Privacy Policy
1. Who we are (data controller)
This website, topzara.com ("TopZara", "we"), is operated and advertised by Lumeris Agency, the controller of personal data processed through this site.
Lumeris AgencyPrivacy / data protection contact: [email protected]
Website: topzara.com
We provide independent comparisons of online casinos for adults in Canada. We are not a gambling operator and never receive your gambling account or payment details. This policy follows the EU/UK GDPR, and Canada's PIPEDA and applicable provincial privacy laws.
2. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Operate and secure the website (delivery, fraud and abuse prevention) | IP address, browser/device data, server logs | Legitimate interests (6(1)(f)): running a secure site |
| Remember your cookie choices | Consent choice, timestamp, policy version | Legal obligation / legitimate interests (6(1)(c),(f)): proving valid consent |
| Audience analytics (only if you accept Analytics cookies) | Pseudonymous identifiers, pages viewed, approximate location, device type | Consent (6(1)(a)) |
| Advertising measurement and conversion tracking (only if you accept Marketing cookies) | Ad-click identifiers, pages viewed, device data | Consent (6(1)(a)) |
| Affiliate click attribution when you click an operator link | Campaign parameters in the link (source, medium, campaign, brand, list position). No name or email is added. | Legitimate interests (6(1)(f)): measuring and being paid for referrals |
| Respond to your enquiries and rights requests | Name, email, message, identity-verification details | Legal obligation (6(1)(c)) and legitimate interests (6(1)(f)) |
| Comply with advertising, tax and legal requirements | Records relating to the above | Legal obligation (6(1)(c)) |
We do not sell personal data, and we do not use it for automated decision-making with legal effects. This site is for adults only (19+, or 18+ in Alberta, Manitoba and Quebec) and we do not knowingly collect data from minors.
3. Data retention
| Data | Retention |
|---|---|
| Server and security logs | Up to 30 days |
| Cookie consent record | Up to 12 months, then we ask again |
| Analytics data (if consented) | Up to 14 months |
| Advertising/conversion data (if consented) | Up to 13 months (cookie lifetime); provider reports per provider settings |
| Enquiries and rights requests | Up to 24 months after closing, or longer where needed for legal claims or law |
4. Sharing with third parties
We share data only as needed:
- Service providers (processors) such as hosting/CDN and email providers, under data processing agreements.
- Analytics and advertising providers (Google, Microsoft), only after you consent, as described in the Cookie Policy.
- Casino operators you choose to visit. When you click a link you leave our site and the operator becomes an independent controller under its own privacy policy. We do not pass them your personal data; the link only carries campaign parameters.
- Authorities and advisers where required by law.
5. International transfers
We are based in Canada and our providers may process data in Canada, the EU/UK and the United States. Where personal data of people in the EEA/UK is transferred to a country without an adequacy decision, we rely on safeguards such as the EU Standard Contractual Clauses (and UK Addendum) or participation of the recipient in the EU–US Data Privacy Framework. You can request a copy of these safeguards using the contact details below.
6. Your GDPR rights
- Access your data and receive a copy.
- Rectification of inaccurate data.
- Erasure ("right to be forgotten").
- Restriction of processing.
- Portability of data you provided, in a common format.
- Object to processing based on legitimate interests.
- Withdraw consent at any time, as easily as you gave it, using . Withdrawal does not affect earlier lawful processing.
- Complain to your supervisory authority (in Canada, the Office of the Privacy Commissioner of Canada; in the EU/UK, your local data protection authority).
7. How to submit a GDPR / privacy request
- Email [email protected] with the subject line "GDPR Request".
- Say which right you want to use (for example "access" or "erasure") and give enough detail for us to find your data (for instance the email address you contacted us from, approximate dates, or the cookie identifier from your browser).
- We may ask for proof of identity to protect your data; we will only use it for verification.
- We respond within one month (30 days under PIPEDA); this may be extended by two further months for complex requests, and we will tell you why. Requests are free unless manifestly unfounded or excessive.
Privacy / data protection contact: [email protected]
Website: topzara.com
8. Security
We use HTTPS, access controls and minimisation to protect data. No system is completely secure; if a breach likely affects your rights we will notify you and the authorities as required.
9. Changes
We will update this page when our practices change and show the date above. Material changes will be highlighted on the site.