Privacy Policy

1. Who we are and what this policy covers

1.1 Who we are. The Services are provided by Eminence Gaming LLC, a Delaware limited liability company, doing business as TopDeck.gg ("TopDeck", "we", "us").

1.2 What this policy covers. This policy explains how we handle personal data when you use the Services (defined in the Terms of Service), including Hubs on other domains. It applies to everyone who uses the Services, and to people an Organizer enters into an Event without an Account. Capitalized terms not defined here have the meaning in the Terms of Service.

1.3 Who is responsible for your data.

• TopDeck is the controller for the personal data we hold to run the Services.
• Organizers and Publishers are independent controllers for the personal data they receive about Players for their Events and Organized Play Programs. Each is responsible for its own use of that data, under its own privacy notice and the Organizer Terms.
• Developers are responsible for the data they receive under the Developer Terms.
• Partner services, apps and other websites you use through or alongside the Services have their own privacy policies.

1.4 How to reach us. Send privacy questions and requests to [email protected]. Our privacy contact at that address acts as our privacy officer. Our other contact details are in §17.

---

2. Personal data we collect

To create an Account, you need to give us your name, email address and password. Without them we can't create one. Everything else on your profile is optional. An Organizer may require more for its Event, such as a linked Discord account or a game ID. If you don't provide it, you can't register for that Event.

2.1 Data you give us

2.2 Data created when you take part

• The Event Record: pairings, results, standings, ratings, check-in status, placements, league and circuit points, and deck archetypes (§6).
• Event administration records: penalties, judge-call records, private notes Staff add to Registrations, and records of actions Staff take.
• Account activity: Rewards balances and history, in-app notifications, referral attribution, how you found an Event (such as an Organizer's tracking link), and a summary of your activity, such as the games and formats you play and when you last played. We use that summary for recommendations and promotions (§8).

2.3 Data from Organizers, Publishers and other users

• Organizers and Staff can add you to an Event or waitlist by name and email, invite you, edit your decklist, record results and penalties, add private notes to your Registration, and ban you from their own Events. If you later create an Account with the email address they used, we link the Registration to it.
• Publishers and their partners can send us registration lists for their Events. A Publisher can also add you to its program's conduct list (§5.2).
• Other Players can report results, file judge calls and chat at your table.

This policy applies to data others give us about you, whether or not you have an Account. An Organizer who adds you to an Event is responsible for giving you its own privacy notice.

2.4 Data from services you connect

When you link or use a connected service, we receive the data that feature needs and the details needed to keep the connection working. For example:

• Discord: your Discord user ID and username, and requests you make through our Discord bot.
• Deck sites: the contents of decks you import and, if you link an account, your username and ID on that site.
• Partner sign-in on a Hub: your name, email address and account details from that partner. We may use them to create an Account for you.
• Wizards EventLink (for Organizers): your Wizards account email and the access EventLink grants, so we can send your rosters when you ask.
• Stripe and PayPal: payment confirmations, payment and order IDs, and billing records, such as your name, email, billing address and card brand and last digits. For Organizers, account IDs and onboarding status. Stripe and PayPal hold bank, tax and identity details; we don't.

2.5 Data collected automatically

• Location: an approximate location from your IP address, and your device's precise location only if you allow it (§7).
• Device and app information: device type and name, operating system and app version, and tokens for push notifications and Live Activities.
• Usage data: pages and screens viewed and features used, through Google Analytics on the website and Firebase Analytics in the apps (§9). Google processes your IP address. In the apps, usage data is linked to your account ID.
• Email engagement: whether our emails were delivered, bounced or marked as spam, and, for digests, promotional emails and Publisher broadcasts, whether you opened them and which links you clicked.
• Device permissions: the apps ask for camera, calendar and photo library access for specific features. Camera and calendar data stay on your device. A photo you choose is uploaded.
• Cookies and similar technologies (§9).

2.6 Sensitive information

We don't ask for government ID numbers. Please don't put sensitive information, such as health details, in your bio, chat messages or deck names. If you ask, Staff may note an accommodation need on your Registration. Pronouns are optional and, if you set them, public (§4).

---

3. How we use personal data, and our legal bases

The table lists our purposes and our legal bases under the EU and UK GDPR: contract (we need the data to provide the Services you asked for); legitimate interests (the interest is named in the table; we weigh it against your rights, and you can object, §11); consent, which you can withdraw at any time; and legal obligation. §10 explains how long we keep data.

