How we use data
We use the data we collect to run the site, understand which pages are useful, and respond to messages. We do not sell reader data to third parties, we do not share it with the operator, and we do not build advertising profiles against individual readers. Server logs are kept to spot abuse, fix bugs and meet our legal obligations under UK GDPR; analytics data is aggregated before it reaches any dashboard the editorial team sees.
Nothing on this site tracks a visitor across other websites. We do not use fingerprinting, we do not use third-party advertising SDKs, and we do not operate a login system — there is no account to compromise because there is no account to create.
What we collect
Three categories of data pass through this site. First, the normal server access log that every website produces: your IP address, the time of the request, the page you asked for, your browser's user-agent string and the referring page if your browser sent one. Second, anonymous analytics on page views and scroll depth, aggregated by the hour and never tied to an IP. Third, anything you include in an email to us, which stays in our inbox and is used only to answer you.
Third parties
A short list of named processors handles narrow technical tasks: a UK or EU hosting provider for the website itself, a content delivery network that caches images and CSS near your location, an analytics tool that runs in aggregate mode, and an email provider for correspondence. Each processor has signed a UK GDPR data processing agreement with us. Full names and locations are listed in our processor register; email us if you need the current copy.
Retention
Access logs are deleted after 30 days unless a security incident needs them for longer. Aggregated analytics is kept for 14 months to compare year-on-year trends and then rolled up into totals that cannot be traced to an individual. Emails are kept for as long as the correspondence is active and then archived or deleted; if you want your email thread removed, say so in a reply and we will purge it within one working week.
Changes to this policy
If we change what data we collect, who processes it or how long we keep it, this page is updated and the 'Updated' date at the top of the page changes with it. Material changes — a new processor, a new category of data, a different retention window — are also mentioned on the home page for at least two weeks. We do not retroactively broaden the use of data already collected: previously collected data stays under the policy that applied when we received it.
International transfers
Data normally stays in the United Kingdom or the European Economic Area. The only routine transfer out is the content delivery network cache, which may store a compressed copy of a static page in a region close to your browser; that cache contains no personal data because the pages themselves do not. If any future processor sits outside the UK/EEA we will rely on the UK International Data Transfer Agreement and update the processor register before the transfer begins.
You have the full set of UK GDPR rights over data we hold about you: access, correction, erasure, portability, objection and restriction. Send a plain-text email to the address on the Contact page and we will reply within one calendar month, usually sooner. We do not charge a fee for ordinary requests. If you are not satisfied with how we handled your request you can complain to the Information Commissioner's Office at ico.org.uk — the ICO is the independent UK regulator for data protection matters and its complaint form takes about ten minutes to fill in.
Finally, a word on children. This site is written for adults, specifically readers aged 18 or over who are considering a licensed UK gambling product. We do not knowingly collect data about anyone under 18. If you believe a child has sent us an email, let us know and we will delete the thread without reading further.