Cookie policy

heScore Casino is operated by Score Media and Gaming Inc., a company incorporated in British Columbia (Incorporation No. BC1394218, Business No. 848989844BC0002), registered office 1133 Melville Street, Suite 3500, The Stack, Vancouver, BC V6E 4E5, Canada.

Score Media and Gaming Inc. is registered as an internet gaming operator with the Alcohol and Gaming Commission of Ontario under Registration No. OPIG1294141 (Issue Date: May 22, 2026, Expiry Date: April 3, 2028) and offers its games in Ontario under an operating agreement with iGaming Ontario.

For anything in this policy, write to our Privacy Officer at privacy@hescore.casino, or by post to the registered office above, marked for the attention of the Privacy Officer. This policy takes effect on May 22, 2026 and sits alongside our Privacy policy and Terms of use.

Regulated by19+

A cookie is a small text file that a website asks your browser to store and send back on later visits. It lets us recognise the same browser without asking you to sign in on every page. Cookies set by us are called first-party; cookies set by another company through our pages are third-party.

We also use technologies that behave like cookies even though they are not cookies:

• Pixels and web beacons. A one-pixel image or a small script in a page or an email that reports when it was loaded. We use them to count campaign responses and to see whether an email was opened.
• localStorage and sessionStorage. Space in your browser where the site keeps small values, such as your favourites, your catalogue view and the cookie choices you make here. localStorage stays until it is cleared; sessionStorage is dropped when you close the tab.
• Software development kits (SDKs) in the apps. The heScore Casino apps use the equivalent device identifiers instead of browser cookies. The categories and choices in this policy apply there too.
• Device and browser characteristics (fingerprinting). A combination of signals such as operating system, screen size, time zone, language and installed fonts. We use it only for security, fraud prevention, multi-accounting detection and the Ontario location check, never to build advertising profiles.
• Server logs. IP address, timestamp, page and error data recorded when your device contacts our servers. Logs are necessary to run and secure the Service.

Cookies last either for the session (deleted when you close the browser) or for a set period (persistent). Where a cookie is persistent, the retention column in the table below gives its maximum life.

Strictly necessary

Sign-in and session security, load balancing, fraud and bot prevention, enforcement of your deposit, loss, wager and time limits, break and self-exclusion checks, and the record of the choices you make in this banner. These are set on every visit because the Service and our regulatory obligations cannot work without them. They are not used for advertising.

Functional

Preferences you have expressed: favourites, catalogue layout, table sort order, reality-check interval, language and the dismissal of notices. Switching this category off does not stop you using the site; it means the site forgets these choices between visits.

Analytical

Aggregated statistics about how the Service is used: page views, game opens, search terms, load times and errors, through tools such as Google Analytics. We use them to fix problems and to decide what to build. Results are reported in aggregate and are not used to make decisions about an individual player.

Marketing

Measuring our campaigns and showing relevant offers on other sites and apps, through partners such as Google Ads and Meta. Set only with your express consent. Marketing cookies are never set for an account that is on a break, self-excluded through BetGuard, or otherwise excluded from marketing, and never for anyone who has not confirmed they are 19 or older.

Geolocation (AGCO)

Confirms that your device is physically inside Ontario before you can deposit or play for real money, as the AGCO’s Registrar’s Standards for Internet Gaming require. The check combines your device location, IP address and the device signals described above, and it runs again at intervals during play. It cannot be switched off for real-money play: if you decline it, browsing and practice play still work, but wagering does not.

Two federal laws govern what we do here, alongside the AGCO’s Registrar’s Standards for Internet Gaming.

• PIPEDA (the Personal Information Protection and Electronic Documents Act) requires us to identify the purpose of every collection, to obtain meaningful consent for it, and to limit collection to what those purposes need. Where information is sensitive — identity documents, payment data, location, anything that reveals gambling behaviour — PIPEDA expects express consent rather than an assumption. That is why analytics, marketing and functional categories start switched off.
• For strictly necessary and geolocation cookies we rely on the fact that the Service cannot be delivered without them and that Ontario regulation obliges us to run the check. Consent for these is obtained when you open an account and accept the Terms of use; declining them means you cannot play for real money.
• CASL (Canada’s Anti-Spam Legislation) governs commercial electronic messages and the installation of computer programs on your device. Marketing email and push notifications are sent only with express consent, recorded with the date, time and method by which you gave it. Every message identifies us, gives our postal address and carries an unsubscribe mechanism that works for at least 60 days and is actioned within 10 business days.

We do not sell personal information, and we do not use analytics or marketing data to profile a player’s gambling behaviour for the purpose of encouraging more play.

