Privacy Policy

This Privacy Policy explains how Bigboost, operating via the website bigboost-ca.com, collects, uses, discloses, and protects personal information of players and website visitors in connection with our online casino services. It is intended for visitors, registered account holders, and any other individuals whose data we process in relation to our services. By using bigboost-ca.com, you acknowledge that you have read and understood this Policy. This Privacy Policy is effective as of January 1, 2026 and supersedes any previous versions applicable to our Canadian (excluding Ontario) operations.

Who We Are

OBSERVE: Bigboost is operated under an offshore online gaming structure with Curaçao licensing and related payment processing support.

EXPAND: To ensure legal clarity, we identify the controller, its registration details, and contact points for privacy matters, including a dedicated data protection contact channel.

REFLECT: This section provides the necessary transparency about the entity responsible for processing your personal data and how you can reach us for privacy-related queries.

Data Controller / Operator

Legal entity: White Star B.V.
Trading name for Canadian market: Bigboost (operating the website bigboost-ca.com)
Registered address (head office and legal address): Fransche Bloemweg 4, Willemstad, Curaçao
Company registration number: 153150 (Curaçao commercial register)
Gaming licence: OGL/2023/159/0076, issued by the Curaçao Gaming Control Board (GCB), status: active

Payment Processing Support

Certain payment and processing functions for Canadian players (including Interac and card transactions) may be handled by White Star B.V. (Cyprus branch), acting as a payment processor on our behalf.

Contact for General and Support Inquiries

Email (support): [email protected]
Email (general information): [email protected]
Website: https://bigboost-ca.com

Data Protection Contact / DPO Function

For all privacy-related requests, including the exercise of your rights, please contact our data protection contact point:
Email: [email protected] (designated data protection contact)
Postal contact for privacy matters: "Data Protection - Bigboost, White Star B.V., Fransche Bloemweg 4, Willemstad, Curaçao"

What Personal Data We Collect

OBSERVE: In delivering online casino services to Canadian players (excluding Ontario), Bigboost must process several categories of personal and technical data.

EXPAND: These include identity and contact data, transactional/payment data, technical identifiers, behavioural data related to gambling activity, and cookie-based information. Some data is mandatory to meet legal obligations (e.g., KYC/AML) and to provide the services (account creation, deposits, withdrawals).

REFLECT: The following list details what types of data we collect, for transparency and to support informed consent and contractual engagement.

Identity and Contact Data

Full name, date of birth, and gender (where provided)
Residential address, country of residence, and postcode (where applicable)
Email address and phone number(s)
Government-issued identification details (e.g., ID card, passport, driver's licence) and copies or scans thereof for verification
Proof-of-address documents (e.g., utility bill, bank statement) used in verification processes

Account and Interaction Data

Username, encrypted password, and security credentials
Account settings, language preferences, communication preferences, and responsible gambling settings (e.g., limits, self-exclusion)
Customer support communications (emails, chat logs, support tickets)
Records of consents and preferences related to marketing and cookies

Technical and Device Data

IP address and approximate geolocation derived from IP
Device information (device type, operating system, browser type and version, screen resolution, unique device identifiers where applicable)
Log data (access dates and times, pages viewed, clickstream data, game loading times, errors and crash logs)
Session identifiers and security tokens used for authentication and fraud detection

Payment and Financial Data

Payment method details (e.g., masked card numbers, card type, expiry date, Interac-related identifiers, e-wallet details as applicable)
Deposit and withdrawal records, including amount, currency (CAD), timestamps, and payment service provider used
Banking identifiers to the extent necessary for processing withdrawals (e.g., IBAN or equivalent, bank name where relevant)
Transaction reference numbers and confirmations from our payment providers

Gaming and Behavioural Data

Betting and gaming history (games played, stakes, wins/losses, bonus usage, session duration, frequency of play)
Bonus and promotion participation (opt-ins, wagering progress, completion status)
In-game events, clicks, navigation patterns, and interaction with site features
Responsible gambling behaviour markers (e.g., time-outs, self-exclusions, reality checks) and related system flags

Cookies and Similar Technologies

Cookies, web beacons, tracking pixels, and similar identifiers to recognize your browser/device, maintain sessions, remember preferences, and perform analytics and marketing (as detailed in the Cookies & Tracking Technologies section)

Special Categories and Sensitive Data

We generally do not seek to collect sensitive categories of data (e.g., health, religion). However, we may record information related to problem gambling or self-exclusion that you actively provide or that is inferred from your behaviour, where necessary to protect you and comply with responsible gambling obligations.

