Privacy Policy
This Privacy Policy explains how personal information is collected, used, disclosed, and protected when you visit and use luckynugget-win.com, including the Lucky Nugget Casino page, and when you interact with any related online casino services offered under the Lucky Nugget Casino brand. It applies to visitors to our Website and to registered players who use our gambling services, from Canada and other locations where our Services are lawfully accessible. By using the Website or Services, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is effective as of 1 January 2026.
Who We Are
For the purposes of this Privacy Policy, references to "Lucky Nugget Casino", "we", "us" or "our" relate to the entities that operate the Lucky Nugget Casino brand and the Website at luckynugget-win.com, including the Lucky Nugget Casino page, for players located in Canada.
Operational Structure
- Players located in Ontario, Canada: Services are provided by Cadillac Jack Inc, operating under an agreement with iGaming Ontario (iGO) and regulated by the Alcohol and Gaming Commission of Ontario (AGCO). Cadillac Jack Inc holds an iGaming Ontario operating agreement (agreement number not specified here) for regulated online casino gaming in Ontario.
- Players located in the rest of Canada (e.g., BC, AB, QC and other provinces/territories): Services are provided by Bayton Ltd, a company licensed and regulated by the Malta Gaming Authority (MGA) under remote gaming licence number MGA/B2C/145/2007. Bayton Ltd provides online casino services to Canadian players outside Ontario.
Corporate and Regulatory Details
- Bayton Ltd: A private company incorporated under the laws of Malta and licensed by the MGA. Its registered office and full corporate details are available in the Malta Business Registry and in the MGA licence MGA/B2C/145/2007. Bayton Ltd is the controller of personal information for players located outside Ontario, to the extent described in this Policy.
- Cadillac Jack Inc: A private company authorised by iGaming Ontario and regulated by AGCO to provide online casino services in Ontario. Its registered office and full corporate details are available in the relevant Ontario corporate and gaming regulatory registers. Cadillac Jack Inc is the controller of personal information for players located in Ontario, to the extent described in this Policy.
- CityViews Group: A related private entity referenced in connection with Bayton Ltd in certain materials. The exact corporate relationship (for example, group holding structure) is not specified in the data relied on for this Policy and may be clarified on the Website or in future updates.
Data Protection Contact
- Data Protection Officer / Privacy Contact: We have appointed a dedicated privacy contact (the "DPO") responsible for overseeing questions related to this Policy and our data handling practices.
- How to reach us: You may contact us and our DPO using:
- the online contact or support forms made available in the "Contact Us" or equivalent section of luckynugget-win.com, clearly marking your message "Privacy" or "For the attention of the Data Protection Officer"; and/or
- postal mail addressed to Bayton Ltd or Cadillac Jack Inc at their respective registered office addresses as published in the Malta Business Registry, the MGA licence register (for Bayton Ltd), or the relevant Ontario business and gaming regulatory registers (for Cadillac Jack Inc).
- Where the Website lists a specific email address or telephone number for privacy queries, you may also use those contact details. If any such details change, the latest contact information published on the Website will prevail from time to time.
What Personal Data We Collect
We collect different categories of personal information depending on how you interact with luckynugget-win.com, the Lucky Nugget Casino page, and any associated casino Services (such as account registration, deposits, gameplay, and withdrawals).
Identification and Contact Data
- Basic identifiers: Full name, username, title, date of birth, and government-issued identification details where required for age verification and KYC (Know Your Customer) obligations.
- Contact details: Email address, telephone number, postal address, province/territory and country of residence, preferred language, and contact preferences.
- Verification documentation: Copies or details of ID documents, proof of address, payment account ownership documentation, and any additional information required to comply with KYC/AML (anti-money laundering) and responsible gambling obligations.
Account, Gameplay and Behavioural Data
- Account information: Account credentials (in hashed or otherwise protected form), account status, registration date, security settings, and communication preferences.
- Gameplay and betting data: Game selections, betting history, session times, wins and losses, bonuses claimed, tournament participation, and other in-game activities.
- Behavioural and interaction data: Clickstream data, navigation paths, pages viewed (including visits to Lucky Nugget Casino), time spent on pages, interaction with offers, and responses to surveys or promotions.
