Privacy Policy

This Privacy Policy explains how personal data is collected and used when you visit or use the online casino services offered on the domain rocketplay-win.ca as part of the Rocket Play project (collectively, the "Website"). It applies to all Website visitors, registered players, and other individuals whose data we process in connection with our services.

The Policy is intended to comply with applicable privacy requirements for Canadian users, while also aligning with international standards such as the EU General Data Protection Regulation (GDPR) and relevant Mexican data protection principles where appropriate. By accessing or using the Website, you acknowledge that you have read and understood this Privacy Policy.

Effective date: 1 January 2026

Who We Are

The Website rocketplay-win.ca (Rocket Play) is operated for the online casino brand Rocket Play by:

Operator (data controller): Dama N.V., a company incorporated under the laws of Curaçao
Registered address: Scharlooweg 39, Willemstad, Curaçao
Registration number: 152125 (Curaçao)
Gaming licence: Antillephone N.V. License No. 8048/JAZ2020-013, held by Dama N.V. in Curaçao (status: VALID as of 22 May 2024)

For certain payment-related operations, Dama N.V. is assisted by:

Payment agent / subsidiary: Strukin Ltd
Registered address: Pavlov Nirvana & Aipeias, 4, ALPHA TOWER, Floor 1, Flat 11, 3021 Limassol, Cyprus
Registration number: ΗΕ 407624 (Cyprus)

Important regulatory note for Canadian users: Rocket Play operates as an offshore online casino for Canadian players under its Curaçao licence. According to the information available, it is not licensed by iGaming Ontario (AGCO) and is not listed in the iGaming Ontario directory.

Data Protection Contact: For privacy-related questions, requests, or complaints, you may contact our data protection team (Data Protection Department) by using the customer support or contact options available on https://rocketplay-win.ca and clearly marking your message with the subject "Privacy" or "Data Protection". You may also write to:

Dama N.V. - Data Protection Department
Scharlooweg 39
Willemstad, Curaçao

What Personal Data We Collect

Information you provide to us

Identification and contact data: first and last name, date of birth, country of residence, physical address, email address, phone number, username, and similar identifiers provided when you register or update your account.
Account data: login credentials (stored securely), security questions/answers, communication preferences, documents uploaded for verification (ID documents, proof of address, payment ownership evidence).
Support communications: information you include in messages to customer support, complaints, surveys, or feedback forms.

Technical and device data

Technical identifiers: IP address, approximate geolocation derived from IP, device type, operating system, browser type and settings, language settings, and unique device identifiers where applicable.
Usage logs: login and logout timestamps, session duration, visited pages, clickstream data, referral URLs, and error logs necessary to ensure security and service quality.

Payment and transactional data

Payment details: partial payment card information (card type, masked card number, expiry date), e-wallet identifiers, bank transfer references. Full card data is typically processed directly by our payment providers and not stored in full on our systems.
Financial transactions: deposits, withdrawals, bonuses credited, chargebacks, refunds, transactional timestamps, amounts, and currencies.
Verification data: results of Know-Your-Customer (KYC) and Anti-Money Laundering (AML) checks performed by us or by third-party verification providers.

Behavioral and gaming data

Gameplay data: betting history, games played, session duration, wins and losses, bet sizes, game preferences.
Interaction data: clicks, navigation patterns, response to in-game prompts, participation in promotions and tournaments.
Responsible gambling indicators: self-exclusion status, limits set by you (deposit, loss, wager, session), and in some cases internal risk indicators used to detect problematic gambling or fraud.

Cookies and similar technologies

Cookies: small text files stored on your device to remember settings, maintain sessions, and understand how the Website is used.
Similar technologies: web beacons, pixels, and local storage used for analytics and advertising personalisation where permitted by law.

More details are provided in the "Cookies & Tracking Technologies" section below.

Data from third parties

Payment providers and banks: confirmation of payments, card validity status, chargeback information, and limited KYC data.
Verification and risk management services: identity verification results, sanctions and politically exposed persons (PEP) screening, fraud prevention signals.
Marketing and affiliate partners: information about how you arrived at the Website (e.g., affiliate ID, campaign ID, click ID) and aggregated performance data.

