Opening a gambling account means verifying age, identity and place of residence. This policy explains what that involves in practice: what is collected, why, and what you can ask for.
1. Data controller
Société des loteries du Québec (Loto-Québec)
500 Rue Sherbrooke Ouest, Montréal, QC H3A 3G6
NEQ 1144330454
A person responsible for the protection of personal information is designated within the organisation, under the Act respecting access to documents held by public bodies and the protection of personal information (CQLR, c. A-2.1). They answer for decisions on collecting, using, keeping, disclosing and destroying information, and they handle requests for access, correction and withdrawal of consent.
How to reach them:
- by email — info@espacejeux.co, with “protection of personal information” in the subject line;
- by post — Responsable de la protection des renseignements personnels, 500 Rue Sherbrooke Ouest, Montréal, QC H3A 3G6;
- by phone — 1-866-611-5686, seven days a week.
A written request receives a written answer within 30 days of being received. If more time is needed, you are told before the deadline, with the reason. Before an access or correction request can be handled, your identity has to be confirmed — that check is required, not an extra hurdle.
2. Information collected
- Identity — surname, first name, date of birth, occupation.
- Contact details — Québec mailing address, email address, phone number.
- Account — username, hashed password, preferences, gambling limits, request history.
- Verification — supporting documents provided during identity validation.
- Gambling activity — bets, deposits, withdrawals, prizes, dates and times of transactions.
- Technical data — IP address, device and browser type, pages viewed, location signals confirming presence in Québec.
The information requested in public forms is limited to what is needed to handle the request concerned. No optional field is required to get an answer.
3. Purposes
- Verifying eligibility: age, residence in Québec, presence in the province, absence of self-exclusion.
- Opening and administering the account, handling deposits, bets, withdrawals and prizes.
- Applying gambling limits, breaks and self-exclusions.
- Preventing fraud, duplicate accounts and money laundering.
- Answering requests sent to customer service.
- Meeting legal, regulatory and tax obligations.
- Measuring site use in aggregate, where you consent to it.
4. Basis for collection
Most of this information is necessary to perform the account contract or to meet a legal obligation: without it, the account cannot be opened or maintained. Optional processing — audience measurement, information messages — rests on your consent and can be declined without affecting access to the service.
5. Disclosure to third parties
Information is neither sold nor rented. It may be disclosed:
- to providers who process payments, host systems or verify identities, only as far as their mandate requires;
- to gambling oversight authorities, within their supervisory powers;
- to tax or judicial authorities, where the law requires it;
- to the corporation’s gaming establishments, so that a self-exclusion is applied consistently.
Providers are bound by contractual confidentiality and security commitments.
6. Disclosure outside Québec
Where information has to be processed outside Québec, a privacy impact assessment is carried out before disclosure, and appropriate contractual measures are put in place.
7. Retention periods
Information is kept as long as the purposes above require, then for the period imposed by law — in particular accounting, tax and anti-money-laundering obligations.
Information tied to a self-exclusion is kept for the whole length of the measure, since deleting it would make the exclusion inoperative. An account inactive for 36 months may be closed, with prior notice.
8. Security
Exchanges with the site are encrypted. Passwords are stored as hashes, access to data is restricted by role, and sensitive operations are logged.
In the event of a confidentiality incident presenting a risk of serious injury, the people concerned and the competent authority are notified as the law requires.
9. Your rights
- Access — obtain a copy of the information about you.
- Correction — have inaccurate or incomplete information corrected.
- Withdrawal of consent — for optional processing.
- Portability — receive your information in a structured technological format.
- De-indexing — in the cases provided by law.
A request is handled within 30 days. Proof of identity may be required, so that your information is not disclosed to somebody else. Some rights have limits: gambling and exclusion records must be kept even after an account is closed.
10. Cookies
The site uses cookies necessary to run it and, with your agreement, audience measurement and preference cookies. The details and how to change your choices are in the Cookie Policy.
11. Minors
The service is not intended for people under 18 and no information about them is knowingly collected. If an account has been opened by a minor, it is closed and the information deleted, subject to legal retention obligations.
12. Complaints
To exercise a right or file a complaint, write to the person responsible for the protection of personal information — contact details in section 1 — or use the Contact us page.
A request moves faster when it says what you are after: access to the information held, correction of something inaccurate, withdrawal of a consent, deletion of an account. You do not have to give a reason for asking.
If the answer does not satisfy you, or if no answer arrives within the deadline, you may refer the matter to the Commission d’accès à l’information du Québec (opens in a new window). The Commission reviews complaints about the protection of personal information and can order corrective measures. Filing with it is free and does not require a lawyer.
A question about this page? Write to customer service or call 1-866-611-5686. Contact us.