1. On your first visit, before any non-essential cookie is set, a banner explains the categories and offers three equally prominent choices: Accept all, Reject non-essential and Manage settings. Rejecting is one click, exactly like accepting.
2. Nothing in the functional, analytical or marketing categories loads until you choose. Closing or ignoring the banner is not consent, and the banner reappears on the next visit.
3. Your choice is written to this device with the categories you allowed, the policy version and the date and time you chose. That record is how we prove consent under PIPEDA and CASL and is kept for as long as the consent is relied on, plus three years.
4. Signed-in players have the same choices stored against the account, so they carry across devices. Marketing consent given at registration is stored the same way and can be withdrawn separately at any time.
5. We ask again whenever this policy changes in a way that affects what is set or who receives it, and at least every 12 months.

On this site

Use the panel in section 5, or the Cookie settings link in the footer of every page. Turning a category off stops new scripts in that category from loading and clears the cookies we control in it. Withdrawing consent is as easy as giving it, and it never costs you access to anything except the feature the category provides.

In your browser

Every major browser lets you block or delete cookies, block third-party cookies, or clear site data for a single site: Chrome (Settings › Privacy and security › Third-party cookies), Safari (Settings › Privacy), Edge (Settings › Cookies and site permissions), Firefox (Settings › Privacy & Security). Blocking strictly necessary cookies will sign you out and stop parts of the Service, including the location check, from working. On mobile you can also reset or limit the advertising identifier in your device settings.

Marketing messages (CASL opt-out)

Every marketing email carries an unsubscribe link, and push notifications can be turned off in Account › Notification settings or in your device settings. You can also write to privacy@hescore.casino and ask us to stop. We action the request within 10 business days, and we keep your address on a suppression list so the opt-out is honoured. Service messages we are required to send — security alerts, limit and self-exclusion confirmations, transaction receipts, regulatory notices — continue, because they are not commercial electronic messages.

If you self-exclude

Activating BetGuard or a break stops all marketing immediately and permanently for the exclusion period, whatever your cookie settings say. See Self-exclusion & BetGuard.

With your consent, the following categories of provider may set or read cookies and similar identifiers through our pages. Each acts under a written contract that limits what it may do with the data.

• Google LLC (Google Analytics, Google Ads, Google Tag Manager) — analytics and campaign measurement. IP addresses are truncated and advertising features are enabled only in the marketing category.
• Meta Platforms, Inc. (Meta pixel and conversions) — campaign measurement and audiences for Facebook and Instagram.
• Game and live-studio providers (for example Evolution and NetEnt) — strictly necessary cookies inside a game frame, so a round can be resumed and settled.
• Geolocation and identity-verification providers — the Ontario location check and the age and identity checks required before you can play.
• Hosting, content delivery, error monitoring and customer-chat providers — keeping the Service available, fast and supported.

Some of these providers, and some of our own group companies, store or process personal information outside Canada, mainly in the United States and the European Union. While information is in another country it may be accessible to the courts, law enforcement and national security authorities of that country under its laws. We remain accountable for it under PIPEDA: transfers are made for processing only, under contracts requiring a comparable level of protection, and we assess each provider before it is engaged. Ask the Privacy Officer if you want the current list of providers and the countries involved.

Third-party sites we link to — ConnexOntario, the AGCO, iGaming Ontario, BetGuard, app stores — have their own cookie and privacy policies, and this one does not apply to them.

Write to the Privacy Officer first at privacy@hescore.casino. We acknowledge within 2 business days and answer in writing within 30 days; if we need longer we tell you why and when to expect the answer.

If our answer does not resolve it, you may complain to the Office of the Privacy Commissioner of Canada (OPC), the federal authority that oversees PIPEDA and, with the CRTC and the Competition Bureau, enforces CASL:

• Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3
• Toll free 1-800-282-1376 · priv.gc.ca

Complaints about how we run the casino itself, rather than about privacy, follow the chain in our Terms of use: our internal complaints process, then iGaming Ontario, then the AGCO.

We review this policy at least once a year and whenever we add, remove or change a technology, a provider or a purpose. The version number and the dates at the top of the page always show the text in force.

• Minor changes (wording, a new example, a provider replaced by an equivalent one) are published here with a new last updated date.
• Material changes (a new category, a new purpose, a new recipient, a transfer to a new country) are announced in the Service and, for account holders, by email at least 14 days before they take effect, and the consent banner is shown again so you can make a fresh choice.
• Previous versions are kept and can be requested from the Privacy Officer.

Continuing to use the Service after a change takes effect means the new policy applies to you; where the change needs consent, nothing new is set until you give it.

Privacy Officer, Score Media and Gaming Inc., 1133 Melville Street, Suite 3500, The Stack, Vancouver, BC V6E 4E5, Canada. Email privacy@hescore.casino. General support: Contact us. Regulator: Alcohol and Gaming Commission of Ontario (agco.ca); iGaming Ontario (igamingontario.ca).