Legal
Privacy policy
How we handle personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who is responsible for your data
The data controller is the publisher of Approved Gaming Guide, who can be contacted at [email protected].
2. Categories of data
- Contact form data: name, email address, subject and message. At present the form is only checked in your browser and is not sent to any server. This section will apply once submission is set up.
- Email correspondence: your email address and anything you choose to write to us.
- Device storage: your age confirmation and your cookie choice, stored in your browser's local storage (see section 4).
- Technical data: IP address, browser type and the pages requested. Our hosting provider may record these in server logs. Web fonts are served from our own website, so no font request goes to a third party.
- Analytics data: collected with Matomo only if you allow analytics in the cookie settings (see section 4).
- Marketing data: only if you consent and only once such a tool is installed. No marketing tool is currently active.
We do not ask for, and you should not send us, payment details, gambling account details or special category data such as health information.
3. Purposes and legal bases
| Purpose | Data | Legal basis (UK GDPR Art. 6) |
|---|---|---|
| Replying to your enquiry | Contact form and email data | Legitimate interests (6(1)(f)): answering the people who write to us |
| Remembering your age confirmation and privacy choice | Device storage | Legitimate interests (6(1)(f)). Under PECR the storage is strictly necessary for a service you requested. |
| Delivering and securing the website | Technical data | Legitimate interests (6(1)(f)) |
| Audience analytics (Matomo) | Analytics data | Consent (6(1)(a)) and PECR consent |
| Measuring referrals to operators (if introduced) | Marketing data | Consent (6(1)(a)) and PECR consent |
| Meeting legal obligations and handling legal claims | Any relevant data | Legal obligation (6(1)(c)) or legitimate interests (6(1)(f)) |
4. Cookies and local storage
We do not run optional analytics or marketing scripts until you give consent through the cookie banner. Details of every storage item, and how to change your choice, are in our cookie policy. You can reopen your settings at any time using “Cookie settings” in the footer.
5. Third parties
- Hosting provider: our hosting provider processes technical data to deliver the pages of this website to your browser.
- Email provider: Google Workspace (Google Ireland Limited), which processes the emails you send us.
- Analytics: Matomo, used only if you allow analytics in the cookie settings. Details are in the cookie policy.
- Web fonts: the Inter and Space Grotesk typefaces are stored on and served from this website. No third-party font service is used, so loading the fonts does not share your IP address with anyone else.
- Operator websites: when you follow a link to an operator, that operator (and any affiliate tracking provider it uses) processes your data under its own privacy policy. We do not pass your name or email address to operators.
Where data is transferred outside the UK, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement. Data held by Google Ireland Limited is covered by the UK adequacy regulations for the EEA; onward transfers to Google LLC in the United States rely on the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge).
6. Retention periods
- Contact-form messages and email correspondence: 12 months after our last response, unless we need them longer for a legal claim.
- Age confirmation and cookie choice in your browser: until you clear your browser storage. You can withdraw or change your cookie choice at any time.
- Server logs: kept by our hosting provider according to its settings.
7. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict or object to processing, including processing based on legitimate interests;
- data portability where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time, without affecting processing carried out before you withdrew it;
- complain to the Information Commissioner's Office (ico.org.uk (opens in a new tab)). We would appreciate the chance to resolve your concern first.
We will respond to a rights request within one month. In some cases the law allows us to extend this.
8. Legal requirements and voluntary practice
| Measure | Status |
|---|---|
| Privacy information (this notice), lawful basis, data subject rights | Legal requirement (UK GDPR) |
| Prior consent for non-essential cookies and similar storage | Legal requirement (PECR) |
| Appointing a Data Protection Officer | No Data Protection Officer has been appointed. A DPO is mandatory only in the cases listed in UK GDPR Article 37. |
| Blocking all optional scripts until consent and showing equal “Accept” and “Reject” buttons | Our practice, in line with ICO guidance |
| A named privacy contact address | Voluntary practice |
9. Data protection contact
No Data Protection Officer has been appointed. For privacy questions or to exercise your rights, please contact us:
Email: [email protected] (this address will work once the mailbox has been set up)You can also use the contact form and choose “Privacy or data request”.