Legal Basis for Processing

OBSERVE: Bigboost processes personal data of Canadian players under a combination of contractual, consent-based, legal, and legitimate interest grounds.

EXPAND: Although White Star B.V. is established in Curaçao, we align our practices with widely recognized standards (including concepts derived from GDPR-style frameworks) and Canadian privacy principles to ensure fairness, transparency, and security.

REFLECT: The table below explains the key legal bases we rely upon for different processing activities.

Contractual Necessity

Purpose: To create and manage your player account, verify your eligibility, provide access to games, process deposits and withdrawals, and deliver customer support.
Legal basis: Processing is necessary for the performance of a contract to which you are party (your use of bigboost-ca.com) or to take steps at your request prior to entering into such a contract.
Examples: Account registration, logging you in securely, processing your bets, crediting winnings, handling your withdrawal requests, and responding to support tickets about your account.

Compliance with Legal and Regulatory Obligations

Purpose: To meet obligations imposed by applicable laws, regulatory frameworks, and license conditions (including KYC/AML, fraud and money-laundering prevention, record-keeping, tax or regulatory reporting, and responsible gambling requirements).
Legal basis: Processing is necessary for compliance with legal obligations to which White Star B.V. is subject under Curaçao law and any other applicable legal frameworks relevant to our operations, including those pertaining to anti-money laundering and combating the financing of terrorism.
Examples: Identity verification, transaction monitoring, screening against sanction or exclusion lists where applicable, retaining transaction records for legally prescribed periods, and implementing responsible gambling controls.

Legitimate Interests

Purpose: To secure our systems and services, prevent and investigate fraud and abuse, protect the integrity of our games, ensure network and information security, improve and optimize our services, and conduct non-intrusive analytics.
Legal basis: Processing is necessary for the purposes of our legitimate interests (or those of a third party), provided such interests are not overridden by your fundamental rights and freedoms.
Examples: Analysing gameplay patterns to detect collusion or bonus abuse, enforcing our Terms and Conditions, improving site performance, performing limited profiling for security risk assessment, and maintaining logs and backups.

Consent

Purpose: To send you marketing communications (e.g., bonuses, promotions, newsletters), to use non-essential cookies/trackers for analytics and advertising, and, where required, to process certain categories of information that are not strictly necessary for the contract or law.
Legal basis: Your explicit or implied consent, given through our interfaces (e.g., checkbox during registration or in your account settings, cookie banner choices).
Examples: Email or SMS marketing about new games or promotions, participation in surveys, personalized promotional offers based on your gaming preferences, and advertising cookies used for retargeting.

Protection of Vital Interests and Public Interest

Purpose: In rare situations, to protect you or others from serious harm (for example, where we reasonably believe there is a risk of significant financial or psychological harm due to gambling behaviour).
Legal basis: Processing may be necessary to protect vital interests or to support public interest in preventing crime and serious harm, in line with applicable legal frameworks.

Purpose of Processing

OBSERVE: We use personal data for clearly defined and legitimate purposes related to the operation of an online casino service for Canadian players (excluding Ontario).

EXPAND: These purposes cover service provision, security, compliance, analytics, and marketing activities.

REFLECT: Below we describe how your information is used and why this is necessary.

Providing and Managing Casino Services

Registering and maintaining your player account on bigboost-ca.com.
Allowing you to log in, access games, place bets, and participate in promotions.
Processing deposits, withdrawals, and other financial transactions securely in CAD via our payment providers, including those supported by our Cyprus branch.
Providing customer support, troubleshooting issues, and handling your requests or complaints.

