WOODBINE ENTERTAINMENT PRIVACY POLICY

Woodbine Entertainment Group (“we” or “our”) offers a range of racing, gaming and entertainment products, which are available across North America and worldwide through our various Internet sites. Neither this web site nor any of our other Internet sites or applications are intended for use by children.

We maintain a firm commitment to the privacy of our customers’ and our employees’ Personal Information (defined below under the heading “What is Personal Information?”). The following outlines our commitment in this regard::

• Purpose and Consent: At the time of collection we will explain the purpose of collecting Personal Information and obtain consent to collect, use and disclose Personal Information.
• Limiting Collection: We limit the collection of Personal Information to what is reasonable under the circumstances and Personal Information will only be used for the purposes for which it is collected.
• Security: Personal Information is kept strictly confidential and is not disclosed outside of our operations without consent, unless required or permitted by law.
• Access: Customers and employees have the right to access the Personal Information that we maintain about them and to correct any inaccuracies.

We have adopted the 10 privacy principles established by the Canadian Standards Association’s Model Code for the Protection of Personal Information. These principles form a part of the Personal Information Protection and Electronic Documents Act (“PIPEDA” or the “Act”) which establishes the rules governing the collection, use and disclosure of
Personal Information in Canada. It should be noted that certain provinces (Alberta, British Columbia and Québec) have privacy legislation that governs the collection, use, retention, protection and disclosure of Personal Information in those provinces. We will periodically review our principles in order to ensure that they remain relevant and current with changing technologies and laws and the evolving needs of our customers and employees.

Our 10 Principles:

1. Accountability: We are responsible for maintaining and protecting Personal Information under our control. We have appointed a Chief Privacy Officer to oversee our compliance with the Act and our 10 principles.
2. Identifying Purposes: We will identify the purposes for which Personal Information is collected, either before or at the time of collection.
3. Consent: We will only collect, use and disclose Personal Information with the applicable individual’s knowledge and consent, except where otherwise required or permitted by law.
4. Limiting Collection: We will limit the collection of Personal Information to only those items of information that are necessary for the purposes for which the information is collected.
5. Limiting Use, Disclosure and Retention: Personal Information will only be used or disclosed for the purposes for which it was collected, unless the applicable individual has otherwise consented, or where it is required or permitted by law. We will retain Personal Information only as long as necessary to fulfill the purposes identified. When Personal Information is no longer required, it will be securely destroyed, deleted, anonymized, or otherwise disposed of in accordance with our Document Management policy.
6. Accuracy: We will keep Personal Information that we collect accurate, complete and up-to-date to fulfill the purposes for which it was collected.
7. Safeguards: We will protect Personal Information with security safeguards appropriate to the sensitivity of the information.
8. Openness: Specific information about our policies and practices relating to the management of Personal Information will be made available upon request.
9. Access: Upon request, we will provide information to the applicable individual of the existence, use and disclosure of their Personal Information and provide access to such Personal Information. Individuals have the right to verify the accuracy and completeness of their Personal Information and to have it amended as appropriate.
10. Verifying Compliance: Please contact us with any questions, complaints or suggestions with respect to the above principles and this Privacy Policy using the contact information provided below.

What is Personal Information?

Personal Information is broadly defined as information about an identifiable individual, but does not include the name, title, business address or business telephone number of an employee of an organization. Personal Information with personal identifiers removed (removing the identity of the individual from the information) so that it can no longer be identified with a particular individual is not considered Personal Information.

Personal Information We Collect

We may collect Personal Information in person, by telephone, by mail, by intercept survey or through the Internet. We also collect information when customers use our WIFI services, visit our website(s), interact with our employees or chatbot(s), use our application(s) or wager using their HPIbet account. Such information may include device information, usage information and/or location information. We may also collect information regarding wagering activity and rewards earned through our loyalty programs so that we may better serve our customers.

For the purposes of providing account wagering services, we collect and maintain the following information of our customers:

Name
Mailing Address
Email Address
Telephone Number
Date of Birth

We collect this information in order to provide services to our customers, to develop and improve our products and service offerings,
and provide tailored offers and information.

• Several of our products and services (e.g. telephone account and Internet wagering) are governed by federal and provincial regulations that require that specific Personal Information be collected and maintained by us.
• Some of our products and services can only be provided to our customers if we can collect, use and disclose their Personal Information (e.g. HPIbet Rewards program).

