What Personal Data Does Core Sport Collect, and Why?

1. Scope of This Policy and What We Collect

This policy covers every personal data point Core Sport gathers through coresportbet.com, our account systems, and our support channels. It applies to registered account holders, prospective bettors browsing our markets, and anyone contacting support. We collect identity data (legal name, date of birth, residential address), contact data (email, phone number), financial data (deposit and withdrawal records, payment instrument details), technical data (IP address, device identifiers, browser type), and wagering data (bet history, stake amounts, odds selected, settlement outcomes).

Some data arrives directly from you at registration. Other data — session logs, device fingerprints, betting patterns — is generated automatically as you use the sportsbook. We do not purchase personal data from third-party data brokers, and we never collect more than regulatory compliance and service delivery actually require.

2. Who Is Responsible for Your Data

Core Sport (operating coresportbet.com) acts as the data controller for information collected through this website. Our Compliance Office, reachable via the contact details in Section 8 below, oversees data governance, breach response, and regulatory reporting obligations under Canadian and applicable international frameworks.

3. Legal Grounds for Data Processing

Core Sport processes personal information in accordance with applicable data protection laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada and the General Data Protection Regulation (GDPR) where cross-border data transfers apply. Every data processing activity relies on at least one defined lawful basis:

• Performance of a Contract: Processing your contact details, financial transactions, and account preferences is required to deliver sports wagering services, execute payouts, and maintain your user account as specified in our terms and conditions.
• Legal and Regulatory Obligations: We are legally mandated by regulatory authorities to collect identity verification records, perform Anti-Money Laundering (AML) monitoring, enforce age restrictions (19+ in most Canadian provinces, 18+ in Alberta, Manitoba, and Quebec), and maintain transactional ledgers for a statutory period of no less than five years.
• Legitimate Interests: We analyze user interaction patterns to improve infrastructure resilience, combat fraudulent chargebacks, detect irregular syndicate wagering on our sportsbook platform, and safeguard network integrity.
• Consent: Where required by law, such as for direct marketing communications or non-essential analytical cookies, we collect explicit opt-in consent, which you can revoke at any time via your account preferences.

We apply data minimization at every intake point. A field that does not serve one of the four grounds above simply isn't collected, regardless of how useful it might seem for internal reporting.

4. Disclosure and Sharing of Personal Data

Core Sport does not sell or rent personal information to external brokers. We share data solely with authorized third parties strictly necessary to deliver regulated wagering services and uphold compliance standards:

• Payment Processing Gateways: Encrypted financial identifiers and transaction amounts are transmitted to verified payment processors, including Interac, Visa, Mastercard, and electronic funds transfer (EFT) partners, to securely settle deposits and withdrawals in Canadian Dollars (CAD).
• Identity Verification and Fraud Prevention Services: Government-issued identity documents, proof of residential address, and device fingerprints are verified against trusted credit bureaus, sanction databases, and automated KYC verification networks.
• Regulatory Authorities and Law Enforcement: Data may be disclosed to provincial gaming commissions, financial intelligence units (such as FINTRAC), or dispute resolution arbitrators when required by court order, statutory subpoena, or ongoing regulatory inquiry.
• Responsible Gaming Infrastructure: If you elect to implement deposit caps, cooling-off intervals, or self-exclusion, your status is recorded and synchronized across our internal compliance registries to support responsible gaming practices.

5. Data Retention Schedules and Storage Security

Personal data is retained only for as long as necessary to fulfill the business, contractual, and legal purposes for which it was gathered. Account profiles and transaction histories remain active throughout your customer lifecycle. Following account closure or permanent self-exclusion, core identification records and audit logs are securely archived for five (5) to seven (7) years in compliance with Canadian anti-money laundering and corporate taxation regulations. Once retention obligations expire, data is permanently scrubbed or irreversibly anonymized.

All stored personal data is safeguarded using TLS 1.3 cryptographic protocols in transit and AES-256 encryption at rest. Internal access is strictly limited through role-based access control (RBAC), multi-factor authentication (MFA), and routine third-party penetration testing to prevent unauthorized data exposure.

6. Cookies, Tracking Technologies, and Analytics

Our website utilizes first-party and third-party cookies, local storage, and server log files to ensure platform stability and session continuity:

• Strictly Necessary Cookies: Essential for authenticating user logins, securing wagering betslips, and keeping balance displays accurate across active browser sessions.
• Performance and Analytics Cookies: Used to measure page load times, identify navigational errors, and optimize mobile responsiveness without collecting personally identifiable information.
• Functional Cookies: Retain interface customizations such as language preferences (English/French), odd display formats (Decimal, American, Fractional), and time-zone settings.

You can manage cookie settings directly within your web browser settings. Disabling essential cookies will impact navigation and prevent real-time odds updates.

7. Your Statutory Rights and Access Requests

Under Canadian privacy legislation and international data frameworks, you hold distinct rights regarding your personal records held by Core Sport:

• Right of Access: You may request a complete copy of the personal data we store about your profile, account history, and transaction logs.
• Right to Rectification: You may correct inaccurate or incomplete details by editing your profile settings or submitting updated verification documents to support.
• Right to Restriction and Erasure: You can request data deletion or processing limits, provided the requested data is not subject to mandatory regulatory retention periods.
• Right to Data Portability: You have the right to obtain your structured transaction and activity logs in a machine-readable CSV or JSON format.

