table in section 14. Where information cannot be deleted, we restrict it so it is used only for the purpose that requires its retention. FIPPA gives no right of erasure, and a public body must keep personal data used to make a decision about you for at least one year after that decision; we will not claim to have deleted something we have not.

Portability

FIPPA does not give a right to data portability. We nevertheless provide the personal data you gave us, on request, in a structured, commonly used, machine-readable format (CSV or JSON), so you can keep or reuse it. Ask the Privacy Officer.

Human review of an automated decision

See section 6.

How to make a request

Email [email protected] or write to the Privacy Officer at the BCLC address in section 1. Say that you are making a request under FIPPA, what you want, and enough detail to find the records; the clock in section 7 starts when the request reaches us. We will verify your identity before releasing anything — that check protects you, and we ask only for what is needed to confirm it is you. You may authorise someone to act for you in writing.

16. Security

The protections in place on this site are: encryption in transit (HTTPS/TLS); passwords stored only as one-way hashes; sessions that expire after 30 minutes of inactivity and end on the server when you log out or reset your password; identification documents stored outside the public web space with access restricted to the service account and authorised reviewers; protection against cross-site request forgery and repeated login attempts; and scheduled deletion at the end of each retention period. We do not claim protections that are not in place: additional measures, such as encryption at rest or multi-factor authentication for staff, will be listed here only once they are implemented.

No system is perfectly secure. Please use a strong, unique password, enable any additional authentication offered, and tell us immediately at [email protected] if you suspect your account or information has been compromised.

17. If there is a breach

Breach notification is a statutory duty under FIPPA section 30.5, not a discretionary courtesy. Anyone at BCLC or at one of our service providers who learns of an unauthorised disclosure must report it internally immediately. We then investigate, contain it, and assess whether the breach could reasonably be expected to result in significant harm — which includes identity theft, fraud, financial loss, damage to reputation or relationships, humiliation, and loss of employment or professional opportunity.

Where that threshold is met we will, without unreasonable delay:

• Report to the Commissioner. Notify the Office of the Information and Privacy Commissioner for British Columbia, as s.30.5 requires.
• Notify you directly — by email or, if we cannot reach you, by a conspicuous notice on this site — describing what happened, when, what information was involved, what we have done, what we are doing to reduce the harm, what you can do to protect yourself, and how to contact us with questions.
• Notify other organisations, such as payment providers or law enforcement, where doing so may reduce the risk to you.
• Keep a record of every breach, whether or not it was notifiable, for at least 24 months, and make those records available to the Commissioner on request.

We will not delay notification to complete an investigation, and we will not downplay what happened.

18. People under 19

This service is not for anyone under 19. We do not knowingly collect personal data from people under that age, and we do not market to them. If we learn that we have collected information from someone under 19, we delete it promptly and close any associated account. If you think a minor has provided us with information, contact [email protected]. See our Safer Gambling page for how access by minors is prevented, including parental control software.

19. Changes to this policy

We may update this policy. The current version is always posted here with its version number and "last updated" date.

For a material change — a new purpose for using your information, a new category of recipient, a new country in which it is stored or accessed, or a longer retention period — we will give at least 30 days' notice before it takes effect, by notice on this site and, where we hold your email address, by email. A change that widens a purpose beyond the authority relied on in section 4 requires a new authority under FIPPA, not merely a new version of this page; where consent is the authority, we will ask for it rather than assume it from continued use.

20. Complaints

Raise a privacy concern with our Privacy Officer first, at [email protected]. We acknowledge within 2 business days, investigate, and give a written response within 30 business days, telling you what we found and what we have done.

If you are not satisfied, take it to the Office of the Information and Privacy Commissioner for British Columbia (OIPC) at oipc.bc.ca. The OIPC oversees both FIPPA and PIPA, and BCLC is answerable to it as a public body under FIPPA. There are two routes:

• A request for review where you disagree with our decision on an access or correction request — including a refusal, a severing, a fee or a missed deadline. FIPPA sets a time limit for asking for a review, running from the date you are notified of our decision; the current limit is published by the OIPC, so do not sit on it.
• A privacy complaint about how we collected, used, disclosed, retained or protected your personal data. The Commissioner may investigate, audit our practices and order us to change them.

You do not need our permission for either, and you can approach the OIPC directly whenever needed. Raising it with us first is usually faster, but it is not a precondition.

21. Contact

Privacy Officer, British Columbia Lottery Corporation — [email protected], a BCLC-operated mailbox. By post: Privacy Officer, British Columbia Lottery Corporation, 74 West Seymour Street, Kamloops, BC, V2C 1E2, Canada.

For anything that is not a privacy matter, see our Help & support page or email [email protected].

22. Version history

To request a copy of an earlier version, email [email protected], quoting the version number.