Legal Basis for Processing

Performance of a contract

We process personal data to create and operate your player account, verify your eligibility, provide access to games, process deposits and withdrawals, apply bonuses, and provide customer support.
This processing is necessary to enter into and perform the Terms & Conditions you agree to when registering on rocketplay-win.ca (Rocket Play).

Compliance with legal obligations

As a licensed gaming operator under Curaçao law, we must conduct KYC and AML checks, prevent fraud and money laundering, and maintain appropriate records.
We process and retain data to comply with tax, accounting, anti-fraud, and responsible gambling obligations imposed by applicable laws and licensing conditions in Curaçao and other relevant jurisdictions.

Legitimate interests

Security and fraud prevention: monitoring accounts and transactions to detect and prevent fraud, abuse, and technical threats.
Service improvement and analytics: analysing aggregated usage and game performance data to improve the Website, fix errors, and develop new features.
Enforcement of our rights: investigating violations of our Terms & Conditions, recovering debts, and defending against legal claims.
Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations, applying additional safeguards where needed.

Consent

We may rely on your consent for certain processing activities, for example:
- sending marketing communications by email, SMS, push notifications, or other electronic means, where required under Canadian anti-spam rules and other applicable laws;
- using non-essential cookies and similar technologies for analytics and advertising personalisation;
- processing sensitive verification data beyond what is strictly required by law, where we ask for your explicit consent.
You may withdraw your consent at any time as described in the "Your Rights" section. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Purpose of Processing

Provision and operation of casino services

Creating and managing your account on rocketplay-win.ca (Rocket Play).
Providing access to casino games, bonuses, tournaments, and related functionality.
Processing payments, including deposits and withdrawals, and verifying ownership of payment methods.

Regulatory compliance and risk management

Carrying out identity verification, source-of-funds checks, and ongoing monitoring for AML and counter-terrorist financing purposes.
Ensuring that you meet legal age and eligibility requirements and that we comply with applicable gambling regulations.
Monitoring activity to detect and prevent fraud, abuse of bonuses, and security incidents.

Service improvement and analytics

Understanding how players use the Website and games (e.g., which games are popular, how features are used) to improve functionality and user experience.
Performing statistical, de-identified, or aggregated analytics for business reporting and product development.

Marketing and personalisation

Sending you promotional materials, newsletters, and special offers where permitted by law and where you have not opted out.
Personalising content and offers based on your preferences, play history, and behavior, where allowed by applicable laws and your consent settings.
Measuring the effectiveness of marketing campaigns and affiliate performance.

Customer support and communication

Responding to your questions, complaints, and feedback submitted through support channels.
Informing you about changes to our services, Terms & Conditions, or this Privacy Policy.

Disclosure & Sharing

Group companies and internal sharing

Your personal data may be shared within the Dama N.V. group of companies, including Strukin Ltd (payment agent), for administrative, payment processing, and support purposes.

Payment providers and financial institutions

We share necessary payment and verification data with banks, card schemes, e-wallet providers, and payment processors to complete deposits, withdrawals, and chargeback handling.
These entities act as independent controllers or processors under their own legal obligations, including financial regulations and AML requirements.

Service providers (processors)

We engage carefully selected third-party providers to support:
- IT hosting and infrastructure;
- customer support platforms and communication tools;
- identity verification and AML screening;
- fraud detection and risk scoring;
- analytics and performance monitoring;
- email/SMS delivery and, where applicable, marketing automation.
These providers are contractually obliged to process personal data only on our instructions, implement adequate security, and maintain confidentiality.

Regulators, authorities, and dispute bodies

We may disclose data to:
- regulatory and licensing authorities in Curaçao and other relevant jurisdictions;
- law enforcement agencies, courts, and other public authorities when required by law or to protect our legal rights or the safety of others;
- alternative dispute resolution bodies or mediators in case of disputes.

