A Manitoba player asked TonyBet to delete the personal data tied to his account under PIPEDA, Canada’s federal private-sector privacy law. The request was processed, the account data was purged, and a C$400 bonus credit that should have followed his WELCOME2026 entry never arrived. When he contacted support, the agent could see a deposit but could not find the promo field entry, the tracking tag, or any record linking the two. This case study walks through what happened, why the audit trail vanished, and how to protect your own bonus history when you file a privacy request.
What the deletion request actually removed from the account record
PIPEDA gives individuals the right to request access to and correction of personal information held by a commercial organization, and it obliges the organization to destroy data that is no longer needed for the purpose it was collected. Operators treat promo field entries, tracking tags, and bonus-claim timestamps as personal information because each one is tied to an identifiable player. When a deletion request is honoured in full, those records go with everything else.
In this case the player had claimed the first tier of the TonyBet welcome package, which is up to C$2,500 plus 225 free spins across multiple deposits and requires a minimum deposit of C$20 per tier. He entered WELCOME2026 in the cashier deposit field on a Friday, deposited C$40, and expected a matched bonus within the standard processing window. On the Monday he filed a deletion request through the site’s privacy contact, apparently to wipe marketing consent records he no longer wanted. The operator’s privacy team processed it against the whole account profile rather than a scoped subset.
Three data points disappeared together: the promo field entry, the tracking tag that attributed the deposit to the code, and the timestamp that proved the entry preceded the deposit. The deposit transaction itself survived in the payment ledger because financial records are retained for anti-money-laundering and tax obligations, and those retention duties override a deletion request under PIPEDA. That split is what created the problem. Support could see money arrive but had nothing to connect it to a bonus claim.
Why support could not manually re-credit the bonus
The agent’s first move was the obvious one: look up the account, find the deposit, and issue a manual credit as a goodwill gesture. That path closed almost immediately. Bonus systems do not pay out on deposits alone; they pay out on deposits that carry a valid promo field entry with a matching tracking tag. Without the tag, the system cannot distinguish a genuine WELCOME2026 claim from a player who deposited normally and then asked for a bonus after the fact. Manual overrides exist, but they require evidence, and the evidence had been lawfully destroyed at the player’s own request.
What the audit trail normally proves and why its absence is final
A working audit trail answers four questions in sequence: did the player enter the code before depositing, did the qualifying deposit meet the C$20 minimum for that tier, was the claim made within the eligibility window, and had the player already claimed that tier. Each answer lives in a separate record. Remove the promo field entry and the tracking tag, and the first and third questions become unanswerable. The operator cannot reconstruct them from the payment ledger, and rebuilding them from memory or from the player’s screenshots would not satisfy an internal audit or a provincial regulator.
There is a second constraint the player did not anticipate. The promo code does not bypass minimum deposit limits or house wagering rules, and it does not create an entitlement independent of the claim process, as explained at https://tonybet-casino-online.ca/promo-code/. WELCOME2026 is a tag that tells the system which offer to apply; without the tag, there is no offer to apply. Support explained this in writing, and the file was closed with the deposit intact and the bonus forfeited. The player’s money was never at risk. Only the bonus was lost.
The operator’s position was defensible but not comfortable. A scoped deletion, limited to marketing preferences and email consent, would have removed what the player actually objected to and left the bonus records untouched. The privacy team processed what was asked, and the request was broad. Players filing under PIPEDA should treat the wording of the request as the single most important decision in the process.
How to file a privacy request without destroying your bonus history
Before you send anything, pull a copy of your account statement and screenshot the cashier page showing any active promo field entry, the deposit confirmation, and the bonus status. Store those outside the operator’s systems. They are not a substitute for the operator’s own audit trail, but they give you a factual basis for a complaint if something goes wrong.
Then scope the request in writing. Say explicitly which data you want deleted and which you want retained. A practical structure looks like this:
- Request deletion of marketing consent records, email lists, and advertising identifiers only.
- State that you want transaction history, bonus claim records, promo field entries, and tracking tags retained for the duration of any active welcome offer and its wagering period.
- Ask the operator to confirm in writing which categories of data fall outside the deletion because of legal retention duties.
- Wait until all tiers of a multi-deposit bonus are claimed and wagering is complete before filing any deletion request that touches account data.
- Keep the operator’s confirmation email and your own screenshots for at least twelve months.
Timing matters as much as wording. File after the bonus cycle closes, not during it. If you must file during an active offer, ask the operator to freeze the request until the offer resolves. Most privacy teams will agree, because a deferred request is easier to defend than a disputed bonus.
Jurisdiction changes the ground rules slightly. TonyBet Ontario operates at tonybet.ca under provincial oversight from the Alcohol and Gaming Commission of Ontario, and it does not advertise welcome packages to Ontario players, so Ontario residents are not chasing this particular bonus anyway. TonyBet OÜ operates the main site for players outside Ontario, and that is the entity a Manitoba player deals with. Age rules also split: players in Alberta, Manitoba, and Quebec must be at least 18 years old, while players in the rest of Canada must be at least 19. None of these differences change how PIPEDA applies, but they change which regulator hears a complaint and which internal team handles the file.
One more habit worth building: after any deposit where you used a promo field entry, check the bonus status within 24 hours and screenshot it. If the credit has not landed, contact support before filing anything else. A live ticket with a timestamp is far stronger evidence than a reconstructed timeline, and it survives a later deletion request because the ticket sits in the support system rather than the player profile.
The Manitoba case ends with a straightforward lesson. A privacy request is a legal instrument, not a settings toggle, and it can erase the records that prove you earned something. Decide what you want deleted, say so in writing, keep your own copies of the key evidence, and file only after the bonus cycle is finished. If you are working through the WELCOME2026 offer at tonybet-casino-online.ca or anywhere else, read the retention language in the operator’s privacy policy before you send a deletion request, and ask support to confirm which records will remain. Ten minutes of scoping beats a closed ticket and a forfeited bonus.