Privacy Policy

1. Introduction

This Privacy Policy explains how Best Online Casino UK (“we”, “us”, “our”) collects, uses, discloses, and protects information about you when you visit or use any of the services offered on it. We are the controller of the personal data described in this policy for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Best Online Casino UK is an independent editorial and review website. We are not a gambling operator: we do not accept deposits, hold player funds, run games, or perform identity verification (KYC). If you follow a link from our site to a casino or a sportsbook and then create an account there, that operator becomes the controller of your data at that point, and its own privacy policy applies. Read the operator’s policy before signing up.

2. Scope

This policy applies to personal data we collect through , its subdomains, and any related communications (for example email newsletters or replies to your enquiries). It does not apply to third-party websites we link to, and it does not apply to any data you provide directly to a casino, sportsbook, payment provider, or other operator you visit through our links.

3. What personal data we collect

We collect the following categories of personal data. We deliberately keep this list short because we do not need much data to run a review site.

4. How we use your data

We use personal data for the following purposes, and for no other purposes:

• To reply to your enquiries and to handle correction, complaint, and data-protection requests.
• To send our email newsletter to people who have subscribed, and to allow them to unsubscribe at any time.
• To operate, maintain, and improve the site — including debugging errors, preventing abuse, and measuring how our content is used at an aggregate level.
• To protect the site and its users against fraud, spam, security attacks, and misuse.
• To comply with our legal obligations, including responding to lawful requests from public authorities.

5. Legal bases for processing (UK GDPR)

We only process personal data where we have a lawful basis to do so. The bases we rely on are:

• Consent — for our email newsletter and for non-essential cookies. You can withdraw consent at any time.
• Legitimate interests — for running and improving the site, handling correspondence you initiate with us, aggregated analytics, and security. Where we rely on legitimate interests, we balance them against your rights and freedoms; you can object at any time (see “Your rights”).
• Legal obligation — where we must retain records or respond to lawful authority requests.
• Performance of a contract — very limited, for example when we enter into a written partnership contract with an operator or agency.

6. Sharing and disclosure

We do not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary:

• Service providers we rely on to run the site — hosting, email delivery, analytics, customer-support tooling, and security services. These providers act as processors on our instructions and are bound by written contracts.
• Advertising and affiliate networks — where required to attribute a referral or a conversion (usually via cookie-based identifiers rather than named data).
• Professional advisers — accountants and lawyers, where confidentiality applies.
• Public authorities, courts, and law-enforcement bodies — where we are legally required or permitted to share information.
• A successor or acquirer — if the site is transferred, merged, or acquired, the buyer becomes bound by this policy for the personal data it receives.

When you click through from our site to an operator (for example a casino review that links to that casino), we do not transfer your personal data to that operator. The operator sees only what your own browser and its own tracking give it. Its own privacy policy will govern anything you go on to do there.

7. International data transfers

Some of our service providers are based outside the United Kingdom, including in the European Economic Area and, in some cases, the United States. Where personal data is transferred to a country that has not been given an adequacy decision by the UK, we rely on appropriate safeguards — most often the UK Addendum to the EU Standard Contractual Clauses, combined with a transfer risk assessment. You can ask us for a copy of the safeguards in place for any specific transfer.

8. Data retention

We keep personal data only for as long as we need it. Typical retention periods:

• Contact form and email correspondence: up to 24 months after the last message, then deleted or anonymised.
• Newsletter subscribers: for as long as the subscription is active, plus a short archival period after unsubscribe to prove that the unsubscribe was actioned.
• Data subject request records: up to 3 years, to demonstrate compliance if challenged.
• Server logs and technical data: typically 30–90 days, longer only where needed for security investigations.
• Analytics data at an individual level: up to 14 months. Aggregated, non-identifying statistics may be kept indefinitely.

9. Your rights under UK GDPR

Where UK GDPR applies to you, you have the following rights over your personal data:

• The right to be informed — this policy is part of how we meet that duty.
• The right of access — to receive a copy of the personal data we hold about you.
• The right to rectification — to have inaccurate or incomplete data corrected.
• The right to erasure — to have personal data deleted, subject to certain exceptions.
• The right to restrict processing — to have processing limited in specific circumstances.
• The right to data portability — where processing is based on consent or contract and carried out by automated means.
• The right to object — to processing based on legitimate interests, including for direct marketing.
• The right to withdraw consent — at any time, where processing is based on consent.
• The right not to be subject to solely automated decision-making that produces legal or similarly significant effects — we do not carry out such decision-making.
• The right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

To exercise any of these rights, email us at [email protected]. We aim to acknowledge requests within 3 business days and to respond in full within the timescales required by UK GDPR (usually within one month, extendable by up to two further months for complex requests).

10. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• The right to know what personal information we collect, use, disclose, and (if applicable) sell or share.
• The right to delete personal information, subject to certain exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of personal information. We do not sell your personal information for money, and to the extent that our advertising and affiliate cookies could be considered “sharing” under CCPA, you can opt out through the cookie banner or your browser’s Global Privacy Control (GPC) signal.
• The right to limit the use of sensitive personal information — we do not collect sensitive categories in the CCPA sense.
• The right not to be discriminated against for exercising these rights.

To exercise a CCPA/CPRA right, email [email protected] with “California request” in the subject line.

11. Cookies

We use cookies and similar technologies for essential site functions, for measuring how our content is used, and for advertising and affiliate attribution. You can accept, reject, or configure non-essential cookies through the cookie banner shown when you first visit the site, and you can change your choices at any time from the cookie settings link in our footer. For a full breakdown of the cookies we use, please see our Cookies Policy.

12. Security

We take reasonable organisational and technical measures to protect the personal data we process. These include HTTPS across the site, access controls on our systems, encrypted backups, monitoring for suspicious activity, and vendor due diligence on the service providers we use. No internet service is entirely secure; if we ever suffer a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours and, where required, notify you directly.

13. Children

Our content is intended for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe we have collected personal data from a person under 18, please contact [email protected] and we will delete it.

14. Responsible gambling

Because our site is about gambling, we consider safer-play information a part of protecting you. Please see our Responsible Gambling page for information about problem-gambling warning signs, player-control tools, and independent support organisations such as GamCare, BeGambleAware, and GAMSTOP.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of the page. For material changes — for example a new category of data collected, or a new legal basis — we will highlight the change on the site and, where you have subscribed to communications, notify you by email before the change takes effect.

16. Contact

For any question or request about this Privacy Policy or about how we handle your personal data, please write to [email protected]. For general enquiries you can also reach the editorial team at [email protected] or use the contact form on the site. Postal correspondence should be addressed to the editorial team, Best Online Casino UK, willowandpepperpot.co.uk.