Affiliates and advertising partners

With your consent or where otherwise allowed by applicable law, we may share limited data with marketing partners and affiliate networks to:
- attribute visits and registrations to the correct affiliate or campaign;
- measure and optimise advertising performance.
We do not sell your personal data in exchange for money. Any sharing with advertising networks is conducted under contractual restrictions and, where required, based on your consent or opt-in preferences.

Business transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your data may be transferred as part of the business transaction. In such cases, we will ensure that the new entity continues to respect this Privacy Policy or provides equivalent protections.

International Transfers

Due to the global nature of online gaming and our use of international service providers, your personal data may be transferred to and processed in countries other than the one in which you reside. These include, in particular:

Curaçao: where Dama N.V. is incorporated and operates its licensed gaming services;
Cyprus: where Strukin Ltd, our payment agent, is established;
Canada: where many players reside and where certain service providers may process data;
Countries within the European Economic Area (EEA): where some technical and payment providers are located;
Other countries, including potentially the United States and other jurisdictions: where providers of hosting, analytics, or communications services may be based.

Where data is transferred outside your country or outside regions with comparable protection (such as the EEA), we aim to ensure an adequate level of protection through one or more of the following safeguards, where applicable:

data processing agreements with appropriate security obligations;
standard contractual clauses (SCCs) or equivalent data transfer agreements approved by relevant regulators, where required for transfers from the EEA or similar jurisdictions;
technical and organisational measures, including encryption and access controls, to reduce the risks of cross-border transfers;
careful due diligence and ongoing monitoring of our service providers' privacy and security practices.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, to comply with our legal and regulatory obligations, to resolve disputes, and to enforce agreements. Retention periods may vary depending on the type of data and applicable laws.

Category of data	Typical retention period
Account and identification data	During the lifetime of your account and generally up to 5 years after account closure, subject to longer periods where required by AML or other laws.
KYC / AML documentation	Typically at least 5 years after the end of the business relationship or last transaction, or longer if required by applicable regulations.
Transaction and payment records	At least 5 years from the relevant transaction date, or longer as required for tax and accounting obligations.
Gameplay and betting history	For the duration of the account and usually up to 5 years after closure, for dispute resolution, responsible gambling, and regulatory purposes.
Technical logs (e.g., IP logs)	Typically 12 - 24 months, unless needed longer for security, fraud investigations, or legal proceedings.
Marketing preferences and consents	Until you withdraw consent or object, plus a short period to record your opt-out and demonstrate compliance.
Cookies and similar identifiers	From the duration of a browsing session up to approximately 13 months, depending on the cookie type and purpose.

When data is no longer needed, we will either securely delete it or irreversibly anonymise it so that it can no longer be linked to you. If you request deletion, we may still retain certain information where we have a legal obligation or overriding legitimate interest (for example, AML and regulatory record-keeping), in which case access to that data is strictly limited.

Your Rights

Overview of your rights

We aim to respect the privacy rights available to you under applicable Canadian law (including the Personal Information Protection and Electronic Documents Act - PIPEDA - and comparable provincial laws) and to align, where feasible, with international standards such as the GDPR and relevant Mexican privacy principles (e.g., ARCO rights: Access, Rectification, Cancellation, and Opposition).

Subject to applicable law and certain limitations, you may have the following rights:

Right of access: to obtain confirmation whether we process your personal data and to receive a copy of such data, together with information about how it is used.
Right to rectification (correction): to have inaccurate or incomplete personal data corrected or updated.
Right to deletion / cancellation: to request deletion of your personal data when it is no longer necessary, when you withdraw consent (where consent was the legal basis), or when processing is unlawful. Legal retention obligations (e.g., AML) may limit this right.
Right to restriction of processing: to request that we limit the processing of your data (for example, while we verify its accuracy or assess an objection).
Right to object: to object to certain processing activities, particularly those based on our legitimate interests or for direct marketing purposes.
Right to data portability: where supported by law (for example, under GDPR), to receive your data in a structured, commonly used, and machine-readable format and, where technically feasible, to have it transmitted to another controller.
Right to withdraw consent: where processing is based on your consent (e.g., marketing communications or non-essential cookies), you may withdraw that consent at any time.
Rights relating to automated decision-making: where automated decisions producing legal or similarly significant effects are made (for example, certain risk assessments), to request human review and to express your point of view.