---

4. What is public

Some information is public by design, because published results are part of competitive play. Anyone can see it without logging in. Search engines can index it, and other people can copy it.

• Event pages and the Event Record: your display name, username, profile image and pronouns; usernames you've added for other services, such as Discord or Magic Online; your account ID; your rating, check-in status, pairings, results and standings; and your decklist and archetype once the Organizer shows decklists or the Event ends. For leader-based games, your leader or champion is shown once the Event starts.
• Public profiles: your name, username, pronouns, bio, images, social links, Event history and ratings. You can hide your profile page in your Account settings. A hidden profile page isn't shown to others or listed or searchable on the Services, but you stay in the Event Record, leaderboards and results, which remain visible through Event pages and the API.
• Leaderboards, circuits and results pages: your name, record, rank and placements.
• Store pages and Event listings, including the business and contact details the Organizer puts on them.
• Article comments, under your name.
• The API: Developers with an API key can access public Event data, plus profile, Registration and result information, including Discord usernames and IDs where present (§5.6).

We don't publish your email address, payment details, registration location, shipping address, penalties or Staff notes. Your display name is public; some sanctioned Events require your real name.

---

5. Who else sees your personal data

5.1 Organizers and their Staff

When you register for an Event, its Organizer and the Staff it appoints can see your full Registration: your contact details, linked Discord account and required game IDs, payment status and references, decklist, approximate registration location (§7), how you found the Event, check-in status, penalties, judge calls and Staff notes. Depending on their role, Staff can also see order details and export Registrations. Organizers keep records of Players who drop or leave before an Event starts, and of Players they ban from their Events.

An Organizer's community. Each Organizer can see a list of everyone who has played in its Events, with name, email address, account ID, Events and games played, and approximate home area (§7). Some of its Staff can search the list to add Players. Organizers of circuits and conventions, and their Staff, can see Registrations across those Events.

5.2 Publishers and Hubs

If an Event's game has an Organized Play Program on the Services, the Publisher can see the full Registration data for every Event of that game, whoever organizes it, and can receive Event data by webhook (§5.6). Publishers also see:

• applications from stores to join their program;
• the player community of each store in their program: everyone who has played in that store's Events, with name, email address and Event history;
• their program's conduct list of Players excluded from their league standings, with the reason;
• orders for their kits and Rewards, including shipping addresses (the Publisher is the seller and ships the items);
• judge certifications for their game.

Publishers can message the stores in their program. Whoever operates a Hub has this Publisher access for that Hub's game, and may have its own privacy notice.

5.3 Other Players

Other Players see your public data (§4). Players in an Event can see its judge-call records and its chat. Event chat isn't private.

5.4 Promotions we send for Events ("Boost")

We may promote Events by email and push notification to people who haven't turned off promotions (§8), chosen by the games they play, their approximate location and recent activity. We send these promotions ourselves. The Organizer doesn't receive recipients' names or contact details.

5.5 Partners

When you, an Organizer or a Publisher uses an integration, we share the data it needs with the partner, which handles it under its own privacy policy. For example:

• Game publishers' organized play systems: Wizards of the Coast's EventLink, when the Organizer of a Magic Event sends its roster (names and email addresses); and Publishers' own systems for Events linked to their programs (rosters and results, including names, email addresses and Discord IDs).
• Discord: when an Organizer connects an Event to a Discord server, our bot posts Event updates there, which can include Player names and Discord usernames.
• Deck-building, sign-in and results sites you link, import from or export to, which receive the requests or data that feature needs.
• Affiliate links. Some card links go to retailers, such as TCGplayer, through an affiliate network. When you click one, the retailer and network receive the card, the page you came from and what your browser sends. TopDeck may earn a commission.

5.6 Apps and Developers

• "Log in with TopDeck" apps get what you approve on the app's consent screen, such as your profile, email address and your own Registrations, results and decklists, and may keep access while you're signed out. To disconnect an app, email [email protected].
• API keys. Developers with an API key can access public Event data, plus profile, Registration and result information, including Discord usernames and IDs where present.
• Webhooks. Organizers, Staff and Publishers can have Event data sent to their own systems: Event details, Player names and IDs, results, standings and deck archetypes or leaders (not full decklists), and Discord details for Events that show Discord names. Webhooks don't carry email addresses, payment details or location. Whoever sets up a webhook is responsible for where the data goes.

