Who is responsible for this site, and how to reach them

This notice is the information required by Article 13 of the General Data Protection Regulation (Regulation 2016/679), and we have written it to be read rather than to be survived. The site is a guide: it sells nothing, holds no accounts, runs no forms and has no login, so the amount of personal data involved is small, and saying exactly how small is of more use to you than a page of "boilerplate" written to be skipped.

The "controller" of the processing described here is [OWNER: nome e cognome, oppure ragione sociale e sede], and the address for anything in this notice, including an exercise of the rights set out further down, is [EMAIL: indirizzo di contatto del sito]. There is no "data protection officer", because the processing here meets none of the conditions in Article 37 that would require us to appoint one, and appointing one anyway would be a decoration rather than a safeguard.

What is collected, and what is not

Three things are processed here. They are worth naming before they are described: the technical data in the hosting's logs, the measurement data that Google Analytics collects after an explicit "Accept", and the data used to work out which country or "region" a request arrives from. Nothing else happens, and we would rather say that in four words than imply it in four hundred.

There is no account, no registration, no newsletter and no contact form on this site, and no personal data is bought, sold, rented or exchanged with anybody. There is no advertising network here, no "retargeting" pixel from a social platform, no "fingerprinting" script and no "profiling" of any kind. Nothing on these pages tries to recognise a reader who comes back, and the one cookie the site writes for itself ("bjc_consent") holds a yes or a no and nothing else!

No "automated decision-making" within the meaning of Article 22 takes place on this site, for the plain reason that there is no decision here to automate.

There is nothing to appeal.

The hosting, and the logs it keeps

The site is hosted on Amazon Web Services, which is therefore a "processor" (someone handling data on the controller's instructions rather than for purposes of their own). Like every web server, it records in its "access logs" the address of the request, the time, the page asked for, the response given, the referring page where the browser sends one, and the identifying string of the browser itself (the "user agent").

Those logs exist so that the site can be delivered at all, and so that an attack or an abuse can be investigated: that is a "legitimate interest" within Article 6(1)(f) of the Regulation.

We keep them for the short period the hosting applies and we do not extend, aggregate or enrich them for any purpose of our own. Nobody here reads a log in order to learn something about a reader, and nobody here would have the time!

Measurement, and the fact that it waits for an answer

Measurement on this site is Google Analytics 4 (loaded through Google Tag Manager), and it arrives only after a reader has pressed "Accept" on the banner. The legal basis is consent, under Article 6(1)(a) of the Regulation and Article 5(3) of the Directive on privacy in electronic communications. "Consent" there means an affirmative act, which is to say a press on a button, and not a scroll, a sigh or a continued use of the site; the banner that stood on the old pages of this address announced the opposite, and it was wrong.

A reader who presses "Reject" is not measured at all: the "container" (the Tag Manager file that would load the measurement) is never requested, no identifier is created, and any Google Analytics cookie left over from an earlier acceptance is deleted on the spot. A reader who changes their mind after accepting stops being measured immediately, because the revocation disables the property, declares consent denied, deletes the cookies and reloads the page without the container, which matters more than it sounds. Without that reload a container already in memory goes on measuring the scroll and the exit, and quietly rewrites the cookies that were just deleted (we have watched it happen on another site, which is why the reload is there).

What Google receives, once consent exists, is the usual measurement data for a property of this kind. That means the pages opened, the order of them, the approximate location derived from the address of the request, the type of device and of browser, and an identifier kept in a cookie (the "_ga" family, whose names and lives are listed on the cookie page). The site also pushes an event when a reader clicks an affiliate link, which it does in the browser, carrying the short name of the operator and the address of the link ("affiliate_click", in the event list), which lets us see which cards get opened without telling us anything whatever about who opened them.

The recipient of that data is Google, as a processor for the measurement and in its own right for the services it provides, and the detail of the cookies involved, with their names and their lives, is on cookies, where you will also find the control that reopens the banner.

