We collect the minimum needed to run the site and answer your emails. Server access logs record your IP address, the page you requested, the referring page, and the user-agent string of your browser, together with the response status code and the number of bytes served. These are the same fields that any web server records by default; we do not enrich them with additional identifiers. If you email us, we keep the email and any attachments in our support inbox, with the standard headers your mail client adds automatically — including the sending mail server and the delivery timestamps. If you click through to the operator's site, an anonymous click identifier is passed so the commission for that visit can be attributed correctly — we do not receive your name, your address, your date of birth or any information about the bets you place at the operator. The site does not embed social widgets, does not ask you to sign in, and does not run any form on which you could volunteer personal data. If a specific page in the future needs to collect anything — a comment box, a reader survey — it will be disclosed on that page, with the categories of data listed, and this section will be updated the same day.
Access logs are read to diagnose problems: a page that returns errors, a spike in requests from a single IP address, an image that fails to load on a specific browser, an attempt to probe the site for known vulnerabilities. They are also used to compile aggregate traffic statistics — how many people opened a given page in a given week, which pages are most read, which browsers our readers use, roughly which country the traffic came from at the level of a two-letter ISO code. These aggregates are not linked back to individual IP addresses and are not shared outside the editorial team. Emails are read only by the editorial team member handling your request, and any personal data in them is kept only for as long as the request is open, plus the statutory retention period for correspondence with third parties (six years for tax-relevant correspondence, shorter for everything else). Click identifiers are used solely to reconcile commission with the operator at month-end and are not used to build any profile of your reading habits. We do not sell, rent or share personal data with third parties for advertising purposes, and we do not run any automated decision-making that produces legal or similarly significant effects for readers.
This notice is dated at the bottom of the page. If we change how the site handles personal data, the new date will appear here and the change itself will be described in a short changelog under the last section, with the specific paragraph or sentence that changed. Material changes — new categories of data collected, new recipients of the data, or a change in retention that affects readers already on the site — are additionally announced on the home page for two weeks so returning visitors can see them; the announcement links back to this page. If the change is one that legally requires fresh consent (for example, a new advertising cookie or a new third-party analytics tag), the change will be preceded by an in-page banner asking for that consent before the new behaviour begins on your device. You can always ask us for the previous version of this notice by writing to the privacy inbox — versions are kept indefinitely on our side.
The site is served from Cloudflare, which processes request headers on our behalf as a data processor under a standard data processing agreement; Cloudflare terminates TLS at its edge, applies bot protection, and passes the request on to the origin. Cloudflare's own privacy notice governs what it does at the edge with the same request headers. Email is delivered through our mailbox provider, which also acts as a processor under a data processing agreement and stores messages in a region within the United Kingdom or the European Economic Area. Outgoing clicks reach Gambajack, and once you are on the operator's site their own privacy notice applies — not ours; the operator is a separate controller for the data you provide to them, including your account, your deposits and your gameplay. We do not use Google Analytics, Meta pixels, TikTok pixels or any comparable third-party analytics tag on the pages, and we do not run remarketing tags of any kind. If a specific page ever needs to embed a third-party widget for an editorial reason (for example, an official video from a regulator), it will be disclosed on that page, with the option to skip the widget and read a plain-text summary in its place. Under UK GDPR you have the right to request a copy of the personal data we hold about you, to correct it, or to ask us to delete it — write to the privacy inbox listed on the Contact page and we will answer within one calendar month of receiving the request. If you are unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.