Developers must handle the data they receive as the Developer Terms require.

5.7 Service providers

Service providers process personal data for us, on our instructions. They provide:

• hosting, databases, sign-in, file storage and push notifications (for example, Google Cloud and Firebase, and Apple for iOS notifications);
• content delivery, security and bot protection, and image hosting (for example, Cloudflare);
• email delivery and our newsletter;
• search, IP geolocation and maps;
• analytics (Google Analytics and Firebase Analytics);
• automated image screening and AI-based deck classification (§6);
• app updates, hosting for our Discord bot, delivery of code libraries and fonts, and our support mailboxes.

5.8 Payment Processors

Stripe and PayPal process payments. Registrations and add-ons are paid through the Organizer's own Stripe or PayPal account, and kits and on-demand queue holds through the seller's Stripe account, so the seller also sees your name, email address and payment details. Subscriptions are paid through TopDeck's Stripe account. Stripe and PayPal also use payment data for their own purposes, such as fraud prevention and legal compliance, as independent controllers.

When you provide personal data in connection with TopDeck.gg, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy (https://stripe.com/privacy). This includes the data Organizers provide when they set up a Stripe account. PayPal processes data under its Privacy Statement (https://www.paypal.com/privacy).

5.9 Our team

Authorized TopDeck personnel can access personal data held in or available through the Services when needed for support, safety, security and legal reasons.

5.10 Legal requests, safety and business changes

We may disclose personal data if we believe in good faith that the law requires it, or that it's needed to respond to valid legal process, protect someone's safety, investigate fraud or abuse, or protect the rights of TopDeck or our users. If TopDeck is involved in a merger, acquisition, financing or sale of assets, personal data may transfer to the new owner, and this policy will continue to apply to it.

5.11 No sale of data; no third-party ads

We don't sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, including the data of users under 18. We don't show third-party ads. We may promote Events to people who haven't turned off promotions (§5.4), and some card links are affiliate links (§5.5).

---

6. Automated processing and AI

• Image screening. We automatically screen uploaded images for adult, violent or similar content, and may block an upload that fails. If you think an image was blocked by mistake, contact us.
• Deck archetypes. We use fixed rules and AI models from a third-party provider to suggest a deck's archetype from its card list and the archetype label you typed. We don't send your name, email address or account ID. The archetype follows your decklist's visibility, feeds metagame statistics, and can be corrected by you or Staff.
• Judge certification tests are scored automatically. A Publisher may set a test so that a passing score grants the certification.
• Abuse prevention. To detect ban evasion and abuse, we may compare account, device and contact information across accounts.

We don't make decisions with legal or similarly significant effects on you solely by automated means. Penalties and Organizer bans are decided by Organizers and their Staff.

---

7. Location

From your IP address. We derive an approximate location (city, region, country and approximate coordinates) from your IP address, for example when you sign in, open the app or register for an Event. We keep a limited history of these readings, estimate a home area from them, and record the city, region and country on your Registrations. We also use it to show nearby Events when you browse without choosing a location. Our hosting and network providers also process IP addresses.

How we use it. We use approximate location to:

• show Events near you;
• run regional features, such as regional leaderboards and filters;
• choose who receives promotions;
• show Organizers the home area of Players in their community (§5.1), and give Organizers and Publishers regional reports;
• prevent fraud and abuse.

The location on a Registration is visible to that Event's Staff and, for games with an Organized Play Program, the Publisher (§5). It's never public.

Objecting. You can object to our use of IP-based location by emailing [email protected] (§11).

Precise device location. If you allow location access in the app or your browser, we use your device's location to find nearby Events. It's sent with that search to our search and mapping providers, and your browser may remember the location you searched from (§9). We don't save it to your Account.

---

8. Messages we send you

Transactional and Event messages are part of the Services, such as account and security emails, Registration confirmations, pairings and round updates, waitlist offers, Staff messages, cancellation, refund and Subscription notices, and notices about policy changes. You can't opt out of these emails while you hold an Account or are registered for an Event, but you can turn off Event push notifications in the app or your device settings.