Technical and Device Data
- Technical identifiers: IP address, device identifiers, browser type and version, operating system, time zone, language settings, and referring URLs.
- Log information: Login attempts, access timestamps, session tokens, error logs, diagnostics and performance logs, and security-related logs (e.g., unusual login patterns or suspected fraud indicators).
- Location-related information: Where permitted by law and necessary for regulatory or security reasons, we may process approximate location derived from IP address or similar technologies to confirm the jurisdiction (e.g., Ontario vs. the rest of Canada).
Payment and Financial Data
- Transaction data: Deposit and withdrawal records, payment methods used, transaction identifiers, amounts, currencies, and timestamps.
- Payment instrument details: Limited card or account details (such as masked card numbers), digital wallet information, and related verification data, as processed via our payment service providers.
- Financial due diligence data: Information necessary for fraud prevention, AML checks, source-of-funds/source-of-wealth inquiries, and regulatory reporting.
Marketing and Communications Data
- Marketing preferences: Opt-in/opt-out status for email, SMS, push notifications, telephone calls, and other communications.
- Engagement data: Records of marketing messages sent, open and click rates, responses to campaigns, participation in loyalty programs and contests.
Cookies and Similar Technologies
- Cookies: Small text files stored on your device, including session cookies, persistent cookies, first-party cookies set by us, and third-party cookies set by our partners.
- Tracking technologies: Web beacons, pixels, tags, SDKs, device fingerprinting and similar tools used for security, analytics, performance monitoring, and advertising purposes, as further described under "Cookies & Tracking Technologies" below.
Legal Basis for Processing
Because Lucky Nugget Casino operates in and targets users in multiple jurisdictions (including Canada and, where applicable, the EU/EEA and Mexico), our legal bases for processing personal information may vary depending on where you are located. In all cases, we seek to ensure that processing is lawful, fair, and transparent.
Consent
- We rely on your consent where required by law, particularly for:
- non-essential cookies and advertising technologies;
- direct marketing communications by email, SMS, push notifications, or telephone where opt-in consent is required;
- processing of certain sensitive or high-risk categories of data, where applicable local law requires explicit consent.
- You can withdraw your consent at any time, as described in the "Your Rights" and "Cookies & Tracking Technologies" sections. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Contractual Necessity
- We process personal information as necessary to enter into and perform a contract with you, including:
- creating and managing your player account;
- providing access to casino games, tournaments, and related Services;
- processing deposits, bets, wins, withdrawals, bonuses, and loyalty rewards;
- providing customer support, including account-related communications.
- If you do not provide information that is necessary for us to perform the contract, we may be unable to provide some or all of the Services.
Legitimate Interests
- We process personal information where necessary for our legitimate interests, taking into account your rights and interests, for example:
- ensuring the security and integrity of our systems, games, and accounts (including fraud prevention and detection);
- maintaining and improving the Website, including Lucky Nugget Casino, and our Services;
- performing analytics and statistical reporting (e.g., understanding how Canadian players use our games and promotions);
- personalising content and offers within the limits of applicable marketing laws;
- defending our legal rights, responding to complaints, and managing business risks.
- Where local law (for example, under EU/EEA GDPR or Mexican LFPDPPP) requires a balancing test, we carry out such an assessment to ensure that your fundamental rights and freedoms are not overridden by our interests.
Compliance with Legal and Regulatory Obligations
- We process personal information as necessary to comply with legal obligations, which may include:
- Canadian federal and provincial laws, including PIPEDA and applicable provincial privacy, consumer protection, and gaming laws;
- Malta Gaming Authority regulations and other EU/EEA requirements applicable to Bayton Ltd;
- Ontario iGaming regulations, rules and standards applicable to Cadillac Jack Inc under iGO and AGCO;
- anti-money laundering, terrorist financing, sanctions, and fraud-prevention obligations in all relevant jurisdictions;
- record-keeping, tax, accounting, audit, and reporting obligations;
- compliance with lawful requests and orders from courts, regulators, and law enforcement authorities.
Purpose of Processing
We use the personal information described above for the following purposes, to the extent permitted by applicable law:
Provision and Operation of Casino Services
- Creating, verifying, and managing your player account and profile.