This policy also applies to Personal Information of our employees that we collect, use, disclose, retain, and dispose of during the employment lifecycle. We collect and use employee Personal Information only as required to support employment-related activities, business operations, legal obligations, and employee programs with respect to all employees of Woodbine Entertainment Group, including full-time, part-time, temporary, contract, seasonal, and casual employees. The Personal Information that we collect about our employees includes:

• Name, address, contact, date of birth and (Government issued) identification information
• Payroll and banking, compensation, benefits, pension information
• Performance, employment, attendance and scheduling records
• Accommodation and leave-related information
• Security and workplace access information

We may collect Personal Information throughout the employment relationship, including but not limited to:

• Recruitment, hiring, employment, payroll, benefits, and pension administration
• Health, safety, and accommodation processes
• Training, development, and performance management
• Security, investigations, and business operations
• Compliance with legal and regulatory obligations

How We Use Personal Information

Relationships with our customers are important to us. We want to provide our customers with our various services on an ongoing and efficient manner to establish a long-lasting relationship which will meet each customer’s changing needs.

We collect Personal Information about our customers to:

• Provide customers with products, services or information that customers request, including opening and administering accounts and account transactions and related purposes
• Assist in identifying customer preferences
* Enable use of social networking features and media
• Provide customers with information about upcoming events, promotions and new and improved services
• Protect the customer, and us, against error and fraud
• Comply with legal requirements
• Comply with our internal risk management and related policies
* Collect usage and user data, including screen recordings
* Conduct and promote contests, including awarding prizes, etc.
* Conduct and inform indirect, targeted or interest-based marketing activities
* Provide customers with the opportunity to participate in additional product offerings (such as, without limitation, partial cash out opportunities)
*perform identify verification checks where required, including without limitation via a credit reference agency
*Track movement throughout our physical and digital properties

Customer Personal Information may also be used to provide us with business statistics. These statistics do not contain any information which personally identifies a customer.

We collect Personal Information about our employees to:

• Establish and administer the employment relationship
• Process payroll, benefits, pension, and compensation programs
• Support attendance, scheduling, and workforce administration
• Manage performance, training, and career development
• Administer health, safety, wellness, and accommodation programs
• Meet legal, regulatory, and reporting obligations
• Protect company assets, employees, customers, and operations
• Support investigations, audits, and security activities
• Facilitate services provided by third-party providers on our behalf

Marketing

In accordance with Canada’s Anti-Spam Legislation, a customer must provide their consent in order to receive information from us about our events, promotions or services by email or other electronic means. We may otherwise inform customers about our events, promotions or services by mail, telephone or other means. If a customer wishes to receive email correspondence from us, or does not wish to receive direct marketing by mail, telephone or other means, please contact us using the contact information provided below.

Customer Consent

Key to protecting the privacy of our customers’ Personal Information is consent. We collect, use and disclose customer Personal Information only with their consent except where otherwise permitted or required by law. A customer may decline to provide us with their Personal Information. However, this choice may make it impossible for us to provide certain products or services. For example, we cannot set up a telephone wagering account with Internet access without the Personal Information which is required by the Canadian Pari-Mutuel Agency, the agency which regulates pari-mutuel wagering, on behalf of the Ministry of Agriculture, Food and Rural Affairs (OMAFRA).

Privacy and Access Choices

Should a customer wish to limit access to certain types of information, they may block cookies and/or similar technologies as permitted by their device. A customer may also opt out of receiving targeted advertising by visiting the Network Advertising Initiative, Digital Advertising Alliance and/or Digital Advertising Alliance of Canada.

Withdrawing Consent

A customer may withdraw their consent at any time, subject to legal or contractual restrictions and reasonable notice. If a customer wishes to withdraw their consent we will inform them of the implications. To withdraw consent, a customer should simply contact us and tell us of the Personal Information which they no longer wish us to collect, use and/or disclose. See below for contact details.

Security and Disclosure of Personal Information

We recognize the concerns of our customers and employees about the security of the Personal Information which they provide to us. Our processes and procedures keep Personal Information safe and secure. We have different safeguards in place (physical, technological and organizational). While we use reasonable efforts to protect Personal Information, we cannot guarantee the security of Personal Information or of any information that is transmitted via the Internet. In the event that Personal Information is inadvertently disclosed, the affected individual may be subject to financial loss, identity theft, negative effects on credit records and damage to or loss of property, damages to reputation, and other potential consequences.

We will only use and disclose Personal Information to fulfill the purposes for which it was collected or as otherwise identified in this Privacy Policy. Other uses of Personal Information will only be undertaken after we have obtained additional consent, or as may be required or permitted by law. We will only keep Personal Information for as long as needed for the stated purposes.

We may transfer Personal Information to a third-party service provider or agent who provides services to us or on our behalf such as hosting, data management and storage services, market analysis and retention services. We may also share Personal Information with our affiliated companies, social media services providers, companies that provide content, advertising or functionality, or other third parties as required or permitted by law. We may, or any such third-party service provider may, use servers for such purposes which are located outside of Canada. Personal Information may be processed in a location outside of Canada, and the laws of any such foreign jurisdiction may apply such that the governments, courts, law enforcement or regulatory bodies of any such foreign jurisdiction may be able to obtain disclosure of such Personal Information.