Marketing covers our newsletter, event digests, and promotional emails and push notifications, including Boost (§5.4). These are on by default:

• Newsletter. On the website, the newsletter box at signup is checked unless you uncheck it. Signing up in the app subscribes you. Starting a Subscription, or being approved for a Publisher's Organized Play Program, also adds your email address to our newsletter list. To stop the newsletter, use the unsubscribe link in any newsletter email.
• Event digests. Turn them off on your Account page on the website. Each digest links there.
• Promotions. Turn them off in the app's notification settings, or with the unsubscribe link in any promotional email.

Turning off marketing doesn't affect messages about Events you've entered.

Organizers and Publishers may contact you about their Events and programs, under their own policies.

On your device. You control push notifications and Live Activities, which can show Event details on your lock screen, in your device settings and in the app.

---

9. Cookies and similar technologies

Cookies are small files a website stores in your browser. We also use similar technologies: local storage in your browser or app, SDKs in the apps, and, in some emails, pixels that report opens (§2.5).

Local storage and app SDKs. The website and apps store some information on your device so they work properly, such as your sign-in state, preferences and Staff actions saved while offline. The apps include SDKs for analytics (Firebase Analytics), push notifications, payments (Stripe) and app updates. On Android, the analytics SDK may access your device's advertising ID; we don't use it for advertising.

Your choices. Analytics runs by default. You can control cookies and analytics this way:

• Browser settings. You can block or delete cookies. If you block the sign-in cookie, you can't sign in.
• Google's opt-out add-on. Google's Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout) stops Google Analytics on the website.
• Device settings. In the apps, your device settings control permissions such as location, camera and notifications. On Android, you can also reset or delete your advertising ID there.

Do Not Track. We don't respond to Do Not Track signals.

Tracking by third parties. Third parties, including Google (through Google Analytics, Google Maps and Google Fonts), Cloudflare, Stripe, PayPal and code and font networks, may collect information about your online activities over time and across different websites when you use the Services. If you click an affiliate card link, the affiliate network collects click information (§5.5).

---

10. How long we keep data, and deleting your Account

10.1 Retention

We keep personal data for as long as we need it for the purposes in §3, using these criteria:

• Account and profile data: while your Account is active.
• The Event Record: indefinitely, as a competitive record (§10.2 explains what changes if you delete your Account).
• Registrations and other Event records, such as chat, judge calls and Staff records: as long as the Event Record is kept.
• Transaction and tax records: as long as tax and accounting law requires.
• Safety, fraud and ban records: as long as needed for those purposes; ban records while the ban lasts.
• Linked-service details: until you disconnect the service.
• Saved shipping address and payment-method references: until you replace them or ask us to delete them.
• Marketing data: your activity summary and location history until you delete your Account; email engagement records as long as needed to measure our campaigns. We keep a record of opt-outs so we can honor them.
• Developer tools: keys, endpoints and grants until you remove them; delivery logs for a limited period.
• Data held by our providers, such as analytics data: as set by the provider.
• Support requests, disputes and legal matters: as long as the matter or the law requires.

Deleted data can stay in backups for a limited period before it's overwritten.

10.2 Deleting your Account

You can delete your Account in the app (Settings) or on the web (Account page), or by emailing [email protected]. When you delete your Account, we:

• delete your Account, profile and sign-in;
• delete your marketing profile (your activity summary and location history);
• on your Registrations, replace your name with "Deleted User" and remove your username, Discord details and profile image.

What stays. Other Registration details, such as your email address, pronouns, game IDs, decklists, payment references, registration location, penalties and Staff notes, remain in those Events' records, which Organizers keep. Details that were public (§4) stay visible next to "Deleted User". Results archived when an Event ended may keep the name you had then. Other records linked to your account ID or email address, such as orders, waitlist entries, Organizers' community and ban lists, judge certifications and Staff activity records, are kept under §10.1. Email [email protected] to ask us to delete more, and we'll handle your request as the law requires.

Why Event records stay. Other Players' standings and tiebreakers are calculated from every match in an Event, so removing yours would change theirs, and the Event Record is a competitive record. If you're an Organizer, the Events you ran stay on the Services, because they hold other Players' records.

Before you delete. Deleting your Account doesn't cancel a Subscription, revoke API keys, webhooks or app connections, or unsubscribe you from our newsletter. Cancel or remove them first.

