How BeGamblewareSlots collects, uses, and protects your personal data in accordance with UK data protection law.
Important: This privacy policy applies to personal data collected through begamblewareslots.org.uk and related services. It does not apply to third-party websites we link to.
Our data protection practices comply with UK data protection legislation
We comply with the UK General Data Protection Regulation as incorporated into UK law following Brexit. This provides comprehensive protection for personal data processed in the UK.
The Data Protection Act 2018 supplements UK GDPR, providing specific provisions for public interest processing and law enforcement. Our regulatory functions fall under Part 2 (General Processing) provisions.
BeGamblewareSlots is registered with the Information Commissioner's Office (ICO), the UK's independent data protection authority. Our registration number is ZB428749.
We collect only the personal data necessary to fulfil our regulatory functions
Information you provide when contacting us
| Data collected | Purpose | Legal basis | Retention |
|---|---|---|---|
|
General enquiries: Name, email, phone (optional), organisation (optional), message content |
Respond to enquiry, provide information about our services |
Public task UK GDPR Art. 6(1)(e) |
3 years |
|
Formal complaints: Name, email, phone, organisation, complaint details, reference number, supporting evidence |
Investigate and respond to complaints, maintain complaints records, escalate if necessary |
Legal obligation UK GDPR Art. 6(1)(c) |
7 years |
|
FOI requests: Name, email, postal address (optional), request details |
Process FOI request, respond within statutory timeframe |
Legal obligation FOI Act 2000 |
3 years |
|
Verification enquiries: Name, email, organisation/website, URL(s), enquiry type, details, current reference (optional) |
Process assessment requests, provide compliance guidance, manage appeals |
Public task UK GDPR Art. 6(1)(e) |
7 years |
|
Media enquiries: Name, email, outlet, phone, enquiry type, deadline, details, story context |
Respond to media requests, provide statements, coordinate interviews |
Legitimate interests UK GDPR Art. 6(1)(f) |
2 years |
Information collected during regulatory assessment activities
Processing necessary for performance of task carried out in public interest. Our regulatory oversight function established under Gambling Act 2005 framework.
Retained for regulatory and legal purposes. Longer retention may apply for ongoing investigations or legal proceedings.
Technical information collected automatically
Required for website functionality. No consent required under PECR Regulation 6(4).
Help us understand website usage and improve services. Requires consent under PECR Regulation 6(1).
Collected data: IP address (anonymized), browser type, device type, pages visited, time on site, referral source. Legal basis: Consent (UK GDPR Art. 6(1)(a)). You can withdraw consent anytime via cookie settings.
We share personal data only where necessary for our regulatory functions or required by law
We share assessment findings, non-compliant URL details, and supporting evidence with the Gambling Commission for enforcement consideration.
As our parent organisation, GambleAware receives operational reports and aggregated statistics. Personal data shared only where necessary for governance oversight.
We use trusted third-party service providers who process personal data on our behalf as data processors under written contracts.
We may disclose personal data where required by law, court order, or to comply with legal process, or where necessary to protect rights and safety.
All service providers processing personal data on our behalf are bound by written contracts requiring:
You have legal rights regarding your personal data. We will respond to requests within one month.
Request copy of personal data we hold about you (Subject Access Request).
Request correction of inaccurate or incomplete personal data.
Request deletion of personal data in certain circumstances (not absolute).
Request limitation on how we use your personal data in certain situations.
Receive personal data in structured, machine-readable format.
Object to processing based on legitimate interests or for direct marketing.
Some rights may not apply in all circumstances. We may refuse or restrict requests where:
We will explain any refusal and inform you of your right to complain to the ICO.
Identity verification: We may request additional information to verify your identity before processing requests. This protects against fraudulent requests.
We implement appropriate technical and organisational measures to protect personal data
In the event of a personal data breach, we follow documented procedures:
All personal data is stored and processed within the United Kingdom and European Economic Area. We do not transfer personal data to countries outside the UK/EEA.
Google Analytics: While Google LLC is US-based, we use IP anonymization and have configured data retention to UK/EU servers only. This complies with UK GDPR Article 46 safeguards.
We retain personal data only as long as necessary for the purposes collected
| Data category | Retention period | Legal basis for retention | Disposal method |
|---|---|---|---|
|
URL assessment records Assessment data, determinations, evidence, correspondence |
7 years from assessment date | Regulatory requirements, potential legal proceedings, audit trail | Secure deletion, documented destruction |
|
Formal complaints Complaint details, investigation records, outcomes |
7 years from resolution | Limitation Act 1980 (6 years), plus 1 year for administrative purposes | Secure deletion, documented destruction |
|
FOI requests Request details, responses, correspondence |
3 years from response | FOI Act 2000 record-keeping requirements, ICO guidance | Secure deletion |
|
General enquiries Contact form submissions, email correspondence |
3 years from last contact | Operational record-keeping, service improvement | Secure deletion |
|
Website analytics Anonymized usage data, IP addresses (hashed) |
26 months | Google Analytics default, ICO guidance on analytics retention | Automatic deletion by processor |
|
Media enquiries Press contacts, interview records, statements |
2 years from last contact | Operational purposes, ongoing media relations | Secure deletion |
|
Staff records Employment data, training records, access logs |
6 years after employment ends | Employment law, tax requirements (HMRC 6-year rule) | Secure shredding, secure deletion |
We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or service offerings. We will notify you of significant changes through:
We recommend reviewing this privacy policy periodically. Continued use of our services after changes constitutes acceptance of updated terms.
Questions about your personal data or how we process it? Contact our DPO.
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office.