Ontario’s regulated online casino market is barely a few years old, but the privacy obligations attached to it are older and stricter than most players realize. When you sign up with an operator like High Flyer Casino, you are handing over a verified identity, banking details, and a play history that runs to thousands of rows. Two regimes govern what happens to that data: the Registrar’s Standards from the Alcohol and Gaming Commission of Ontario, and the federal Personal Information Protection and Electronic Documents Act. Most casino privacy pages describe the first and stay quiet about the second. Here is what operators must actually disclose, and what you can ask for.

The Regulatory Stack: AGCO Standards On Top Of PIPEDA

Every operator in the Ontario market answers to iGaming Ontario, the subsidiary of AGCO that conducts and manages the regulated marketplace, while AGCO itself issues the gaming-related supplier licence. High Flyer Casino holds a licence from the Alcohol and Gaming Commission of Ontario and operates under licence OPIG1241860, having entered the regulated Ontario market in December 2022. The brand itself was launched in 2020 by Ellipse Entertainment Limited, the company that operates it. That corporate chain matters because the licence holder, not the marketing affiliate, is the party accountable for data handling.

AGCO’s Registrar’s Standards set out what an operator must put in writing: a privacy policy, clear terms of use, responsible gambling information, and complaint routes. These are conditions of holding the licence, and AGCO can inspect against them. PIPEDA, which applies to commercial activity across Canada, adds a second layer that AGCO standards mirror but do not replace. Under PIPEDA, an organization must identify the purpose for collecting personal information, limit collection to what is necessary, obtain consent, protect the data, and – the point almost nobody advertises – give individuals a right of access to the information held about them.

The practical upshot is that a licensed Ontario casino cannot tell you to get lost when you ask what data it holds on you. PIPEDA’s access principle requires a response, generally within 30 days, with limited exceptions such as information that would reveal another person’s data or legal privilege. AGCO’s standards do not weaken that right. If you have ever wondered why a casino’s privacy page runs to five thousand words about cookies and says nothing about subject access requests, the answer is not that the right disappears. It is that the page is written for compliance optics, not for you.

What Must Be Disclosed Before You Deposit

Before a single dollar moves, an Ontario-licensed operator must be transparent about the identity of the licensee, the terms attached to any bonus, and how funds and personal data are handled. High Flyer Casino illustrates the pattern. The welcome package includes 320 free spins across 3 deposits and requires a minimum deposit of C$20, with playthrough of 1x on spin wins. Those numbers have to be disclosed in the promotional terms, and the bonus code – WELCOME2026 is entered during registration – has to be presented as part of a defined promotional string rather than buried in fine print.

Disclosure failures usually happen in the other direction: not missing terms, but invented ones. Affiliate aggregators publish fabricated promotional strings all the time, attaching bonus codes and wagering figures to brands that never issued them. https://highflyer-online.com/promo-code/ offers additional context worth reviewing. A player searching for a High Flyer Casino promo code 2026 can land on three portals with three different codes, none of which match the operator’s own cashier terms. The fix is procedural: confirm any bonus code inside the bonus lobby after login, and treat a third-party code as unverified until the cashier accepts it. The licensed operator’s own terms are the only version AGCO would hold it to.

Cashier terms belong in the same disclosure bucket. Deposit and withdrawal limits, processing times, payment methods, and identity verification requirements must be visible before you commit funds. Verification is not optional paperwork; it is a condition of the licence, and it is also the moment when the operator collects and stores the most sensitive personal data you will ever give it – government ID, proof of address, sometimes source-of-funds documents. A casino that discloses verification requirements clearly is usually also the kind that handles the resulting data competently.

How To Exercise Your Access Right And What To Expect

PIPEDA gives you the right to request access to the personal information an operator holds, and to ask how it has been used and to whom it has been disclosed. The mechanics are mundane, which is why they work. Write to the operator’s privacy officer – the contact is required to be published in the privacy policy – state that you are making a request under PIPEDA, and describe the data you want. Keep the request specific: account details, transaction history, verification documents, marketing consent records. Operators may charge a minimal fee for producing copies, though many waive it for straightforward requests.

Expect a response inside 30 days, with the clock pausable if the operator needs clarification from you. You can also ask for correction of inaccurate information, and you can withdraw marketing consent at any time without touching your account status. If the response is evasive or the deadline passes, PIPEDA gives you a route to the Office of the Privacy Commissioner of Canada, which can investigate. AGCO sits alongside that as a second channel: complaints about a licensee’s conduct, including its handling of player data, can go to the regulator that issued licence OPIG1241860.

Two practical cautions. First, access requests are one per household in spirit – the right attaches to you as an individual, and operators reasonably reject blanket requests covering family members. Second, an access request does not override record-keeping duties. Ontario operators must retain certain account and transaction records for anti-money-laundering and licensing purposes, so some data will be held regardless of a deletion request. The right is to see it, correct it, and control its commercial use, not to erase the audit trail.

Run the checklist before you register anywhere: find the licensee name and licence number in the footer, read the bonus terms and confirm any promo code inside the cashier rather than on an affiliate page, note the privacy officer’s contact, and remember that your stored data is accessible on request under federal law. High Flyer Casino, operated by Ellipse Entertainment Limited under AGCO licence OPIG1241860, is one of many Ontario operators bound by that dual regime. The ones worth your deposit are the ones that disclose both halves of it without being asked twice.