Copies held by others. Deleting your Account doesn't delete copies already held by Organizers, Publishers, partners, Developers, search engines or people who copied public pages. Developers must update or delete their copies when we ask (Developer Terms §8). Where the law requires, we'll tell recipients about your request.

10.3 Correcting your data

You can change your name and profile at any time. A name change updates your name on your Registrations. Results archived when an Event ended keep the name you had then.

---

11. Your rights and choices

Depending on where you live, you may have the right to:

• access your personal data and information about how we use it;
• correct inaccurate or incomplete data;
• delete your data, with the exceptions in §10;
• port your data in a common machine-readable format;
• object to processing based on legitimate interests, including location (§7), and always to direct marketing;
• restrict our use of your data in certain cases;
• opt out of sale, targeted advertising and significant profiling (we don't do these; §5.11, §6);
• withdraw consent at any time, without affecting earlier processing;
• appeal if we turn down your request (below);
• complain to a data protection authority or other regulator (§15).

How to make a request. Use the self-service controls below, or email [email protected] from the address on your Account. If you don't have an Account, tell us the Event and the email address used. We may ask for more information to confirm your identity. You can use an authorized agent; we may ask the agent for proof of authority and ask you to confirm your identity. We respond as required by applicable law. We won't discriminate against you for using your rights.

Self-service controls:

Limits. We can't remove your results from an Event Record (§10.2). Organizers and Publishers hold their own copies of their Events' data; for those copies, contact them.

Appeals. If we turn down all or part of your request, you can appeal by replying to our decision, or by emailing [email protected] with "Appeal" in the subject line. We'll answer within the time the law requires. If we deny your appeal, you can complain to your state attorney general or your data protection authority.

---

12. Children and teens

Minimum age. You must be at least 13 to create an Account. Where local law sets a higher age for using online services without a parent's consent, you must be at least that age: for example, 14 in South Korea and Quebec, and up to 16 in some EU/EEA countries.

Users under 18 (or under the local age of majority) confirm that a parent or guardian has reviewed and agreed to the Terms of Service for them (Terms §4.2). A parent or guardian should supervise any paid purchase.

Children under 13. We don't knowingly collect personal data from children under 13 (or under the local minimum age). If we learn that we have, we'll close the Account and delete that data. Parents and guardians can contact [email protected].

Players without Accounts. Organizers can enter Players who don't have Accounts into Events, including younger Players. The Organizer is responsible for having any permission a parent or guardian needs to give. Those Players' names and results appear in the Event Record like any other Player's.

---

13. Security

We protect personal data with technical and organizational measures suited to the risk, including encryption in transit and access controls. Card and bank details are handled by Stripe and PayPal. No system is completely secure.

To report a security vulnerability or incident, email [email protected]. If a breach affects your personal data, we'll notify you and the authorities as the law requires.

---

14. International transfers

TopDeck is based in the United States. We and our service providers process personal data in the US and other countries. Organizers, Publishers and partners can be anywhere. When personal data from the EEA, UK or Switzerland goes to a service provider in a country without an adequacy decision, we rely on the safeguards in that provider's data processing terms, such as the EU-US Data Privacy Framework (and its UK extension) or the European Commission's Standard Contractual Clauses. When we share your data with an Organizer, Publisher or partner to provide the Event, program or feature you chose, we rely on that transfer being necessary for it. You can ask about the safeguards that apply to your data at [email protected].

---

15. Details by region

15.1 United States

Your rights. Depending on your state, you may have the rights to know, access, correct, delete and port your personal information, and to opt out of its sale, targeted advertising and significant profiling. Use §11 to make a request or an appeal. §2, §3 and §5 describe the categories we collect, their sources, why we use them and who receives them.

Sale and sensitive information. We don't sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising (§5.11). We don't use sensitive information to infer characteristics about you, and we use precise device location only if you allow it (§7).

California and Delaware. This policy is our notice under the California Online Privacy Protection Act and Delaware's Online Privacy and Protection Act. §2 describes the personal information we collect, §5 who we share it with, §11 how you can review and correct it, and §16 how we notify you of changes. §9 explains how we respond to Do Not Track signals and describes tracking by third parties.

Nevada. We don't sell covered information as defined by Nevada law. You can still send an opt-out request to [email protected], our designated request address.

