Privacy Policy

1. Introduction

OneEasySpin Inc. ("OneEasySpin," "we," "us," or "our") is a Canadian corporation incorporated under the laws of British Columbia, with its registered office at Vancouver, BC V6E 3P3, Canada. We develop and operate free-to-play social gaming applications, platforms, and related digital services (collectively, the "Services").

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our website at oneeasyspin.com, create an account, play our games, or otherwise interact with our Services. It also describes your rights under applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and the British Columbia Personal Information Protection Act (BC PIPA).

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of the Services and contact us to request deletion of any personal information we may hold about you.

2. Information We Collect

We collect personal information that you voluntarily provide to us and information collected automatically when you use our Services. The categories below describe what we collect and why.

2.1 Account and Registration Data

When you create an account, we collect your display name or username, email address, date of birth (to verify age eligibility), province of residence, and the password you choose (stored in hashed form). If you register via a third-party social login (e.g., Google, Apple, Facebook), we receive basic profile information from that provider in accordance with your permissions.

2.2 Gameplay and Activity Data

We collect data about how you interact with our games, including game sessions, scores, achievements, virtual currency balances, in-game purchases of virtual items, chat messages within our platform, friend connections and social interactions, and your preferences and settings.

2.3 Device and Technical Data

We automatically collect technical information when you access our Services, including your IP address, browser type and version, operating system, device identifiers, screen resolution, time zone, referring URLs, pages visited, session duration, crash reports, and performance logs. This information helps us operate, maintain, and improve the Services.

2.4 Payment Data for Virtual Currency

If you purchase virtual coins or other virtual items, your payment is processed by our third-party payment processor. We do not store full credit card numbers or bank account details on our servers. We do retain a transaction record including the amount, date, a masked card identifier (last four digits), and the virtual items received, for accounting and customer support purposes.

2.5 Communications Data

We collect the content and metadata of any communications you send to us, including support tickets, live chat transcripts, emails, survey responses, and feedback forms. If you participate in our community forums or chat features, we collect the content of those posts.

2.6 Promotions and Marketing Data

If you opt in to marketing communications, we collect your email address and communication preferences. We may also collect information you provide when entering contests, sweepstakes, or promotional events, including your name, mailing address, and phone number where required for prize delivery.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

1. To provide and operate the Services: creating and managing your account, processing virtual currency transactions, enabling gameplay features, and delivering customer support.
2. To verify age and eligibility: confirming that you meet our minimum age requirement (19 years of age or older in most provinces; 18 years of age or older in Alberta and Manitoba) and that you are located in an eligible jurisdiction.
3. To personalise your experience: tailoring game recommendations, adjusting difficulty settings, and presenting offers relevant to your activity and preferences.
4. To communicate with you: sending transactional emails (account confirmations, password resets, transaction receipts), service announcements, and, where you have consented, promotional messages about new games, features, or offers.
5. To analyse and improve our Services: using aggregated and anonymised data to understand how players interact with our games, identify bugs, measure feature performance, and inform product development decisions.
6. To ensure platform security and integrity: detecting and preventing fraud, cheating, bot activity, money laundering, account takeovers, and other prohibited conduct; enforcing our Terms of Service.
7. To comply with legal obligations: retaining records required by Canadian tax law, responding to lawful government or law enforcement requests, and fulfilling obligations under PIPEDA and BC PIPA.
8. To conduct research and analytics: performing internal research on player behaviour (on an anonymised basis where possible) to develop new game concepts and improve responsible gaming features.

4. Legal Basis for Processing

Under PIPEDA and BC PIPA, we rely on the following legal bases to collect, use, and disclose your personal information:

4.1 Consent

We obtain your express consent at account creation for core data processing activities, and your opt-in consent for marketing communications. Where consent is the basis for processing, you have the right to withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

4.2 Contractual Necessity

Certain processing is necessary to perform our contract with you — namely, our Terms of Service. This includes processing your account data to provide access to our games, processing virtual currency transactions, and delivering customer support.

4.3 Legitimate Interests

We may process personal information where it is in our legitimate business interests and not overridden by your privacy rights. This includes fraud detection and prevention, network and information security, improving our Services through analytics, and direct marketing to existing users (subject to your right to opt out).

4.4 Legal Obligation

We process and retain certain personal information as required by applicable Canadian laws, including the Income Tax Act (Canada), the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and applicable provincial consumer protection legislation.

5. Sharing Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

5.1 Service Providers

We engage trusted third-party companies to assist in operating our Services, including cloud hosting providers, payment processors, customer support platforms, email delivery services, push notification services, and identity verification providers. These service providers are contractually bound to use your information only for the purposes of providing services to us and are required to implement appropriate security measures.

5.2 Analytics and Advertising Partners

We use analytics tools (such as Google Analytics) to help us understand usage patterns. We may also share aggregated, de-identified data with advertising technology partners to measure campaign effectiveness. We require such partners to process data in accordance with applicable privacy law and our data processing agreements.