How to exercise your rights

Submit a request: Contact us through the support or contact channels available on https://rocketplay-win.ca, clearly indicating that your message relates to a "Privacy Request" and specifying which right(s) you wish to exercise.
Identity verification: To protect your data, we may ask you for information necessary to verify your identity (for example, login credentials, security questions, or copies of identification documents).
Processing of your request: We will review your request in light of applicable law and our legal obligations (including AML and gaming regulations).
Response time: We aim to respond within 30 days of receiving a complete request. If your request is complex or we receive a high volume of requests, we may extend this period in accordance with applicable law, informing you of the extension and reasons.
Cost: Requests are typically handled free of charge. We may charge a reasonable fee or refuse to act on manifestly unfounded or excessive requests, where permitted by law.

If you are located in a jurisdiction that provides additional or different rights (for example, within the European Union under the GDPR or in Mexico under applicable data protection regulations), we will seek to respect those rights where we are subject to those laws or where we have voluntarily committed to follow similar principles, to the extent consistent with our legal obligations as a Curaçao-licensed operator.

Cookies & Tracking Technologies

Types of cookies

Session cookies: temporary cookies that exist only while your browser is open and are deleted automatically when you close it. They are used to maintain your session (e.g., keeping you logged in).
Persistent cookies: remain on your device for a predefined period or until you delete them. They help us remember your preferences and recognise you when you return.
First-party cookies: set by the Website (rocketplay-win.ca) to support core functionality and preferences.
Third-party cookies: set by external providers (e.g., analytics services, advertising partners, affiliate tracking systems), subject to their own privacy policies.

Purposes of cookies

Strictly necessary / functional: required for the Website to function properly, to provide secure login, maintain sessions, and enable core game functionality. These cannot normally be disabled without affecting service quality.
Preference cookies: store choices such as language, display settings, and user interface preferences.
Analytics cookies: help us understand how visitors use the Website (e.g., which pages are visited most often, how long sessions last) so that we can improve performance and user experience.
Advertising and affiliate cookies: used to track the effectiveness of ads, measure affiliate campaign performance, and, where permitted by law and your consent, personalise marketing content.

Managing cookies

You can manage or delete cookies through your browser settings. Instructions are usually available in the "Help" or "Settings" section of your browser.
Many browsers allow you to:
- block all cookies;
- block cookies from specific sites;
- delete existing cookies;
- receive notifications before cookies are stored.
Where provided on rocketplay-win.ca, you may also use internal cookie or privacy settings to manage non-essential cookies and consent preferences.
Please note that disabling certain cookies may impact your ability to log in, play games, or use all features of the Website.

Data Security

We implement technical and organisational measures designed to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. While no system can be guaranteed 100% secure, we strive to maintain a security level consistent with industry good practices and relevant regulatory expectations.

Technical measures

Encryption in transit: data transmitted between your browser and our servers is protected using TLS (Transport Layer Security) 1.2 or higher.
Encryption at rest: sensitive information is stored using encryption or other safeguards to reduce the risk of unauthorised access.
Access controls: access to personal data is restricted to authorised personnel and service providers who need it for legitimate business purposes, using role-based access controls and authentication mechanisms.
Multi-factor authentication (MFA): MFA or equivalent mechanisms are implemented for critical internal systems and administrative access where appropriate.
Network and system security: firewalls, intrusion detection/prevention systems, and regular patching and hardening of servers are used to mitigate security threats.

Organisational measures

Policies and training: staff with access to personal data receive training on data protection, confidentiality, and security practices, and are bound by contractual confidentiality obligations.
Vendor management: service providers with access to personal data are vetted and bound by data protection and security obligations in their contracts.
Monitoring and audits: we conduct periodic internal checks and, where applicable, use external assessments to evaluate the effectiveness of our security measures, aiming to align with recognised standards such as ISO 27001 or SOC 2 where feasible, without implying formal certification unless explicitly stated.