- Providing access to games, including recording stakes, outcomes, jackpots, and bonuses.
- Processing deposits, withdrawals, and other financial transactions through our payment partners.
- Providing customer support and responding to your questions, feedback, or complaints.
Service Improvement and Personalisation
- Monitoring and analysing usage of the Website and Services (including Lucky Nugget Casino) to improve functionality, performance, and user experience.
- Developing new features, promotions, and game offerings that may be of interest to Canadian players and other users.
- Customising content, game recommendations, and offers based on your preferences and behaviour, within legal limits.
Marketing and Promotions
- Sending you marketing communications (where permitted) about Lucky Nugget Casino, including special offers, bonuses, loyalty programmes, and news.
- Carrying out targeted advertising and remarketing campaigns, including through third-party advertising networks, social media platforms, and affiliates, subject to your consent where required.
- Measuring the effectiveness of our advertising and promotional campaigns.
Analytics, Research and Reporting
- Performing analytics and statistical reporting to understand trends (for example, iGaming Ontario market performance, MGA reporting, or internal financial and responsible-gambling reporting).
- Conducting surveys, research and testing to improve the safety, fairness, and quality of our Services.
Fraud Prevention, Security and Legal Compliance
- Preventing, detecting, and investigating fraud, abuse, cheating, collusion, money laundering, and other illicit activities.
- Protecting the integrity of our games, systems, and accounts, including enforcing our terms and conditions.
- Complying with legal, regulatory, and licensing requirements and cooperating with competent authorities.
Disclosure & Sharing
We do not sell your personal information in the sense prohibited by applicable privacy laws. However, we may share personal information with selected third parties for the purposes described in this Policy and in accordance with appropriate safeguards.
Group Companies and Operators
- Bayton Ltd and Cadillac Jack Inc: Personal information may be shared between these entities as necessary to operate the Lucky Nugget Casino brand, allocate responsibilities between Ontario and non-Ontario operations, and comply with respective regulatory obligations.
- Related entities such as CityViews Group: Where relevant, personal information may be shared with related entities that provide support or strategic services, subject to appropriate contractual safeguards.
Service Providers and Business Partners
- Payment processors and financial institutions: To process deposits, withdrawals, chargebacks, and financial settlements.
- Technology and hosting providers: For website hosting, data storage, content delivery, analytics, security, and technical support.
- Customer support and communication tools: For live chat, helpdesk services, email and SMS distribution, and customer relationship management.
- Marketing, analytics, and advertising partners: To manage campaigns, provide analytics, personalise content, and deliver targeted advertising, where permitted by law and, where required, with your consent.
Regulators, Authorities and Compliance Recipients
- Gaming regulators and governmental bodies: Including the MGA, iGaming Ontario, AGCO, and other Canadian federal or provincial authorities, where required by gaming or other applicable laws.
- Law enforcement and public authorities: Where disclosure is required or authorised by law, court order, or administrative request, or necessary to protect our rights or those of others.
- Auditors, legal advisors and consultants: For auditing, legal advice, dispute resolution, and regulatory compliance purposes.
Business Transfers
- In the event of a merger, acquisition, restructuring, joint venture, assignment, transfer, or other disposition of all or any part of our business, assets, or shares, personal information may be transferred to one or more third parties as part of the transaction, subject to appropriate protections and, where required, notice to you or your consent.
Disclosure with Your Consent
- We may share your information with third parties when you have given your explicit consent to do so, or where you actively request or authorise us to disclose information (for example, to participate in joint promotions with our affiliates or partners).
International Transfers
Because Lucky Nugget Casino serves players in Canada and other jurisdictions and uses global service providers, personal information may be transferred to, stored in, or accessed from countries other than the one in which it was originally collected. These countries may have different data-protection laws from those in your home jurisdiction.
Key Transfer Scenarios
- Transfers between Canada and Malta/EU: Personal information of Canadian players (particularly those outside Ontario) may be processed by Bayton Ltd in Malta and within the European Union/European Economic Area (EU/EEA), where many of our systems or service providers may be located.
- Transfers involving Ontario: Personal information of Ontario players may be processed by Cadillac Jack Inc and by service providers located in Canada, the EU/EEA, the United States, or other jurisdictions, in accordance with applicable laws and iGO/AGCO requirements.