Compliance, Security, and Fraud Prevention

Verifying your identity and age for KYC and regulatory compliance.
Monitoring gameplay and transactions to detect and prevent fraud, money laundering, bonus abuse, and other prohibited behaviour.
Enforcing our Terms and Conditions and bonus terms.
Maintaining system logs and backups to ensure integrity and security of our systems.

Responsible Gambling and Player Protection

Implementing responsible gambling tools (deposit limits, loss limits, self-exclusion, reality checks).
Monitoring behavioural indicators of potential problem gambling and intervening where appropriate (e.g., sending warnings, offering support resources, restricting access in severe cases).

Service Improvement and Analytics

Analysing aggregated and pseudonymised data to understand how players interact with bigboost-ca.com.
Improving game offerings, payment flows, website performance, and user experience.
Testing new features, conducting A/B tests, and assessing the effectiveness of responsible gambling tools.

Marketing and Personalisation (Where Permitted)

Sending you promotional emails or messages about our products, bonuses, and campaigns if you have given consent or if otherwise permitted by applicable law.
Personalising offers and recommendations based on your preferences, playing patterns, and previous interactions, within the limits of your marketing preferences.
Conducting surveys and player satisfaction research to improve our services.

Disclosure & Sharing

OBSERVE: Bigboost uses external service providers and may need to share certain personal data with third parties under controlled conditions.

EXPAND: This includes payment partners, IT providers, regulators, affiliates, and, where applicable, advertising networks, always subject to legal safeguards and contractual protections.

REFLECT: We disclose data only when necessary and proportionate, and we require recipients to protect your data according to applicable standards.

Service Providers and Processors

Payment processors and banking partners: To process deposits, withdrawals, chargebacks, and payment verifications, including entities cooperating with White Star B.V. (Cyprus branch) and other licensed payment service providers.
IT and infrastructure providers: Cloud hosting, content delivery networks, security services, and technical support providers that host or process data on our behalf.
Game providers: Licensed game studios and platforms that provide casino games, where some technical or pseudonymised identifiers may be required for game access and fairness checks.
Analytics and anti-fraud providers: Tools and systems used to detect fraudulent patterns, verify device integrity, and ensure system security.

Regulatory Authorities and Legal Recipients

Gaming regulators: Curaçao Gaming Control Board and any other competent regulatory authorities, where required by our licence or applicable law.
Law enforcement and government bodies: Where we have a legal obligation or a good-faith belief that disclosure is necessary to comply with a legal process, court order, or to protect our rights, your safety, or the safety of others.
Financial and AML regulators: Where necessary to comply with anti-money laundering and counter-terrorist financing obligations.

Affiliates and Business Partners

Affiliates and marketing partners: We may share limited pseudonymised or aggregated data with affiliates that refer players to bigboost-ca.com, for attribution and commission calculation.
Group and structural changes: In the event of a merger, acquisition, internal reorganization, or sale of assets involving White Star B.V., player data may be transferred to the new entity, subject to continued protection under this or an equivalent privacy policy.

Advertising Networks and Third-Party Marketing

We may use third-party advertising networks to display tailored ads for our services on third-party websites or apps.
Where this involves the use of non-essential cookies or similar technologies, we will do so only with your consent as required by applicable laws.
We do not sell your personal information to third parties for their independent marketing purposes.

Other Disclosures

We may share anonymised or aggregated data that does not identify you personally, for statistical, research, or reporting purposes.

International Transfers

OBSERVE: Bigboost is operated by White Star B.V., established in Curaçao, and supported by service providers in multiple jurisdictions.

EXPAND: As a result, your personal data may be transferred to and processed in countries outside your home jurisdiction (including outside Canada and outside the European Economic Area) that may have different data protection standards.

REFLECT: We implement safeguards to ensure an adequate level of protection in line with recognized international principles and contractual measures.

Locations of Processing

Curaçao (CW): Primary location of the data controller and gaming operations, including core account, transactional, and regulatory data processing.
Cyprus (CY): Location of White Star B.V. (Cyprus branch) and certain payment and technical service providers; used for payment processing and related technical support.
Other regions: Third-party service providers (e.g., hosting, analytics, fraud prevention) may process data in additional countries, including within the EU/EEA or other jurisdictions with established data processing infrastructure.

