Privacy Policy
This page describes what personal information Gala Bingo picks up from visitors, why we collect it, where it ends up stored, who it gets shared with, and how to exercise your rights under UK privacy law. The technical counterpart — covering cookies, analytics and browser storage — sits on the Cookie Policy page; this page reads as the plain-English version of the same setup.
Gala Bingo runs as an independent information platform; broader background sits on the About page. The current privacy policy applies only to the Gala Bingo website. Once a reader clicks through to an operator's site, that operator's own privacy policy takes over; Gala Bingo does not pass data to operators except in the limited form described further below.
1. The nature of Gala Bingo as a site
Gala Bingo publishes editorials and guides covering online casinos open to UK players. The flagship operator write-up sits at the Gala Bingo Casino homepage. This site does not host any games, run player accounts, accept deposits, hold funds or process withdrawals. No signup exists. No login exists. A standard visit involves no data exchange beyond ordinary web traffic. In situations where Gala Bingo does collect personal data — for instance, when you write in through the contact channels — this page sets out exactly what happens to that data.
2. The British data-protection framework
Gala Bingo processes personal information in line with the UK GDPR and Data Protection Act 2018 together with the thirteen UK GDPR principles overseen by the Information Commissioner's Office (ICO). Visitors from Europe also have their GDPR rights respected here. Visitors from California have CCPA rights respected to the extent those apply. Where a stricter standard applies under any of the above frameworks, the stricter standard governs.
3. Categories of data Gala Bingo records
Three buckets in total: automatic technical traffic data, contact data submitted voluntarily, and aggregated site analytics.
| Category | What is collected | Why | Legal basis |
|---|---|---|---|
| Technical traffic data | IP address (anonymised after 24h), browser type, device type, page URL requested, timestamp, referrer. | Serve pages, prevent abuse, debug performance issues. | Legitimate interest under UK GDPR Article 6 legitimate interest. |
| Voluntary contact data | Name, email address, message content, supporting documents you choose to attach. Submitted only if you write to us. | Reply to your enquiry. | Consent under UK GDPR consent basis (you provide the data; we use it for the stated purpose). |
| Aggregated analytics | Pseudonymous traffic statistics generated by Google Analytics 4 with IP anonymisation enabled. | Understand which pages are useful and which are not. | Consent (you can decline analytics cookies on first visit). |
Gala Bingo does not capture any of the following: financial data (no payment processing runs on this domain), gambling-account credentials (no accounts exist here), biometric data, location more precise than country level (derived from anonymised IP), or special-category data (race, religion, health, sexual orientation, political opinion). Targeted advertising and remarketing are not deployed; the funding model that supports the site is documented on the Affiliate Disclosure page.
4. Browser cookies plus comparable storage
The cookies Gala Bingo relies on, the third-party services placing them, plus how to control each one are described in full on the Cookie Policy page. Short summary: strictly necessary cookies (page rendering, consent banner state, abuse prevention) are always set; analytics and affiliate-tracking cookies are placed only with your consent through the cookie banner; selections can be adjusted at any time via the link in the footer.
5. Outbound affiliate clicks and operator referral tracking
When you follow an outbound operator link on Gala Bingo, three things happen in sequence. First, the internal redirect at /go logs the click for our analytics (whether or not the visit continues). Second, the browser is forwarded over to the operator's site. Third, the operator can set its own cookies and treat the visit as a referral attribution. Gala Bingo does not forward your name, email address, or any other identifying personal data to the operator. The operator only sees that "a visitor arrived from Gala Bingo". If a reader then proceeds to register an account on the operator's site, that registration falls under the operator's own privacy policy, not under this one.
6. Retention windows for each data category
- IP addresses: the raw address is held no longer than 24 hours, purely for abuse prevention, after which it is reduced by chopping off the trailing octet on IPv4 (or the trailing 80 bits on IPv6). The anonymised form is then kept for a maximum of 14 months and used only to compile traffic statistics.
- Contact correspondence: emails plus any attachments are stored for 24 months for follow-up and audit purposes, then removed unless still part of an active discussion.
- Analytics events: Google Analytics 4 data is retained for 14 months under our configuration, after which it is automatically deleted.
- Cookie consent record: the consent record itself lives locally in your browser for 12 months, after which the consent banner returns.
Where legal obligations demand a longer retention — for example, tax records under the HMRC record-keeping requirements covering affiliate-related accounting — the relevant data is kept only for the legally required window and used for no other purpose.
7. Third parties that receive data from Gala Bingo
Three controlled categories apply. Service providers that run parts of the Gala Bingo infrastructure — web hosting, content delivery, email — each working under a written data-processing agreement that restricts their use of the data to providing the service. Analytics providers (Google Analytics 4): IP-anonymised traffic data only, with no personally identifying information. Law-enforcement bodies and regulators: only on receipt of a valid legal demand, and only the data covered by that demand. Gala Bingo does not sell, rent or trade personal data to anyone, full stop.
8. Geographic location of the data infrastructure
Gala Bingo infrastructure sits on cloud providers located in the UK and the European Economic Area. Certain service providers — Google Analytics 4 in particular — process data in the United States. Where data leaves the UK, the recipient is held either to Standard Contractual Clauses or to an equivalent regime that the ICO has assessed as offering protection at least as strong as UK law.
9. Rights available to you
Under the UK GDPR plus equivalent international laws, you hold the following rights in relation to any personal data Gala Bingo keeps about you.
- Access: request what we hold and receive a copy of it.
- Correction: request that any inaccurate data be corrected.
- Deletion: request deletion of your data, subject to legal retention duties.
- Withdrawal of consent: where processing relies on consent, you can withdraw it whenever you like without affecting prior lawful processing.
- Complaint: where you suspect Gala Bingo has mishandled personal data, a formal complaint can be filed with the ICO via ico.org.uk. We would generally ask UK readers to write to us first, giving us a reasonable window to remedy the situation directly.
To exercise any of the above rights, write to the privacy address shown on the Contact page. Gala Bingo will respond inside 30 days, which is the timeframe set by the UK GDPR.
10. Data handling concerning minors
The Gala Bingo audience is, by design, adults located in the United Kingdom. Nothing on the site is built for, marketed to or appropriate for visitors below the age of 18. Personal data from minors is never knowingly collected here. Should we identify that any data has come in from somebody under 18, that record is purged and — where there is a means to do so — the parent or guardian is notified directly.
11. Security
Gala Bingo applies industry-standard security controls: TLS 1.2+ across all data in transit; access controls and least-privilege rules over internal systems; routine audit of who has access to what; logging of every administrative action; periodic third-party penetration testing on the public site. No system is genuinely unbreakable; in the event of a personal-data breach likely to cause serious harm, affected individuals are notified directly and the ICO is informed in line with the ICO breach notification regime under the UK GDPR.
12. How this policy gets revised
If this policy is updated, the "Last updated" date at the top is revised accordingly. Material changes — new categories of data captured, new third-party processors, altered retention periods — come with a banner on the home page running for at least 30 days. Minor housekeeping edits (rewording, link refreshes) do not trigger a banner.
13. Contact
Privacy-related questions are best routed through the privacy contact shown on the Contact page. Editorial queries about Gala Bingo content move through the editorial channel; correction requests follow the procedure laid out on the Editorial Policy page. Player-safety guidance applicable to anyone reading this site sits on the Responsible Gambling page.