Both sides of the market this site describes — casinos holding a Great Britain licence and those operating without one, outside GamStop — reach readers in Great Britain through a site that gathers no more personal data than running an information service demands. Handling of that data is governed by the UK GDPR and the Data Protection Act 2018, and the notice below discharges the duty to inform set by Article 13 of the UK GDPR.
Who answers for the data
The body behind playinsideruk.com is the controller in the sense of Article 4(7) UK GDPR. Name, address and e-mail address for reaching it are published at playinsideruk.com; a question about personal data goes by the same route.
What the server and the mailbox record
A page request leaves a record on the server, covering the IP address, the moment of access, which address was asked for, how much data went back, where the visitor came from and which browser was used. Security and the spotting of abuse are what those records are for; once 90 days have gone by they are erased or trimmed until they identify nobody. Correspondence with the editorial desk carries three things in addition — the sender's name, an e-mail address and the text written — and they are put to no other use than replying. Because the site keeps no accounts for readers, holds no deposits and accepts no stakes, no payment details and no identity documents ever arrive.
Why the processing is allowed
Legitimate interests of the controller — keeping the site available and safe — carry the server records and the defence against abuse, under Article 6(1)(f) UK GDPR; the same interest covers a reply to a message. Everything else, meaning every cookie beyond the strictly necessary ones and any measurement of audience, waits for consent, taken under Article 6(1)(a) UK GDPR read together with regulation 6 of PECR, and runs only after it has been given. Consent can be taken back whenever the reader wishes; lawfulness of what happened before is untouched (Article 7(3)). Neither automated decision-making nor profiling takes place.
How long data stays
Nothing is held beyond what its purpose needs. Server records go after no more than 90 days; a correspondence file stays open until the matter is settled and then for as long as a possible claim would need it. Data may be left out of a message, but no answer can then be written.
Who else sees the data, and where it may travel
None of it is sold. Processors work on the controller's instructions — hosting, content delivery and e-mail are theirs (Article 28 UK GDPR) — and public authorities receive data where the law obliges it. Sending data abroad happens only towards a country covered by adequacy regulations or under appropriate safeguards, among them the International Data Transfer Agreement and the UK Addendum (Article 44 onwards).
What a person may demand
Access to the data (Article 15), correction of it (Article 16), its deletion (Article 17), a pause on its use (Article 18), a portable copy (Article 20) and an objection to processing resting on legitimate interests (Article 21) all belong to every person. A request meets an answer without undue delay and no later than a month after it arrives; Article 12(3) allows that month to be stretched by two further months where the case calls for it.
Where a complaint goes
The Information Commissioner's Office (ICO) acts as the supervisory authority. Should someone hold the view that their data has been handled contrary to data protection law, Article 77 UK GDPR gives them the right to complain there.
Last updated: 13.11.2026.