Safeguards for International Transfers

We take reasonable steps to ensure that any international transfer is subject to appropriate safeguards designed to protect your personal information.
Where applicable and feasible, we use contractual protections inspired by standard contractual clauses or equivalent data transfer agreements that require recipients to protect personal data to standards comparable to those in well-recognised privacy frameworks.
We only engage service providers that commit to robust security practices, confidentiality obligations, and limited use of personal data in line with our instructions.

Regional Compliance Note: While our principal legal obligations arise under Curaçao law and other applicable non-Canadian frameworks, we endeavour to align with Canadian privacy expectations regarding cross-border transfers, including transparency, security safeguards, and purpose limitation.

Data Retention

OBSERVE: We must retain certain data for a minimum period to comply with gaming, anti-money laundering, tax, and regulatory obligations.

EXPAND: At the same time, we aim not to keep personal data for longer than necessary for the purposes for which it was collected, applying clear retention periods and deletion criteria.

REFLECT: The retention rules below are indicative; specific periods may vary based on legal requirements in force.

General Retention Principles

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Policy and to comply with applicable laws, including Curaçao gaming regulations and AML requirements.
Once data is no longer required, we will securely delete, anonymise, or aggregate it so that it can no longer be associated with an identifiable individual.

Indicative Retention Periods

Account and identification data: Typically retained for the duration of your account plus up to 5 years after account closure, to comply with AML and gaming record-keeping obligations and to handle any disputes.
Transaction and financial records: Retained for at least 5 - 7 years from the date of the relevant transaction, subject to applicable financial and regulatory rules.
Gaming and betting history: Retained for the life of the account and up to 5 years after closure, for regulatory audits, responsible gambling review, and dispute resolution.
Customer support communications: Retained for up to 3 - 5 years after the interaction, depending on the nature of the inquiry and legal/regulatory requirements.
Marketing data: Retained for as long as you remain subscribed to marketing communications and for a reasonable period (typically up to 2 years) after you withdraw consent or unsubscribe, in order to document your preference and comply with do-not-contact obligations.
Technical logs and security records: Retained for periods ranging from a few months up to 2 years, depending on the type of log and the need for security and fraud analysis.

Deletion and Anonymisation Criteria

Data is deleted or anonymised when:
- The legal retention period expires;
- The data is no longer necessary for any of the purposes for which it was collected;
- You successfully exercise a right to erasure, provided that we are not legally required to retain the data.
Backups may retain data for additional limited periods until they are overwritten, but such backups are protected and not used for active processing except in disaster recovery situations.

Your Rights

OBSERVE: While operated under Curaçao law, Bigboost strives to respect key data subject rights commonly recognized in modern privacy frameworks, including GDPR-style and comparable international principles.

EXPAND: For Canadian players, we emphasize transparency, access, correction, and control over marketing choices. References in this section to GDPR-like rights are for alignment and clarity; EU GDPR or Mexican laws do not directly apply by default, but we adopt similar standards as a matter of policy where feasible.

REFLECT: The rights set out below are subject to legal limitations and our regulatory obligations (especially AML and gaming rules). We will always balance your request with these obligations.

Right of Access

You may request confirmation whether we process your personal data and obtain a copy of such data, together with information about how we use it.

Right to Rectification

You may request correction of inaccurate or incomplete personal information (e.g., address or contact details), provided that any changes comply with our KYC and AML obligations.

Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data where:
- The data is no longer necessary for the purposes for which it was collected;
- You withdraw consent where consent was the sole legal basis;
- You object to processing and there are no overriding legitimate grounds; or
- The data has been unlawfully processed.
We may be unable to delete certain data where retention is required by law (for example, AML or gaming record-keeping rules).

Right to Restriction of Processing

You may request that we temporarily restrict processing of your data if:
- You contest its accuracy (for the period we need to verify accuracy);
- Processing is unlawful and you prefer restriction over erasure;
- We no longer need the data but you require it for legal claims; or
- You have objected to processing and we are considering whether our legitimate grounds override your interests.