- Global service providers: Some of our technology, security, analytics, marketing, or payment partners may operate from, or store data in, countries outside Canada and outside your place of residence (which may include the EU/EEA, the United States, or other jurisdictions).
Safeguards for International Transfers
- Where we transfer personal information internationally, we implement appropriate safeguards, which may include:
- contractual protections such as standard contractual clauses or equivalent instruments approved under applicable data-protection laws;
- technical and organisational measures such as encryption, access controls, and data-minimisation principles;
- ensuring that service providers are subject to robust confidentiality and security obligations.
- We do not rely exclusively on the former EU-U.S. Privacy Shield framework, which has been invalidated; where transfers involve the United States or other non-adequate jurisdictions, we use alternative safeguards allowed by law (such as standard contractual clauses and supplementary measures), or other mechanisms recognised under applicable law as of 2026 (for example, the EU-U.S. Data Privacy Framework, where applicable).
Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, to resolve disputes, and to enforce our agreements, in accordance with applicable law as in force up to and including 2026.
General Retention Principles
- Account and identification data: Typically retained for the duration of your active account and, after account closure, for a period generally not longer than 5 - 7 years, to comply with gaming, AML, tax, and record-keeping obligations and to handle potential disputes.
- Transactional and financial data: Retained for periods typically between 5 - 7 years from the date of the relevant transaction, in line with applicable legal and accounting requirements.
- Gameplay and behavioural data: Retained while your account is active and for a limited period thereafter (usually up to 5 years post-closure), subject to legal obligations and our need to maintain security and integrity of our games and systems.
- Marketing and communications data: Retained while you remain opted in to marketing and for a further period (for example, up to 3 years) from your last interaction or until you opt out, whichever occurs first, unless a longer period is required by law.
- Logs and technical data: Retained for shorter periods where feasible (for example, 12 - 24 months) to support security, fraud detection, and system integrity, unless longer retention is required for investigations or legal proceedings.
- Cookies: Retained in accordance with their specific lifetimes, which vary by cookie type and purpose, as described in our cookie notices and in your browser settings.
Deletion and Anonymisation
- When personal information is no longer required for the purposes described in this Policy, we will either:
- securely delete or destroy it; or
- irreversibly anonymise it so that it can no longer be associated with you (for example, for aggregate analytics and reporting).
- We may also retain limited information where necessary to respect your choices (for example, maintaining a record that you have opted out of marketing) or where retention is necessary to establish, exercise, or defend legal claims.
Your Rights
Your rights over your personal information depend on the laws that apply in your jurisdiction (for example, Canadian privacy laws such as PIPEDA, EU/EEA GDPR-style frameworks, and the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations). We aim to provide a rights framework that is consistent and respectful across jurisdictions.
Core Rights (Access, Rectification, Erasure)
- Right of access: You can request confirmation of whether we process your personal information and obtain a copy of that information, together with an explanation of how we use it.
- Right to rectification/correction: You can request that we correct or update inaccurate, incomplete, or outdated personal information.
- Right to deletion/erasure: You may request that we delete your personal information in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected, you withdraw consent (where consent was the sole basis), or you successfully object to processing. We may be required to retain some data despite such a request where law obliges us to do so (e.g., for AML or gaming law compliance).
Restriction, Objection and Portability
- Right to restrict processing: In certain cases (for example, while we verify the accuracy of data or assess an objection), you may request that we limit the processing of your information to storage only.
- Right to object: Where we process personal information based on legitimate interests, you may object on grounds relating to your particular situation. We will respect your objection unless we have compelling legitimate grounds or we need to continue processing for legal reasons.
- Right to object to marketing: You have an absolute right to object at any time to the use of your personal information for direct marketing, including profiling related to such marketing. We will then stop processing your data for that purpose.
- Right to data portability: Where applicable (for example, under GDPR-like frameworks or Mexican LFPDPPP where analogous rights exist), you may request that we provide certain personal information to you or to another controller in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
Consent and Automated Decision-Making
- Right to withdraw consent: Where processing is based on your consent, you can withdraw that consent at any time by adjusting your settings, using unsubscribe links in our communications, or contacting us as described in this Policy.
