By Jeffrey L. Derevensky — Updated June 2026
A privacy framework with no Canadian regulatory anchor
Instant Casino, operated by Simba N.V. and launched in 2024, presents a privacy picture that Canadian players need to evaluate with more scrutiny than at most platforms covered in this broader review series. The platform’s licensing documentation is itself inconsistent across sources – its own site references Curaçao, while at least one detailed independent review documents registration with the Government of the Autonomous Island of Anjouan under licence ALSI-1423l1005-FI2. Neither licensing body carries the GDPR-influenced data protection standards that Malta Gaming Authority licensing requires, nor the provincial enforcement mechanisms that AGCO registration provides for Ontario-licensed operators. What does apply to Canadian players regardless of which offshore licence is operative is Canada’s federal PIPEDA, which governs how any organisation handles Canadian personal data irrespective of where that organisation is incorporated. This guide examines what Instant Casino collects, how it’s likely used, and what protection Canadian players actually have access to.
About the author
My name is Jeffrey L. Derevensky. I’m James McGill Professor and Chair of the Department of Educational and Counselling Psychology at McGill University, with an additional appointment as Associate Professor in the Department of Psychiatry. I direct the McGill University Youth Gambling Research and Treatment Clinic and the International Centre for Youth Gambling Problems and High-Risk Behaviors, which I co-founded in 1992. My research over more than three decades has examined high-risk behaviours among children, adolescents, and young adults, with particular recent attention to how gambling-adjacent platforms collect and use behavioural data, including data generated through gamified features like lootboxes and mission-based reward systems that resemble those documented at Instant Casino. I’ve authored or co-authored four books and more than 280 peer-reviewed journal articles, and I’ve provided expert testimony before legislative bodies on policy matters connected to gambling and youth protection. I write independently, without commercial arrangements with any operator I cover.
The regulatory framework governing your data
| Framework | Applies | Protection level |
|---|---|---|
| PIPEDA (Canada federal) | Yes – all Canadian players | Federal rights regardless of operator jurisdiction |
| Curaçao or Anjouan licensing | Yes – inconsistently documented | Baseline offshore standards, no Canadian enforcement |
| AGCO / iGaming Ontario | No | Not applicable – platform unavailable in Ontario |
| MGA GDPR-influenced standards | No | Not held by this operator |
PIPEDA is the only consistently applicable protection for Canadian players here, and it provides genuine federal rights: access to personal information held, correction of inaccurate data, withdrawal of marketing consent, and complaint to the Office of the Privacy Commissioner of Canada. These rights exist independently of which offshore licence actually governs Instant Casino’s operations, because PIPEDA’s jurisdiction is based on the personal data of Canadians, not on where the data-handling organisation is based.
What Instant Casino likely collects: a structural assessment
Based on the platform’s documented features and standard industry practice for comparable offshore casinos, the categories of data Instant Casino collects span both standard account information and the behavioural data generated by its more distinctive gamified features.
Data provided directly
| Category | Specific data points |
|---|---|
| Identity data | Full legal name, date of birth (18+ verification) |
| Contact data | Email address, residential address, phone number |
| Verification data | Government-issued photo ID, proof of address – collected before withdrawal |
| Financial data | Payment method details across cards, e-wallets, crypto wallets, Interac |
| Account preferences | Bonus opt-in status, cashback tier progression, notification settings |
Data collected through platform activity
| Category | Specific data points |
|---|---|
| Technical data | IP address, device type, browser, operating system |
| Behavioural session data | Games played across the 3,000-plus library, session duration, bet sizes, win/loss patterns |
| Sportsbook data | Sports markets accessed, bet types including Combi Bet combinations, stakes and outcomes |
| Lootbox engagement data | Frequency of lootbox opens, prize tiers received, spending pattern leading to lootbox access |
| Mission and achievement data | Which missions are completed, completion timing, engagement frequency |
| Loyalty tier data | Progression through the 11-tier cashback structure, current tier status |
| Currency conversion data | EUR transaction records for Canadian players depositing through non-EUR sources |
The lootbox and mission engagement data category deserves specific attention from my research perspective. These features generate a particularly granular behavioural record because they’re designed around frequent, repeatable micro-interactions rather than discrete gambling sessions alone. A platform that tracks lootbox open frequency, mission completion timing, and tier progression velocity has a more detailed picture of a player’s engagement rhythm than transaction records alone would provide. This isn’t necessarily used maliciously, but it represents a data collection depth that’s worth understanding, particularly given that my research has consistently found younger adult players engage with gamified reward systems differently than they engage with traditional slot or table game formats, often with less conscious awareness of cumulative spend.
