Describing casinos that sit outside GamStop, and the timing of the payouts they make, for readers in Great Britain takes no more personal data than the running of an information site requires, and no more than that is processed here. The UK GDPR and the Data Protection Act 2018 are the rules with effect. The duty to inform under Article 13 of the UK GDPR is met by this policy.
Controller
The body running wagerpointuk.com is the controller within the meaning of Article 4(7) UK GDPR. Name, address and e-mail address are available at wagerpointuk.com, and that same channel serves for every question touching personal data.
What is processed
A log entry is recorded by the server on each page opening: IP address, the date and time, the address requested, the volume of data sent, the referring page, and the browser type. Security and the detection of abuse are what the logs are for, and at 90 days they are either deleted or shortened so that no person can be identified through them. A name, an e-mail address and the text of the message are also supplied by anyone writing to the editors, and answering is the only use made of them. Reader accounts, deposits and stakes do not exist on this site, which is why identity documents and payment details are never collected.
Lawful bases and purposes
The controller's legitimate interests in keeping the site operational and secure (Article 6(1)(f) UK GDPR) are what server logs and protection against abuse rest on, and answering a message rests on the same interest. For cookies beyond the strictly necessary ones, and for audience measurement, consent is required (Article 6(1)(a) UK GDPR read with regulation 6 of PECR) and applies only after it has been given; withdrawal is possible at any time and leaves the lawfulness of earlier processing unaffected (Article 7(3)). Automated decision-making there is none, and profiling there is none.
Recipients and transfers outside the UK
No sale of data takes place. Processors acting on the controller's instructions — those providing hosting, content delivery and e-mail (Article 28 UK GDPR) — are the recipients, along with public authorities where the law demands it. A transfer outside the United Kingdom happens only to a country covered by adequacy regulations or under appropriate safeguards, the International Data Transfer Agreement or the UK Addendum among them (Article 44 onwards).
Rights
Access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing founded on legitimate interests (Article 21) are the rights belonging to every person. Without undue delay, and within one month of receipt, a request is answered; a further two months may be added to that period where necessary under Article 12(3).
Retention
No longer than its purpose demands is data kept: server logs for 90 days at most, and correspondence until the matter is closed and for the period needed to defend against possible claims. Data given in a message is given voluntarily, though a reply becomes impossible without it.
Supervision and complaints
The Information Commissioner's Office (ICO) is the supervisory authority. The right to complain to it (Article 77 UK GDPR) belongs to anyone believing that the processing of their data breaches data protection law.
Last updated: 13.11.2026.