To exercise your statutory data rights or raise privacy concerns, contact our designated Data Protection Officer (DPO) at [email protected]. Verification of identity will be required before processing formal data disclosure requests, with all verified inquiries answered within thirty (30) calendar days.

5. Third-Party Data Disclosures and Operational Processors

Core Sport does not monetize, rent, or sell your personal information to third parties. However, maintaining an operational sports betting and online gaming platform requires processing data through specialized third-party infrastructure. All external vendors operating on our behalf are bound by strict Data Processing Agreements (DPAs) ensuring full compliance with Canadian privacy legislation (including PIPEDA and applicable provincial frameworks) and international data protection standards.

Your information may be transferred to or processed by the following specific categories of third-party partners:

• Payment Service Providers: Financial details, payment history, and billing records are shared with secure transaction gateways—including Interac e-Transfer, Gigadat, Visa, Mastercard, and MuchBetter—to execute deposit requests, clear withdrawals, and perform mandatory anti-fraud verification checks.
• Identity Verification and KYC Services: To comply with legal age validation and anti-money laundering regulations, identity documentation (such as government-issued photo identification and proof of address) is submitted to automated identity verification networks like Jumio, Onfido, and TransUnion Canada.
• Gaming and Odds Software Providers: Betting data, system event logs, and user IDs are processed by platform technology vendors and data feed feeds (such as Sportradar and Kambi) to render live odds, calculate wager outcomes, and ensure platform integrity.
• Security and Fraud Prevention Networks: Behavioral telemetry, device identifiers, and IP routing data are evaluated by cybersecurity providers like Sift and Cloudflare to prevent automated bot attacks, multi-accounting, and fraudulent transaction attempts.
• Analytics and Marketing Partners: Aggregated, pseudonymized user trends are processed through analytical tools like Google Analytics to evaluate system performance and optimize site navigation. You can adjust your preferences at any time in accordance with our user communications guidelines outlined in our terms and conditions.
• Regulatory Bodies and Law Enforcement: Personal record files may be disclosed to regulatory agencies—such as provincial gaming regulators, financial intelligence units like FINTRAC, or law enforcement officers—where required by subpoena, court order, or statutory compliance obligations.

6. Statutory Privacy Rights and Data Control

Under Canadian privacy frameworks and applicable regulatory standards, account holders possess well-defined statutory rights regarding how their personal data is collected, stored, and processed. Core Sport maintains straightforward procedures allowing you to exercise these rights at any point during or after your active account relationship.

• Right to Access and Portability: You have the right to request a complete copy of the personal data held about your account, including profile details, transaction records, wagering history, and communications logs. Data exports are supplied in a structured, standard electronic format.
• Right to Rectification: If any personal details (such as address changes or updated identification numbers) become outdated or inaccurate, you may submit updated documentation to correct your master profile record.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal account data. Please note that this right is subject to statutory retention limits mandated by Canadian financial regulatory statutes, which require transaction histories to be preserved for 5 to 10 years following account closure.
• Right to Restrict or Object to Processing: You may request that we suspend active processing of your data under specific conditions—such as while an accuracy dispute is under review—or object entirely to processing activities conducted under legitimate business interest grounds.
• Right to Opt Out of Direct Marketing: You maintain absolute control over promotional communications and may opt out at any time via your account settings page or by clicking the unsubscribe link embedded in promotional email footers.

7. Technical Security Measures and Retention Schedules

Core Sport enforces multi-layered technical, physical, and administrative safeguards designed to secure personal data against unauthorized access, destruction, loss, or alteration. All web communications and API interactions are encrypted using TLS 1.3 protocol standards, while database assets at rest are secured with AES-256 bit encryption. System infrastructure undergoes regular vulnerability assessments and independent security audits in alignment with ISO/IEC 27001 standards.

Data is retained only as long as necessary to fulfill operational, legal, and regulatory obligations:

• Active Account Data: User account profile details, preferences, and active log files remain stored throughout the operational lifetime of your registered account.
• Financial & Transactional Records: Deposit, withdrawal, and betting transaction logs are retained for a minimum of 7 years following account closure to satisfy tax reporting and FINTRAC anti-money laundering compliance requirements.
• Responsible Gaming Data: Self-exclusion records and player protection notes are retained for extended periods to ensure mandatory exclusion rules are strictly enforced across our ecosystem, matching our compliance commitments outlined in our responsible gambling policy.

8. Data Protection Officer and Contact Information

If you have questions regarding this Privacy Policy, wish to submit a data access or correction request, or require assistance with privacy-related inquiries, please contact our Data Protection Officer (DPO):

Data Protection Officer: Core Sport Compliance Office
Email Address: [email protected]
Mailing Address: Core Sport Legal Operations, 250 Yonge Street, Suite 2200, Toronto, ON M5B 2L7, Canada

If you believe your privacy rights have not been adequately addressed, you retain the right to submit a formal inquiry or complaint directly to the Office of the Privacy Commissioner of Canada (OPC) or your local provincial privacy commissioner. Learn more about our legal framework on our licensing disclosures page or view our corporate background on the about page.