Working out the country, and sometimes the region

Some markets do not permit the promotion of operators holding no licence there (Ontario, Alberta and Australia are the clearest cases), and the pages that we show have to respect that. Two mechanisms do the work, and they behave quite differently.

The first of them sits in the hosting itself. For the protected markets, the service that hosts the site derives from the address of the request the country it comes from and, where it is one of those countries, serves the page written for that country instead of the ordinary one. The address is not stored for this purpose, and it reaches nobody outside the hosting; no third party is involved and no script runs in the browser.

The second runs in the browser, because a "region" (a province, a state) is not a country and the hosting cannot see one. Where a page has to tell a province or a state apart, it queries Geo Targetly, a service of TechTurtle s. r. o., of Bratislava. That service receives the address of the request, the address of the page, the referring page, the size of the screen and the type of browser, and derives a location from the address. According to the provider the data are processed in real time, are not kept in any database, and survive only in server logs while a fault is being traced, on Google Cloud servers in several countries; Geo Targetly acts as a "processor" on our behalf and is among the recipients named in this notice.

The legal basis for both is the legitimate interest in complying with each country's rules on gambling advertising, under Article 6(1)(f), and a reader may object to it at the address above. Two limitations are worth stating plainly: a location worked out from a network address is an "approximation" rather than a fact, and a reader with JavaScript disabled, or with an advertisement blocker in the way, simply stays on the page they opened.

Transfers outside the European Union

The processors named above are organisations with establishments in the United States, so some of the data described here is transferred outside the European Economic Area. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer rests on the "adequacy decision" the European Commission adopted on 10 July 2023. Where it is not certified, the transfer rests instead on the "standard contractual clauses" the Commission has adopted for the purpose, together with whatever measures the processor describes in its own documentation.

A reader who wants the current state of a given processor's certification will find it in the public list the framework maintains, which is a better source than an assurance on a page like this one (we would say that about any page, including ours).

How long things are kept

The hosting logs last the period the hosting applies (days rather than months). The measurement data lasts the "retention" set in the property (Google offers two months or fourteen, and nothing between), which is fourteen months at the outside and is the shortest setting that still allows a year to be compared with the year before it. The record of your consent lasts 182 days, which is the life of the cookie holding it, after which the banner asks you again.

Nothing is kept "in case it turns out to be useful", which is the usual reason a retention period in a notice of this kind has no number in it at all!

The rights, and the complaint

A reader has the rights given by Articles 15 to 22 of the Regulation: access to the data concerning you, rectification of it, "erasure" (what the newspapers call the right to be forgotten), restriction of the processing, objection to a processing based on a legitimate interest, and "portability" where the processing rests on consent or on a contract. A consent given to the banner may be withdrawn at any moment, through the "Cookie settings" control at the foot of every page, and withdrawing it costs you exactly as little as giving it did.

Requests go to the address at the top of this page, and we answer within one month, as Article 12(3) requires; a request we cannot meet will be refused with the reason attached rather than quietly ignored; a refusal with a reason in it is something you can argue with, while a silence is not. Anybody who considers the processing unlawful may complain to a "supervisory authority", either the one for the place where the controller is established or the one for their own habitual residence or place of work, and the right to complain does not depend on your having asked us first.

Where this notice stops

Some links on this site lead to the sites of casino operators, and from the moment you arrive there this notice has nothing further to say. The operator becomes the controller of whatever it collects, under its own privacy policy and its own licence, and we have no access to the account, the documents or the balance of anybody who registers there. The clicks themselves we see only in the aggregate, and only where consent exists.

Gambling is for adults, this site applies eighteen as a minimum everywhere (nineteen where the province requires it), and nothing here is addressed to children or knowingly collects data about them. If this notice changes, the changed version carries a new date at the top of the page, and a change altering what is collected, or why, will be announced on the banner rather than slipped in between two paragraphs.

Questions