5.3 Legal Requirements and Safety

We may disclose your personal information if required to do so by law or in good-faith belief that such action is necessary to: (a) comply with a legal obligation or court order; (b) protect and defend the rights or property of OneEasySpin; (c) prevent or investigate possible wrongdoing in connection with the Services; or (d) protect the personal safety of users of the Services or the public.

5.4 Business Transfers

In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred to the successor entity. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

5.5 With Your Consent

We may share your information with third parties for purposes not described in this Policy when we have obtained your explicit consent to do so.

6. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, plus any additional period required by law. Our standard retention schedules are as follows:

• Account and registration data: retained for the duration of your account plus 3 years following account closure, to allow for reactivation and to comply with legal obligations.
• Gameplay and activity data: retained for 2 years from the date of last activity.
• Payment and transaction records: retained for 7 years following the transaction date, as required by the Income Tax Act (Canada).
• Customer support communications: retained for 3 years from resolution of the support request.
• Marketing preferences and consent records: retained for the duration of your account plus 5 years to demonstrate compliance with anti-spam legislation.
• Device and technical logs: retained for 12 months, after which logs are aggregated and anonymised.
• Legal hold data: retained indefinitely while subject to a legal hold, pending resolution of any legal proceedings.

Upon expiry of the applicable retention period, we securely delete or anonymise personal information. Where anonymisation is not practicable, we apply appropriate physical and technical controls to render the data inaccessible.

7. Your Privacy Rights

Under PIPEDA and BC PIPA, individuals whose personal information is held by an organisation have the following rights. To exercise any of these rights, please contact our Privacy Officer at privacy@oneeasyspin.com.

7.1 Right of Access

You have the right to request access to the personal information we hold about you, including a description of the categories of information held, the purposes for which it is being used, and any third parties to whom it has been disclosed. We will respond to access requests within 30 days of receipt.

7.2 Right to Correction

If you believe that personal information we hold about you is inaccurate or incomplete, you have the right to request correction. We will make corrections to the information or, where we disagree, append your statement of disagreement to the record.

7.3 Right to Deletion

You may request deletion of your personal information where it is no longer required for the purposes for which it was collected, where you withdraw consent and no other legal basis for processing exists, or where processing is unlawful. Deletion requests are subject to our legal retention obligations.

7.4 Right to Data Portability

You may request a copy of your personal information in a structured, commonly used, and machine-readable format (such as JSON or CSV), to the extent technically feasible.

7.5 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent to receive marketing communications can be effected by clicking the "unsubscribe" link in any marketing email or by contacting us directly. Withdrawal of consent to core data processing will require closure of your account.

7.6 Right to Lodge a Complaint

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner of British Columbia (oipc.bc.ca).

8. Children's Privacy

Our Services are intended for adults. We do not knowingly collect personal information from children under 13 years of age. Our minimum age requirement is 18 years (19 years in most provinces). If you are a parent or guardian and believe your child under the age of 13 has provided us with personal information without your consent, please contact us immediately at privacy@oneeasyspin.com.

Upon receiving a verified parental request, we will promptly delete any personal information collected from a child under 13. Where we are uncertain of a user's age, we may suspend the account and request age verification documentation prior to restoring access.

9. Security Measures

We implement a comprehensive set of technical, administrative, and physical safeguards to protect your personal information against unauthorized access, use, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Sensitive personal information stored in our databases is encrypted using AES-256.
• Access controls: Access to personal information is restricted to employees and contractors who need it to perform their job functions. Access is governed by role-based permissions and is reviewed quarterly.
• Password security: User passwords are stored using bcrypt hashing with a salt and are never stored in plaintext.
• Penetration testing: We conduct annual third-party penetration testing of our systems and remediate identified vulnerabilities promptly.
• Incident response: We maintain a documented data breach response plan. In the event of a breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada within 72 hours of becoming aware of the breach, as required by PIPEDA's breach notification provisions.

Despite our efforts, no security system is impenetrable. We encourage you to use a strong, unique password for your OneEasySpin account and to keep your login credentials confidential.

10. International Data Transfers

Our primary servers and data infrastructure are located in Canada (Toronto, Ontario). We may also process certain data on servers located in the United States through our cloud service providers (including Amazon Web Services and Google Cloud Platform). When personal information is transferred outside Canada, we ensure appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses;
• Assessments confirming that the receiving jurisdiction provides an adequate level of protection;
• Where required, reliance on your express consent to the transfer.

You acknowledge that personal information transferred to the United States may be subject to access by US government authorities under applicable US laws, which may differ from Canadian privacy protections.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate our Services, remember your preferences, and analyse platform usage. For a detailed explanation of the types of cookies we use, their purposes, duration, and how to manage or opt out of them, please review our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where the changes are significant, provide you with prominent notice (such as a banner on our website or an email notification).

We encourage you to review this Policy periodically. Your continued use of our Services following the posting of an updated Policy constitutes your acceptance of the changes.

13. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or our handling of your personal information, please contact our Privacy Officer:

We will acknowledge receipt of your inquiry within 5 business days and will endeavour to provide a substantive response within 30 days. If additional time is required, we will notify you of the extension and the reason for it.