How we handle your data, in plain English.

Who we are

NewSlot.co.uk ("we", "us") is the data controller for any personal data processed through the site. Editorial decisions are made by the named team listed at /about/team/. Privacy questions, access requests, and complaints go to privacy@newslot.co.uk.

What we collect

We split this by what triggers the collection.

• Newsletter sign-up. Your email address, the moment you submit it, and a timestamp recording when you opted in. Stored in our Directus database. Used only to send the Sunday digest and to evidence consent if challenged.
• Site engagement (cookieless). When you press Play on a demo, our server records anonymous engagement time. No cookies. No localStorage identifiers. The full mechanism, including opt-outs, lives at /about/popular-signal/.
• Request logs. Standard web-server logs (IP address, user-agent string, requested URL, timestamp) are processed briefly for rate-limiting and abuse detection. IPs are dropped from the active log within 24 hours unless we are actively investigating an incident.

What we don't collect

• No reader accounts. We don't ask you to register.
• No first-party tracking cookies. None. See /about/cookies/ for the full picture, including third-party iframes.
• No marketing cookies, conversion pixels, advertising IDs, retargeting tags, or cross-site identifiers.
• No personalised content. Every reader sees the same homepage, the same review pages, the same recommendations.
• No analytics platform. No Google Analytics, no Plausible, no Fathom, no Mixpanel.
• No fingerprinting, no device-graph stitching, no behavioural profile.

Why we collect it and our lawful basis

UK GDPR requires us to name a lawful basis for every processing purpose. Here are ours.

• Sending the newsletter. Lawful basis is your consent (UK GDPR Article 6(1)(a)). You give it by entering your email and pressing Subscribe. You can withdraw it any time via the unsubscribe link in every newsletter, or by emailing privacy@newslot.co.uk.
• Running the site and keeping it secure. Lawful basis is our legitimate interests (Article 6(1)(f)) in operating the service and preventing abuse. The interest is minimal, the data is short-lived, and you would reasonably expect a website to do this.
• Counting anonymous engagement minutes. The values we store are not personal data once the IP is dropped. While the IP is still active for rate-limiting, the lawful basis is legitimate interests as above.
• Responding to legal requests. Lawful basis is legal obligation (Article 6(1)(c)) when we have to. Otherwise we don't share data with anyone.

Who we share it with

Short list. Each is a processor acting on our instructions or a third party you choose to interact with.

• Cloudflare hosts the site and the edge functions that handle the newsletter form. Cloudflare processes request metadata as part of delivering the page.
• Directus stores the newsletter subscriber list. The instance runs on infrastructure we control.
• SlotsLaunch serves the demo-game iframe embedded on every review page. When you load a review, your browser makes a request directly to slotslaunch.com. They are an independent data controller for any data they process. Their privacy notice lives at slotslaunch.com/privacy-policy. We do not share your email or any other personal data with them.
• Linked operators. When you click a link to a UKGC-licensed casino, your browser goes to their site. We send no personal data with the click. Their privacy notice applies once you arrive.

How long we keep it

• Newsletter email + consent timestamp. Kept while you remain subscribed. If you unsubscribe, your email moves to a suppression list so we don't accidentally re-add you. The suppression record is kept for up to six years to evidence the original consent and the unsubscribe event, then deleted.
• Anonymous engagement minutes. Aggregated indefinitely because they are no longer personal data once the IP is dropped.
• Request logs. Within 24 hours, the IP is removed and only anonymised aggregates survive. Active investigation of an incident may extend that briefly.

International transfers

Cloudflare and SlotsLaunch may process data outside the UK and EEA, including in the United States. Cloudflare is certified under the UK Extension to the EU-US Data Privacy Framework. SlotsLaunch operates under its own transfer arrangements documented in its privacy notice. Our own database (Directus) runs on UK-located infrastructure.

Your rights

Under UK GDPR you have the right to:

• Ask for a copy of any personal data we hold about you.
• Ask us to correct anything wrong.
• Ask us to delete your data, where the lawful basis no longer applies.
• Withdraw consent to the newsletter at any time, with no questions asked, via the unsubscribe link or email.
• Object to processing carried out under legitimate interests.
• Take your subscriber email to a different service (data portability).
• Complain to the Information Commissioner's Office at ico.org.uk/concerns/.

To exercise any of these, email privacy@newslot.co.uk. We respond within one calendar month and usually much faster. We may ask you to confirm the email address you used to subscribe so we can identify your record without storing more data than necessary.

Children

NewSlot.co.uk publishes coverage of real-money gambling products. Real-money gambling is restricted to over-18s in the UK. The site is not directed at children and we do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has subscribed to the newsletter, email privacy@newslot.co.uk and we will remove the record immediately.

Automated decisions

We do not use your personal data for automated decision-making or profiling with legal or similarly significant effects.

Changes to this notice

This page is reviewed each quarter and whenever we change how we process data. The last review date sits at the bottom. Material changes get called out in the next Sunday digest so subscribers see them, not just visitors.