How this data is likely used
Based on the platform’s documented features, Instant Casino’s data use likely spans:
- Account authentication and KYC compliance under whichever licensing framework currently applies
- Payment processing across cards, e-wallets, cryptocurrency, and Interac, with currency conversion handling for non-EUR transactions
- Sportsbook bet administration across the more than 50 sports markets offered
- Welcome bonus and weekly cashback tracking, including monitoring toward the stated €10,000 cashback cap
- Lootbox and mission reward delivery and engagement tracking
- 11-tier loyalty programme administration and tier advancement calculation
- Pragmatic Play Drops & Wins tournament participation records, shared with the provider-level tournament infrastructure
- Customer support communications via live chat, email, and social channels
- Marketing communications with consent, distributed across the platform’s documented Instagram, Telegram, X, and YouTube channels
Third parties who may receive your data
| Third party | Purpose | Notes |
|---|---|---|
| Simba N.V. | Corporate operator | Owns and operates the platform |
| Payment processors | Transaction handling across documented methods | Visa/Mastercard, e-wallets, crypto networks, Interac |
| Game providers | Session data during gameplay | Hacksaw Gaming, Play’n GO, Evolution, Pragmatic Play, NetEnt, others |
| Pragmatic Play | Drops & Wins tournament data | Provider-level shared tournament infrastructure |
| KYC verification partner | Identity document processing | Standard offshore verification provider |
| Social media platforms | Engagement data from official channels | Instagram, Telegram, X, YouTube |
| Analytics providers | Platform performance measurement | Standard third-party analytics tools |
The cryptocurrency data point is worth noting specifically: crypto transactions are recorded on public blockchains, meaning wallet addresses and transaction hashes associated with deposits and withdrawals are potentially traceable independently of whatever privacy protections Instant Casino itself applies. This is a structural property of cryptocurrency rather than a platform-specific data handling choice, but Canadian players using crypto specifically to avoid currency conversion friction should understand that this method carries its own distinct privacy characteristics.
The jurisdictional gap in dispute resolution
Because Instant Casino’s actual licensing jurisdiction is inconsistently documented, Canadian players face genuine uncertainty about where to escalate a data-related dispute beyond PIPEDA’s federal framework. If the operative licence is Curaçao, the Curaçao Gaming Control Board provides a nominal complaint pathway. If the operative licence is Anjouan, that jurisdiction’s complaint mechanisms are less established and less documented in English-language consumer resources. Neither provides the structured, accessible dispute resolution that iGaming Ontario’s arbitration process offers Ontario-licensed platform users, or that the Malta Gaming Authority’s formal complaint mechanism provides for MGA-licensed operators.
From a research standpoint, this ambiguity itself is a consumer protection concern worth naming clearly rather than glossing over. A player who can’t confidently identify which regulator has jurisdiction over their account cannot effectively pursue a complaint beyond the platform’s own internal support channels, which creates an asymmetry of power in any dispute that the platform’s own terms don’t resolve in the player’s favour.
Your rights as a Canadian player under PIPEDA
Regardless of the licensing ambiguity, Canadian players retain federal rights under PIPEDA: the right of access to personal information held by Instant Casino, the right to correction of inaccurate or outdated data, the right to withdraw marketing consent without affecting account access, the right to know what third parties have received their data, and the right to complain to the Office of the Privacy Commissioner of Canada if these requests aren’t appropriately addressed. These rights exist as a matter of Canadian federal law and apply to any organisation handling the personal data of Canadians, independent of where that organisation is incorporated or which offshore gambling licence it holds.