- Automated decision-making and profiling: If we carry out automated decisions that produce legal or similarly significant effects (for example, certain risk assessments or responsible-gambling interventions), you may, where recognised by applicable law, request human review, express your point of view, and contest the decision.
Mexican ARCO Rights and References
- If Mexican privacy law (LFPDPPP and its Regulations) applies to you, you may have specific ARCO rights: Acceso (access), Rectificación (rectification), Cancelación (cancellation), and Oposición (opposition). These rights largely correspond to the access, correction, deletion, and objection rights described above.
- We will also consider applicable guidelines issued by the Mexican data-protection authority (INAI - Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales) when handling such requests.
How to Exercise Your Rights
- Submission of requests: You can exercise your rights by:
- using the contact or support forms on luckynugget-win.com and clearly indicating that your request concerns privacy or personal data; or
- writing to the postal address of Bayton Ltd or Cadillac Jack Inc (as relevant for your location) with sufficient details to identify you and your request.
- Verification: We may ask you to provide information necessary to verify your identity and to confirm that you are entitled to make the request (or to act on behalf of another individual, where permitted).
- Response timeframe: We aim to respond to your request within 30 days of receipt. In complex cases or where permitted by law, this period may be extended (for example, by an additional 30 days), in which case we will notify you of the extension and reasons.
- Fees: We will handle your request free of charge, unless it is manifestly unfounded or excessive (for example, repetitive requests). In such cases, we may charge a reasonable fee or refuse to act on the request, as permitted by law and with appropriate justification.
Cookies & Tracking Technologies
We use cookies and similar technologies on luckynugget-win.com, including the Lucky Nugget Casino page, to ensure the proper functioning of the Website, enhance your experience, perform analytics, and provide targeted advertising, where permitted by law.
Types of Cookies and Technologies
- Strictly necessary cookies: Session and other cookies that are essential for the operation of the Website and Services (e.g., to enable login, maintain sessions, and process transactions). These cookies cannot generally be disabled without affecting core functionality.
- Functional cookies: Cookies that remember your preferences (such as language, region, and display settings) and help personalise your experience.
- Analytics and performance cookies: Cookies and similar technologies used to collect information about how visitors use the Website (for example, pages visited, time spent on Lucky Nugget Casino, and errors encountered), so that we can improve performance and usability.
- Advertising and targeting cookies: First-party and third-party cookies used to deliver relevant advertisements, track the effectiveness of marketing campaigns, and build audience segments, where permitted and subject to your consent where required.
- Other tracking technologies: Web beacons, pixels, tags, and device identifiers used for similar purposes as cookies, especially in emails and on third-party platforms.
Managing Cookies
- Browser settings: Most browsers allow you to view, delete, or block cookies and to set preferences for certain sites. Instructions are typically available in your browser's "Help" menu.
- On-site tools: Where provided, you may use our cookie banner or preference centre on the Website to manage your cookie choices, including withdrawing consent for non-essential cookies.
- Impact of disabling cookies: If you block or delete cookies, some features of the Website or Services may not function properly, and your user experience may be affected (for example, you may need to log in more frequently or you may not see content tailored to your preferences).
Data Security
We take the security of your personal information seriously and implement technical and organisational measures designed to protect it against unauthorised access, loss, misuse, alteration, or disclosure.
Technical Safeguards
- Encryption in transit and at rest: We use up-to-date encryption technologies, including TLS 1.2+ for data in transit and industry-standard encryption for data at rest, where feasible and appropriate.
- Access controls: Access to personal information is restricted to authorised personnel and service providers who need it for legitimate business purposes, using role-based access controls, strong authentication mechanisms, and logging of access events.
- Network and application security: We implement firewalls, intrusion-detection and prevention systems, vulnerability-management processes, and secure-development practices to reduce security risks.
Organisational and Procedural Measures
- Policies and training: We maintain internal privacy and security policies and provide regular training to staff, including those involved in handling player data, to promote a culture of data protection and compliance.
- Vendor due diligence: We perform due diligence on service providers who handle personal information on our behalf and require them to implement appropriate security measures and contractual safeguards.
- Incident response: We maintain incident-response procedures for detecting, assessing, and managing suspected data-security incidents. Where required by law, we will notify you and/or relevant authorities of certain breaches without undue delay.
