ukplaynotes.com reports on payout speed and withdrawal conditions at online casinos, those outside GamStop included, and keeps its handling of personal data to the minimum an information site needs. Rules here are the UK GDPR and the Data Protection Act 2018, and this page carries the information Article 13 of the UK GDPR requires.
Controller
The body running ukplaynotes.com is the controller within the meaning of Article 4(7) UK GDPR. ukplaynotes.com holds its name, its address and its e-mail address, and every question about personal data goes through that same channel.
What is processed
Opening a page leaves a server log: IP address, date and time, the address requested, the amount of data sent, the referring page and the browser type. Such logs stand behind security and the spotting of abuse, and 90 days later they are erased or truncated so that nobody can be identified from them. A message to the editors carries a name, an e-mail address and the text itself, used for the answer alone. Payment details and identity documents are never gathered, because this site keeps no reader accounts and takes no deposits or stakes.
Purposes and lawful bases
Keeping the site running and secure is a legitimate interest of the controller, and the server logs and abuse protection rest on it (Article 6(1)(f) UK GDPR); answering a message rests on the same ground. For cookies beyond the strictly necessary ones, and for audience measurement, consent is the basis (Article 6(1)(a) UK GDPR together with regulation 6 of PECR), and nothing of the kind runs before it is given. Withdrawal is possible at any moment and leaves the lawfulness of what came earlier untouched (Article 7(3)). Profiling and automated decision-making do not take place.
Recipients and transfers outside the UK
Nothing is sold. Those who receive data are processors working to the controller's instructions — hosting, content delivery and e-mail (Article 28 UK GDPR) — plus public authorities where the law demands it. Data leaves the United Kingdom only for a country with adequacy regulations, or under appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum (Article 44 onwards).
Retention
Nothing is held longer than its purpose needs: correspondence until a matter ends and for as long as possible claims must be defended, and server logs for 90 days at most. A message may be left unsent without consequence, though no reply can follow without it.
Rights
Access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing that rests on legitimate interests (Article 21) belong to every person. One month from receipt is the deadline for an answer, given without undue delay, and Article 12(3) allows a further two months where the case requires it.
Supervision and complaints
The Information Commissioner's Office (ICO) is the supervisory authority. Where processing is believed to break data protection law, Article 77 UK GDPR gives the right to complain to that body.
Last updated: 13.11.2026.