Non-Personal Information

We may collect and use non-personal information including but not limited to IP addresses to help identify customers, gather statistics regarding our customers and/or the users of our website(s) and/or application(s), diagnose problems with our website(s) and/or application(s) and to administer our website(s) and/or application(s). In addition, our messages and/or website(s) and/or application(s) may use various technologies, such as cookies, pixels or anonymous identifiers, which may then be stored on an individual’s hard drive so that we can learn more about our customers to enable us to serve them better, so that our website(s) and/or application(s) can recognize them when they return and so that we may analyze traffic to our website(s) and/or use of our application(s). This non-personal information may be used by us to learn more about our customers’ preferences and web-related and/or application-related activities in order to better inform our marketing efforts. We will not provide this information to any third party except our service providers or affiliates, and we will only use such non-personal information in accordance with this Privacy Policy and applicable laws.

Third Party Websites

Our website(s) may contain links to other sites that we do not own or operate. Such links are provided as a convenience only; we do not endorse or exercise any control over such third party websites, and therefore have no responsibility or liability for the manner in which such third parties may collect, use, retain, protect and/or disclose Personal Information. Such third party websites have separate and independent privacy policies, notices and terms of use, which customers should read carefully. Except as specifically provided herein, we do not provide Personal Information to the owners or operators of such third party websites without consent.

Personal Information will not be sold to any organization for any purpose.
We will not disclose Personal Information to any third party without consent, except that we reserve the right to disclose Personal Information: (a) to any of our affiliates, subsidiaries, third party service providers or advisers that we deem appropriate; (b) if such disclosure is made pursuant to a legal proceeding or as required or permitted by law; or (c) to organizations involved in a merger, transfer or sale of our assets or business. In the event that we disclose Personal Information as set out above, we will require third party organizations who have access to such Personal Information to protect and maintain the Personal Information in compliance with the terms and conditions of this Privacy Policy.

Access and Update of Personal Information

Individuals may access and verify their Personal Information. At the time of any such request we will need specific information to verify the individual’s identity before we can provide them with the Personal Information we hold. In some instances, we will not be able to provide you the requested Personal Information, for instance where that information:

• Contains references to other persons
• Has already been destroyed due to legal requirements or because the information has served its purposes
• Cannot be disclosed for legal reasons (e.g. when subject to solicitorclient or litigation privilege)

If we are unable to provide an individual with access to their Personal Information, we will explain why and advise as to any recourse available to them.

Updating or Deleting Personal Information

We are committed to maintaining the accuracy of Personal Information. To help us keep Personal Information up-to-date we encourage our customers and employees to notify us of inaccuracies or corrections. Timely notification of a change of address, telephone number and/or email address helps us in providing our customers with the best possible service. In order for a customer to verify or update their Personal Information, please contact us via our Web Site at www.woodbine.com or telephone our call centre at (416) 675-8886. Employees who wish to verify or update their Personal Information should contact their People & Culture representative.

Customers may request deletion of certain Personal Information maintained by us, and we will use commercially reasonable efforts to honor such requests, but please note that we may be legally or otherwise required to keep such information and not delete it, or to keep such information and not disclose it (or to keep this information for a certain time, in which case we will comply with such deletion requests only after we have fulfilled such requirements). As an example, we may refuse access where providing the Personal Information would reveal confidential commercial information that cannot be redacted from the requested Personal Information. Where we do not provide access, we shall explain why. Deletion requests may be made by contacting us via our Web Site at www.woodbine.com.

We reserve the right to amend this Privacy Policy at any time. If we decide to amend this Privacy Policy, we will provide notice of such amended terms by posting the amended terms on this web site so that our customers and employees will always know what information we gather, how we might use that information, and whether we will disclose it to anyone. All amended terms shall be effective immediately upon such notice.

Employee Responsibilities and Privacy Rights

Employees are expected to:

• Protect Personal Information entrusted to them
• Access Personal Information only when authorized and required for their role
• Comply with all privacy, confidentiality, and information security requirements
• Report suspected privacy incidents promptly

We will investigate reported incidents and take appropriate corrective action. Employees who raise privacy concerns in good faith will not be subject to reprisal.

Contact Us

If you have any questions, concerns or complaints regarding the privacy of your Personal Information or this Privacy Policy, you may contact us at the address listed below. We will inform you of our complaint procedures and assist you in resolving the situation. If a complaint is

Please write or e-mail:
Chief Privacy Officer
Woodbine Entertainment Group
P.O. Box 156, 555 Rexdale Blvd
Toronto, Ontario M9W 5L2

privacy@woodbine.com

For more information on the Woodbine Entertainment Group’s commitment to privacy, contact the Woodbine Entertainment Group through our website: www.woodbine.com