Incident response

We maintain procedures for detecting, responding to, and mitigating data security incidents.
In the event of a data breach involving your personal data, we will assess the risk and, where required by law, notify relevant authorities and affected individuals without undue delay, providing information on mitigation steps and recommended precautions.

Complaints & Contacts

Contacting us

If you have questions, concerns, or complaints about this Privacy Policy or our handling of your personal data, please contact us first so we can attempt to resolve the issue:

Online: via the customer support or contact options available on https://rocketplay-win.ca (Rocket Play). Please specify that your message concerns "Privacy" or "Data Protection".
Postal address:
Dama N.V. - Data Protection Department
Scharlooweg 39
Willemstad, Curaçao

Complaint handling procedure

Submission: You submit your complaint using one of the contact methods above, providing sufficient details for us to understand your concern.
Acknowledgement: We will acknowledge receipt of your complaint within a reasonable time, usually within 10 business days.
Investigation: We will investigate the matter, which may include reviewing logs, consulting internal departments, and requesting additional information from you.
Response: We aim to provide a substantive response within 30 days of receiving a complete complaint. If more time is needed due to complexity, we will inform you of the delay and expected timeframe.
Further steps: If you are not satisfied with our response, you may have the right to escalate the matter to a competent data protection authority, as described below.

Escalation to supervisory authorities

Depending on your place of residence and the applicable laws, you may have the right to lodge a complaint with a data protection or privacy authority. Examples include:

Canada

Office of the Privacy Commissioner of Canada (OPC)
30 Victoria Street
Gatineau, Quebec K1A 1H3, Canada
Website: https://www.priv.gc.ca
You may also have rights to complain to a provincial privacy commissioner in provinces with private-sector privacy laws, such as Quebec, British Columbia, or Alberta. Details are available from the OPC and relevant provincial websites.

Mexico (where relevant)

Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI)
Website: https://home.inai.org.mx
If you are in Mexico and applicable Mexican data protection regulations apply to our processing of your data, you may exercise ARCO rights and lodge complaints with INAI in accordance with local law.

European Union / EEA (where relevant)

If you are located in the EU/EEA and EU data protection law applies, you may lodge a complaint with the data protection authority of your habitual residence, place of work, or the place of an alleged infringement. Contact details of EU/EEA supervisory authorities are available via the European Data Protection Board (EDPB): https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We encourage you to contact us first so we can try to resolve your concerns directly, but you are not obliged to do so before approaching a supervisory authority where applicable law grants you a direct right to complain.

Updates

We may update this Privacy Policy from time to time, for example to reflect changes in our services, legal requirements, or technical and organisational measures.

How we will notify you

Minor changes: For non-material updates (e.g., clarifications, stylistic changes), we will post the updated version on https://rocketplay-win.ca with an updated "Last updated" date.
Material changes: For significant changes that affect your rights or how we process your personal data, we will provide additional notice by one or more of the following methods:
- email notification to the address registered in your account;
- prominent banner or pop-up notice on the Website;
- notification within your account dashboard where applicable.
Advance notice: Where reasonably practicable and required by law, we will provide at least 30 days' advance notice before material changes take effect, so that you have time to review them.

Your options

If you continue to use the Website after the effective date of an updated Privacy Policy, your continued use will constitute acceptance of the changes.
If you do not agree with the changes, you may choose to stop using the Website and, where applicable, request account closure. We will continue to process and retain your data only as necessary to comply with legal obligations and legitimate interests as described above.

Version control

Last updated: January 2026

v1.0 - January 2026: Initial comprehensive Privacy Policy for Canadian users of rocketplay-win.ca (Rocket Play), reflecting Curaçao licensing context, Canadian privacy alignment, and reference to GDPR and Mexican privacy principles.

Previous versions of this Privacy Policy may be made available upon request where required by applicable law.