Right to Object

You may object at any time to:
- Processing of your data for direct marketing (including profiling related to direct marketing). In such cases we will cease marketing immediately.
- Processing based on our legitimate interests, where your specific situation justifies an objection and we do not have compelling legitimate grounds to continue processing.

Right to Data Portability

Where technically feasible and where processing is based on consent or a contract and carried out by automated means, you may request that we provide certain data in a structured, commonly used, machine-readable format, or that we transmit it to another controller where this is technically feasible and legally permissible.

Right to Withdraw Consent

Where we rely on your consent (for example, for marketing communications or non-essential cookies), you may withdraw that consent at any time via your account settings, unsubscribe links in emails, or by contacting us using the details below.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Procedures, Timeframes, and Cost

How to exercise your rights:
- Contact our data protection contact at [email protected], or via support at [email protected].
- Include your full name, registered email address, and a clear description of your request.
- We may ask you to verify your identity before acting on your request.
Response time: We aim to respond to all valid requests within 30 days of receipt. If your request is complex or we receive multiple requests, we may extend this period by up to a further 30 days, informing you of the extension and reasons.
Fees: We will not charge a fee for dealing with your requests, unless they are manifestly unfounded or excessive. In such cases, we may either charge a reasonable fee or refuse to act on the request.

Cookies & Tracking Technologies

OBSERVE: Bigboost uses cookies and similar technologies to operate bigboost-ca.com, enhance your experience, and support analytics and marketing.

EXPAND: Cookies differ in duration (session vs. persistent) and in purpose (strictly necessary, functional, analytics, advertising). Some are set by us, others by carefully selected third parties.

REFLECT: You can manage or disable many cookies through your browser or device settings and, where implemented, through our cookie management tools.

Types of Cookies We Use

Session cookies: Temporary cookies that are deleted when you close your browser. They are used to maintain your session, keep you logged in, and remember short-lived preferences.
Persistent cookies: Cookies that remain on your device for a set period or until you delete them. They are used, for example, to remember your login preferences, language settings, or to recognize you when you return.
First-party cookies: Cookies placed by Bigboost directly on bigboost-ca.com.
Third-party cookies: Cookies placed by external providers (e.g., analytics tools or advertising networks) integrated into our website.

Purposes of Cookies

Strictly necessary / functional cookies: Required for the basic operation of the site and the provision of the service you request (e.g., navigation, access to secure areas, transaction processing, fraud prevention).
Preference cookies: Used to remember your language, region, and user preferences to provide a more personalized experience.
Analytics cookies: Help us understand how visitors use our site, which pages are most popular, and how users move around the site, so that we can improve performance and usability.
Advertising and marketing cookies: Used to deliver relevant ads for our services on other websites and to measure the effectiveness of our campaigns. These may be set by us or by trusted ad networks.

Managing and Disabling Cookies

You can manage your cookie preferences in several ways:
- Browser settings: Most browsers allow you to block or delete cookies. Please refer to your browser's help section for specific instructions.
- Device-level settings: Some devices (particularly mobile) provide options to limit tracking or reset advertising identifiers.
- On-site tools: Where available, we may offer an internal cookie preference panel enabling you to accept or reject non-essential cookies.
Disabling certain cookies may affect the functionality and performance of bigboost-ca.com, and some services may not be available.

Data Security

OBSERVE: Bigboost handles sensitive financial and gaming information and must implement strong security controls.

EXPAND: Security measures span technical, organizational, and procedural levels, aiming to protect data against unauthorized access, loss, misuse, alteration, or disclosure.

REFLECT: While no system can be guaranteed 100% secure, we continuously improve our defences and follow recognized best-practice standards.

Technical Security Measures

Encryption in transit: Data transmitted between your device and bigboost-ca.com is protected using industry-standard TLS (Transport Layer Security) protocols (TLS 1.2 or higher).
Encryption at rest: Sensitive data, including financial and authentication information, is stored using encryption or other appropriate pseudonymisation techniques where feasible.
Access controls: Access to personal data is restricted to authorised personnel who require it to perform their duties and is managed through role-based access controls and authentication systems.
Multi-factor authentication (MFA): MFA is implemented for administrative and critical system access and may be available for player accounts where supported.
Firewalls and intrusion detection: Network and application firewalls, intrusion detection, and anti-malware systems are used to protect against unauthorized access and malicious activity.