15.2 European Economic Area and United Kingdom

The controller is TopDeck (§1.1). Our legal bases are in §3 and your rights in §11. Your right to object to direct marketing is absolute. You can complain to a supervisory authority: in the EEA, the authority where you live, work or think an infringement happened; in the UK, the Information Commissioner's Office (ico.org.uk).

15.3 Brazil

TopDeck is the controller under the Lei Geral de Proteção de Dados (LGPD). Our legal bases are those in §3, under LGPD Art. 7: performance of a contract, legitimate interest, consent, compliance with a legal obligation, and the regular exercise of rights.

Under LGPD Art. 18 you can ask for confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully; portability; deletion of data processed on the basis of consent; information about the entities we share data with, and about your right to refuse consent and its consequences; and withdrawal of consent. You can also ask for a review of decisions made solely by automated processing (Art. 20).

Our privacy contact (encarregado) is reachable at [email protected]. You can complain to the Autoridade Nacional de Proteção de Dados (ANPD). International transfers are covered in §14.

15.4 Japan

This section provides the information required by the Act on the Protection of Personal Information (APPI).

• Business operator: Eminence Gaming LLC. Address: 651 N. Broad St., Ste. 201, Middletown, DE 19709, USA. The name of our representative is available on request at [email protected].
• Purposes of use: as set out in §3.
• Provision to third parties. We provide personal data to the Organizer and Staff of each Event you enter, to the Publisher of a game with an Organized Play Program, and to partners, as described in §5. By registering for an Event, or by turning on a feature that sends data to a partner, you consent to that provision.
• Third parties in foreign countries. We, our service providers, and many Organizers, Publishers and partners are outside Japan, mostly in the United States. The US has no comprehensive federal privacy law; privacy is governed by sector laws and state laws. Our service providers are bound by contracts that require them to protect personal data. Ask us for more information about a specific recipient's country and safeguards.
• Security control measures: a designated privacy contact; access to personal data limited to people who need it; confidentiality duties for team members with access; professionally managed cloud data centers; encryption in transit and access controls. For the foreign environment, see above.
• Requests. You can ask us to disclose, correct, add to, delete, or stop using or providing your retained personal data, and to disclose records of our provision of your data to third parties. Email [email protected]. We don't charge a fee.
• Complaints and inquiries: [email protected].

15.5 Republic of Korea

This section provides the information required by the Personal Information Protection Act (PIPA).

• Items collected, purposes, retention: §2, §3 and §10. When a retention period ends, we delete electronic records so they can't be recovered, or anonymize them. We don't keep paper records.
• Provision to third parties. We provide personal data to the Organizer of each Event you enter, to the Publisher of a game with an Organized Play Program, and to partners or apps you or an Organizer turn on, as described in §5. You can refuse by not registering for the Event or not turning on the feature; you then can't take part in it.
• Outsourcing and overseas transfer. We use service providers, mainly in the United States, for the purposes and categories of data described in §5.7, and personal data is transferred to them when you use the Services. A list of these providers, with the data each receives, is available on request at [email protected].
• Your rights: access, correction, deletion, suspension of processing, and withdrawal of consent (§11). A legal representative may make requests for you.
• Cookies: §9. You can refuse cookies in your browser settings.
• Privacy officer: [email protected].
• Remedies. You can seek help from the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Personal Information Infringement Report Center at KISA (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office (www.spo.go.kr, 1301) or the National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).

15.6 Canada and Quebec

We handle personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, Quebec's Law 25.

• Your personal information is stored and processed outside Canada, mainly in the United States (§14), where courts, law enforcement and national security authorities may be able to access it.
• You can access and correct your information and withdraw consent (§11). Quebec residents can also ask for portability, and ask us to stop disseminating their information or to de-index it where the law allows.
• Person in charge of the protection of personal information: our privacy officer, [email protected].
• Technology that locates or profiles you. Our IP-based location (§7) and analytics (§9) can locate or profile you. You can object to IP-based location by contacting us, and control analytics as described in §9.
• Complaints: the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

---

16. Changes to this policy

We update this policy when our practices change. If we make a material change, we'll let you know by email or in the Services. Where the law requires your consent to a change, we'll ask for it. The date at the top shows when this version took effect.

17. Contact us

• Privacy requests and questions: [email protected]
• Security vulnerabilities and incidents: [email protected]
• General support: [email protected]
• Post: Eminence Gaming LLC, 651 N. Broad St., Ste. 201, Middletown, DE 19709, USA