WinPlace UK privacy policy
Last updated: 15/06/2026
At WinPlace we take the protection of your personal data seriously. This privacy policy explains what information we collect, how we use it, how long we keep it and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The policy applies to the /uk/ section of winplace1.org and is written for visitors aged 18 or over.
Last updated 15/06/2026. We may revise this policy from time to time to reflect changes in the law or how we operate. Any material change will be announced on this page, and the "last updated" date above will be refreshed.
Who we are
WinPlace is an informational website providing reviews, bonus information and comparisons about online casinos. We are not a gambling operator and do not offer gambling services directly. Our website contains affiliate links to external operators that hold their own licences from the UK Gambling Commission and other regulators.
What data we collect
When you visit our site we automatically collect limited technical information such as your IP address, approximate location (city level), browser type, operating system, device type, pages visited, referrer URL and visit duration. This data is processed in an aggregated and pseudonymised form and is used only to improve the website and detect abuse.
If you contact us through the help page, we also process the personal data you provide in your message (such as your name, email address and the content of your enquiry). We use this only to reply to you and resolve your query.
We use cookies and similar technologies, described in full in our cookie policy. Non-essential cookies are loaded only after you give consent through the cookie banner.
Legal bases for processing
Under UK GDPR we rely on the following lawful bases: legitimate interest for site analytics and fraud prevention; consent for non-essential cookies and analytics that involve detailed profiling; and legal obligation for any data we must keep to comply with UK law, including financial and anti-money laundering rules where they apply to our affiliate activity.
How long we keep data
Server logs are retained for up to 90 days. Aggregated analytics data is retained for up to 26 months. Email correspondence is kept for up to 24 months after the matter is closed, unless a longer period is required for legal reasons. Cookie data is retained for the period stated in the cookie policy.
Sharing your data
We do not sell personal data. We share limited data with carefully selected processors who help us operate the website (for example hosting, analytics and email delivery providers). Every processor is bound by a written contract that meets the standards of UK GDPR and processes data only on our instructions.
Where data is transferred outside the UK, we rely on adequacy decisions or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, plus appropriate technical safeguards such as encryption.
Your rights under UK GDPR
You have the right to access, correct, delete or restrict processing of your personal data, the right to object to processing based on legitimate interest, the right to data portability, and the right to withdraw consent at any time where processing is based on consent. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
You can lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled in breach of UK law. We would, however, appreciate the chance to address your concerns first, so please contact us before lodging a complaint where possible.
Security
We protect personal data with appropriate technical and organisational measures, including TLS encryption in transit, access controls, regular software updates and least-privilege principles for staff and contractors. No system can be fully secure, but we keep our practices under continuous review.
Children
Our website is intended for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided data to us, please contact us and we will delete it without delay.
International transfers
Some of the providers we rely on operate servers outside the United Kingdom, mostly within the European Economic Area and the United States. When personal data leaves the UK, we use the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or an applicable adequacy decision to keep your data protected to UK standards. We carry out a transfer risk assessment for every new provider before any data is shared.
Automated decisions and profiling
We do not make any decisions about you using fully automated processing, and we do not run profiling that produces legal or similarly significant effects. Analytics tools may group visitors into broad behavioural categories (for example "returning visitor") but these groupings are not used to single you out or to change the content you see in any material way.
Marketing communications
WinPlace does not currently send marketing emails or SMS messages to UK visitors. If we introduce a UK newsletter in the future, it will be strictly opt-in, with a clear unsubscribe link in every message and the ability to manage your preferences at any time. We never share your contact details with operators for marketing purposes.
Data breaches
We take the security of personal data extremely seriously. In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours, in line with Article 33 of the UK GDPR. Where the risk is high, we will also notify affected individuals directly without undue delay.
Safer gambling and your data
Some of the support resources we link to, including GamStop, GamCare on 0808 8020 133 and BeGambleAware.org, are independent organisations with their own privacy policies. When you follow a link from this site to one of these resources, the way they process your personal data is governed by their own notice, not ours. We recommend reading the privacy policy of any service before you submit personal information.
How to exercise your rights
To make a subject access request, ask for correction or deletion of data, restrict processing, withdraw consent or receive a copy of your data in a portable format, send a written request via the help page. Include enough information for us to identify you (full name, email used when contacting us, approximate date of any correspondence). We may ask for a single proof of identity to make sure we are sharing data with the right person. There is no fee for the first request and we aim to respond within one calendar month.
If you are not satisfied with our response, you can escalate the matter to the Information Commissioner's Office. The ICO is the UK's independent regulator for data protection and operates a free helpline on 0303 123 1113.
Contact
For privacy questions or to exercise your rights, contact us via the help page. We aim to respond to every request within one calendar month, in line with UK GDPR. If a request is particularly complex or you make several requests, we may extend the response window by up to two further months and will always let you know in writing if that is the case, along with a clear reason for the extension.