Security Standards
- We strive to align our security practices with recognised industry standards (such as principles derived from ISO/IEC 27001 and SOC 2 frameworks), to the extent appropriate for our operations. This does not constitute a representation that we hold formal certifications unless expressly stated on the Website or in official documentation.
- Despite our efforts, no system can be completely secure. You also play an important role by keeping your account credentials confidential, using strong passwords, and notifying us promptly of any suspected unauthorised access to your account.
Complaints & Contacts
If you have questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, you have several options for contacting us and, if necessary, escalating your complaint.
Contacting Us
- Online contact forms: You can contact us via the customer support or contact forms provided on luckynugget-win.com, marking your message "Privacy" or "For the attention of the Data Protection Officer".
- Postal mail: You may write to:
- Bayton Ltd (for players outside Ontario) at its registered office address as listed in the Malta Business Registry and MGA licence register; and/or
- Cadillac Jack Inc (for players in Ontario) at its registered office address as recorded with the relevant Ontario corporate and gaming regulatory authorities.
- Where the Website lists specific contact details (email or telephone) for privacy matters, you may also use those channels.
Our Complaint Handling Process
- Initial review: Once we receive your complaint or query, we will acknowledge receipt (where feasible) and conduct an initial review, typically within 10 business days.
- Investigation: We will investigate the issue, which may include liaising with relevant internal teams and, where necessary, requesting additional information from you.
- Response: We aim to provide a substantive response within 30 days of receiving your complaint. Where the matter is complex or where permitted by law, this period may be extended, in which case we will inform you of the extension and reasons.
- Further steps: If you are not satisfied with our response, you may request further review or clarification and/or escalate the matter to the relevant data-protection authority, as described below.
Escalation to Supervisory Authorities
- Canada: If you are located in Canada and remain dissatisfied, you may contact:
- Office of the Privacy Commissioner of Canada (OPC)
Website: https://www.priv.gc.ca - Where applicable, you may also contact your provincial or territorial privacy commissioner (for example, in Quebec, Alberta, or British Columbia) for matters within their jurisdiction.
- Office of the Privacy Commissioner of Canada (OPC)
- Mexico: Where Mexican privacy law applies, you may lodge a complaint with:
- INAI - Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales
Website: https://www.inai.org.mx
- INAI - Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales
- European Union / EEA: If you are in the EU/EEA and subject to GDPR-style protections, you may file a complaint with your local data-protection authority. A list of supervisory authorities is available at: https://edpb.europa.eu.
Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, regulatory guidance, or technological developments affecting Lucky Nugget Casino, including operations on luckynugget-win.com and the Lucky Nugget Casino page.
How We Notify You of Changes
- Website updates: We will publish the updated Privacy Policy on luckynugget-win.com, indicating the date of the latest revision at the top or bottom of the document.
- Email or in-account notifications: For significant changes, we will seek to notify registered players by email and/or via account dashboard notifications, where feasible.
- Banners and notices: We may display banners, pop-ups, or other notices on the Website to draw attention to important changes.
Effective Date and Advance Notice
- Unless otherwise specified, changes become effective when the updated Privacy Policy is posted on the Website.
- Where required by law or where we make material changes that significantly affect your rights or how we process your personal information, we will endeavour to provide at least 30 days' advance notice before the changes take effect, giving you an opportunity to review the updated terms.
- If you do not agree to the updated Policy, you may choose to stop using the Website and Services and, where applicable, request account closure. Continued use of the Website or Services after the effective date of the updated Policy will constitute your acceptance of the changes.
Version Control and Changelog
- Last updated: February 2026.
- Key recent changes include (summary):
- clarification of the split regulatory framework for Ontario and rest-of-Canada players (Cadillac Jack Inc under iGO/AGCO and Bayton Ltd under MGA licence MGA/B2C/145/2007);
- expanded explanation of international transfers and safeguards, including references to up-to-date transfer mechanisms available as of 2026;
- enhanced description of user rights to align with Canadian privacy laws, GDPR-style frameworks, and Mexican LFPDPPP (ARCO rights), as well as clearer guidance on exercising these rights and our response timeframes.