Online casinos, those not on GamStop included, and the subject of instant withdrawal, form the material of wagerorbituk.com, which is written for readers in Great Britain; the personal data it handles goes no further than running an information site requires. Governed by the UK GDPR and the Data Protection Act 2018, the site meets the duty to inform under Article 13 of the UK GDPR by means of this policy.
What is processed
With each page opened, a log entry is written by the server: IP address, date and time, the address requested, the amount of data sent, the referring page and the type of browser. Security and the detection of abuse are what these logs serve, and after 90 days they are deleted or shortened so that they no longer point to a person. A name, an e-mail address and the text of the message are supplied by anyone writing to the editors, and these are used only to answer. Payment details and identity documents are not collected, since the site keeps no reader accounts, no deposits and no stakes.
Lawful bases and purposes
Keeping the site working and secure is the controller's legitimate interest, and server logs and protection against abuse rest upon it (Article 6(1)(f) UK GDPR). The same interest carries the answering of a message. For cookies other than the strictly necessary ones, and for audience measurement, consent is needed (Article 6(1)(a) UK GDPR together with regulation 6 of PECR), and these run only once it has been given; consent can be withdrawn at any time, which does not affect the lawfulness of earlier processing (Article 7(3)). No automated decision-making takes place and no profiling.
Controller
The body that runs wagerorbituk.com is the controller within the meaning of Article 4(7) UK GDPR. Its name, address and e-mail address are available at wagerorbituk.com, and through that same channel every question about personal data is put.
Recipients and transfers outside the UK
No sale of data takes place. Processors acting on the controller's instructions, which supply hosting, content delivery and e-mail (Article 28 UK GDPR), are the recipients, along with public authorities where the law requires it. Only to a country covered by adequacy regulations, or with appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum, does a transfer outside the United Kingdom take place (Article 44 onwards).
Rights
The right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on legitimate interests (Article 21) belong to every person. Without undue delay is how a request is answered, and within one month of receipt; where needed that period can be extended by a further two months under Article 12(3).
Retention
No longer than its purpose requires is any data kept: server logs for no more than 90 days, correspondence until the matter is closed and for the period needed to defend against possible claims. Data given in a message is voluntary, but without it no reply is possible.
Supervision and complaints
The Information Commissioner's Office (ICO) is the supervisory authority. A complaint to it (Article 77 UK GDPR) is the right of anyone who believes that the processing of their data breaches data protection law.
Last updated: 13.11.2026.