Privacy Policy and Data Handling

We collect only the information required to operate and maintain our informational services related to nationally regulated prize draws. This may include contact details for communication, technical usage data for platform improvement, and account-related details for access management.

The collected data may consist of email addresses for notifications, names for account identification, IP addresses for security monitoring, and anonymized browsing activity to enhance service performance. All collection activities comply with applicable Canadian privacy requirements.

Personal data is used solely to support platform operation and improvement. This includes delivering informational updates, handling account-related requests, improving navigation and usability, and maintaining system integrity.

We do not transfer personal data for sale or commercial use. In limited cases, information may be shared with trusted service providers under confidentiality obligations for functions such as email distribution or security oversight.

All user information is stored on protected servers situated within Canada. Data is secured using encryption, access restrictions, and monitoring tools designed to reduce the risk of unauthorized access or disclosure.

Retention timelines are defined by data type: account information remains while an account is active, usage data is anonymized after approximately 11 months, communication logs are kept for up to 22 months, and legally required records are stored as mandated.

You may request access to, correction of, or removal of your personal information by contacting support@thawfortune.com. Identity verification is required, and responses are typically provided within 28 days.

Non-essential communications can be declined through account settings or unsubscribe options. Some platform features may be limited if certain necessary data processing is not permitted.

To initiate data removal, please email support@thawfortune.com with relevant account details. Once identity is confirmed, requests are handled within 28 days and confirmation is provided.

Certain records may be retained for defined periods to meet legal obligations, maintain system security, or resolve outstanding issues. Archived data remains encrypted and inaccessible until retention periods conclude, after which it is permanently erased.

Security practices include encryption, controlled access, periodic assessments, and staff awareness training. If a security incident occurs, affected users and authorities will be informed in line with Canadian legal requirements, generally within 72 hours of identification.

Our response procedures cover containment, evaluation, communication, and follow-up actions. Preparedness is supported through documented plans and routine testing of response measures.