Personal information protection and data handling practices at Casino Rama Resort.

Casino Rama Privacy Policy

Casino Rama Resort (“Casino Rama” or “the company”) processes personal information relating to guests, patrons, employees, suppliers, and other individuals in the course of its operations. This Privacy Policy describes how personal information is collected, used, disclosed, safeguarded, and retained, and outlines the rights available to individuals under applicable Canadian privacy legislation.

Casino Rama Resort is located on the Rama First Nation near Orillia, Ontario, Canada. The handling of personal information is subject to federal and provincial privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy statutes. This policy applies to personal information in the custody or under the control of Casino Rama, whether collected through the website, on-site at casino and resort facilities, or through other channels.

1. Scope and Application

This Privacy Policy governs the collection, use, disclosure, retention, and security of personal information by Casino Rama. It applies to:

Guests and patrons who visit the casino, hotel, restaurants, entertainment venues, or other facilities
Individuals who use the website or other digital services
Employees, contractors, and job applicants
Suppliers, vendors, and business partners
Any other individuals whose personal information is collected in connection with business activities

By accessing Casino Rama premises, using its services, or providing personal information, individuals acknowledge that their information will be handled in accordance with this policy and applicable law.

2. Types of Personal Information Collected

Personal information is collected to provide services, comply with legal obligations, and operate the business. Depending on the relationship with Casino Rama and the services used, the categories of personal information that may be collected include:

Identification information: name, date of birth, government-issued photo identification (such as driver’s license or passport), and signature
Contact information: address, telephone number, email address
Financial information: banking details, credit card information, transaction records, and payment history
Employment information (for employees and contractors): résumés, employment history, performance reviews, payroll records, and tax information
Loyalty and player information: membership numbers, gaming activity, preferences, and participation in promotions or events
Health information: in limited circumstances, where required for accommodation requests, incident reports, or compliance with health and safety obligations
Security and surveillance data: images captured by security cameras, access logs, and incident reports

The specific information collected will vary based on the nature of the interaction with Casino Rama.

3. Purposes for Collection, Use, and Disclosure

Personal information is collected, used, and disclosed only for purposes that are reasonable, lawful, and identified at the time of collection or as otherwise permitted by law. These purposes include:

Verifying identity and age to comply with legal requirements for entry to the casino (patrons must be 19 years of age or older with valid government-issued photo identification)
Processing transactions, payments, and financial settlements
Administering loyalty programs, promotions, and customer accounts
Providing hotel accommodations, dining reservations, and event services
Managing employment relationships, including recruitment, payroll, benefits administration, and performance management
Ensuring the security and safety of premises, guests, and staff through surveillance, access control, and incident investigation
Complying with legal and regulatory obligations, including anti-money laundering requirements, tax reporting, and gaming regulations
Responding to inquiries, complaints, and requests for information
Conducting internal audits, risk management, and quality assurance
Defending or pursuing legal claims and cooperating with law enforcement or regulatory authorities

Personal information is not used or disclosed for purposes other than those for which it was collected, except with consent or as required or permitted by law.

4. Disclosure to Third Parties

Casino Rama may disclose personal information to third parties in the following circumstances:

To service providers and contractors that perform functions on its behalf, such as payment processing, IT support, security services, and marketing. Such parties are contractually required to protect personal information and to use it only for authorized purposes.
To Gateway Casinos & Entertainment Limited, as the parent or affiliated company, for corporate administration, reporting, and operational purposes.
To government agencies, regulators, and law enforcement authorities when required by law or in response to valid legal process.
To legal, accounting, and other professional advisors in connection with the management of the business or legal proceedings.
In connection with a corporate transaction, such as a merger, acquisition, or sale of assets, where personal information may be transferred as part of the business.
With the consent of the individual or as otherwise permitted under applicable privacy law.

Personal information is not sold to third parties for their independent marketing purposes.

5. Security Safeguards

Appropriate administrative, technical, and physical safeguards are used to protect personal information against unauthorized access, use, disclosure, loss, or destruction, having regard to the sensitivity of the information. These safeguards include:

Restricted access to personal information on a need-to-know basis
Use of passwords, encryption, and secure transmission protocols for electronic data
Physical security measures at facilities, including controlled access and surveillance
Contractual obligations requiring third-party service providers to maintain confidentiality and security
Periodic review and updating of security practices and incident response procedures

Despite these measures, no system can be guaranteed as completely secure. In October 2016, Casino Rama experienced a cybersecurity incident in which unauthorized parties accessed computer systems and exfiltrated personal information affecting at least 10,990 individuals, including patrons and employees. The data obtained included banking details, copies of government-issued identification, dates of birth, and employment records. The incident was reported to the Office of the Privacy Commissioner of Canada and the Information and Privacy Commissioner of Ontario, and steps were taken to address the incident and enhance security practices. Ongoing measures include investment in cybersecurity controls and staff training to reduce the risk of future incidents.

6. Retention and Disposal

Personal information is retained only for as long as necessary to fulfill the purposes for which it was collected, to meet legal and regulatory requirements, and to resolve disputes or enforce agreements. Retention periods vary depending on the type of information and applicable legal obligations. When personal information is no longer required, it is securely destroyed or anonymized in accordance with Casino Rama records retention policies.

7. Access and Correction Rights

Individuals have the right to request access to personal information in the custody or under the control of Casino Rama and to request corrections to any inaccuracies. Access or correction requests may be submitted using the contact information set out in Section 9 of this policy. Responses will be provided within the timeframes required by applicable privacy law. In certain situations, access may be restricted in accordance with legal requirements, including where information is subject to solicitor-client privilege or other lawful limitations. Where access is refused, the reasons for refusal will be explained, subject to legal restrictions.

Personal information is collected, used, and disclosed with the consent of the individual, except where otherwise permitted or required by law. Consent may be express or implied, depending on the circumstances and the sensitivity of the information. Individuals may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect the ability of Casino Rama to provide certain products or services.

9. Contact and Complaints

Questions about this Privacy Policy, requests to exercise access or correction rights, and privacy complaints may be directed to:

Casino Rama Resort
Rama, Ontario, Canada

The Privacy Officer may also be contacted through the official website at www.casinorama.com.

If a privacy concern or complaint is not resolved to the satisfaction of the individual, a complaint may be filed with the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner of Ontario.

10. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in practices, legal requirements, or operational needs. Any changes will be posted on the Casino Rama website and will take effect upon posting, unless otherwise specified. Periodic review of this policy is recommended.

11. Governing Law

This Privacy Policy and the handling of personal information by Casino Rama are governed by the laws of Canada and the Province of Ontario. The Casino Rama website is a Canadian website subject to Canadian law, and the use of data collected via the site is governed by this Privacy Policy as referenced in the applicable Terms of Use.