Organizational and Procedural Measures

Policies and training: Staff are subject to confidentiality obligations and receive data protection and security awareness training, especially those with access to personal data.
Vendor due diligence: Third-party service providers are vetted for security and data protection practices and are bound by contractual obligations to protect personal data.
Incident response: Formal incident response procedures exist to detect, assess, and respond to security incidents. Where required by applicable law, we will notify relevant authorities and affected individuals of data breaches.
Security audits: Regular internal reviews and, where appropriate, external audits or assessments are carried out to evaluate security controls. While we may not be formally certified to standards such as ISO 27001 or SOC 2, we endeavour to align with comparable industry best practices.

Complaints & Contacts

OBSERVE: Players may have questions or concerns about how their data is handled, and they require clear channels to raise issues and seek redress.

EXPAND: We provide multiple contact points, internal escalation procedures, and reference to external supervisory authorities where applicable, even though our principal regulatory oversight is by Curaçao authorities.

REFLECT: Our objective is to address your concerns promptly and transparently.

Internal Complaint and Inquiry Channels

Data protection contact (preferred for privacy issues):
- Email: [email protected]
- Postal: "Data Protection - Bigboost, White Star B.V., Fransche Bloemweg 4, Willemstad, Curaçao"
Customer support (for general or account-related issues):
- Email: [email protected]
- General info: [email protected]

Complaint Procedure

Submission: Send your complaint or inquiry via email or postal mail, clearly indicating that it is a privacy or data protection issue where relevant.
Acknowledgement: We will acknowledge receipt of your complaint within 5 business days where feasible.
Assessment: We will investigate your complaint, consulting relevant internal departments (e.g., security, compliance, customer support) as needed.
Response: We aim to provide a substantive response within 30 days of receipt. If additional time is required due to complexity, we will inform you of the extension and reasons.
Escalation: If you are not satisfied with our response, you may request further internal review or pursue external remedies as available under your local laws.

External Authorities and Regulatory Contacts

Gaming regulator: Curaçao Gaming Control Board (GCB)
- Website: https://gamingcontrolcuracao.org
- Players may consult the GCB website for available communication channels regarding licensed operators such as White Star B.V.
Local privacy regulators: Depending on your place of residence (e.g., within Canada), you may have the right to raise concerns with your local privacy or data protection authority (for example, a provincial or federal privacy commissioner). For information on Canadian privacy regulators, please refer to official government resources in your jurisdiction.

Note: References to supervisory authorities from other regions (such as EU or Mexico) are not directly applicable unless those laws expressly extend to our relationship; however, we aim to model our practices on broadly recognized privacy standards.

Updates

OBSERVE: Legal requirements, regulatory expectations, and our internal practices may evolve over time.

EXPAND: We must therefore update this Privacy Policy periodically and inform you of significant changes that could affect how your data is processed.

REFLECT: This section explains how we manage updates, notify users, and record changes.

Notification of Changes

We may update this Privacy Policy from time to time to reflect changes in:
- Applicable laws or regulatory guidance;
- Our services, technologies, or business structure;
- Our data processing practices or security measures.
When we make material changes (for example, new processing purposes, new categories of recipients, or significant changes to your rights or our legal bases), we will:
- Post an updated version on bigboost-ca.com and update the "Last updated" date;
- Provide additional prominent notice, such as a banner on the website or alerts in your account dashboard;
- Where appropriate, send an email notification to the address associated with your account.

Advance Notice and User Choices

For material changes that significantly affect your rights or the way we use your data, we will, where practicable, provide at least 30 days' advance notice before the new version takes effect.
If you do not agree with the updated Policy, you may:
- Adjust your privacy or marketing preferences in your account settings; and/or
- Request account closure and, where applicable, exercise your data protection rights (subject to legal and regulatory retention requirements).

Version Control

Last updated: January 1, 2026
Material changes summary (recent versions):
- January 1, 2026: Consolidated policy for Bigboost, clarifying Curaçao licensing details, international transfers, and enhanced explanation of user rights and security measures for Canadian players.