Privacy policy
Bonus No Purchase Required is a site that one reads, not a site that one joins: there is no account to open and nothing to buy, so the personal data that pass through it are few. This page lists them all.
It says who answers for them, what happens at each of the three moments of a visit (the request of a page, the answer to the cookie banner, the click on an offer), who else receives them and for how long, and what the General Data Protection Regulation (the "GDPR") allows every reader to ask.
Who answers for the data
The "data controller", which is the term the GDPR uses for whoever decides why and how data are processed, is <DATA CONTROLLER>, the publisher of the site, who can be written to at <CONTACT ADDRESS> for every question on this policy and for the requests described below. The same address is on the contact page. No "data protection officer" has been appointed, the size of the processing not requiring one.
The request of a page
Whenever a page is requested, the service that hosts the site (Amazon Web Services) records what every web server records: the IP address of the connection, the date and the time, the page asked for and the browser used. These records exist to deliver the pages and to keep the site safe from abuse, which the GDPR calls a "legitimate interest" of the controller (Article 6(1)(f)), and they are kept for the short time that this purpose requires; nobody reads them to follow a reader.
The site does not recognise the country of the reader, and it does not change its pages according to where a request comes from. The operators listed here address the international, non-regulated market, as the sentence at the foot of every page says, and whether the law of a country allows playing with one of them is for the reader to check: nobody checks it in the reader's place, and the site has no reason to know where the reader is.
The answer to the banner
The statistics are the second moment, and they exist only if you accept them. After "Accept" we load Google Tag Manager and, through it, Google Analytics 4, which counts the pages read, the country and the city that the connection suggests, the device and the browser in use, and the clicks on the offers, each with the name of the casino, so as to know which offers readers find worth a click.
The purpose is to understand how our pages are read, in order to write them better, and the legal basis is your "consent" (Article 6(1)(a)), withdrawable at any moment from the cookie page with the same button that gave it. After "Reject" nothing is loaded and nothing is measured, and no page works any differently!
Google processes these data as a "processor", that is on our behalf and on our instructions, in part in the United States, under the EU-US "Data Privacy Framework" (the mechanism that the European Commission has recognised as giving an adequate level of protection). Google Analytics keeps them for the "retention period" set in the account, the shortest that the service offers, two months; the cookies involved, their names and their duration are on the cookie page.
The click on an offer
The third moment is the click on a casino, a bingo room or a poker room, which takes you out of the site. The link passes through an address of ours (a "redirect", which records nothing about the reader) and arrives on the site of the operator, where the privacy policy and the cookies of the operator apply from the first page. The operator, or the affiliate programme managing its offers, may note that a player arrived from here, since that is how "affiliate commissions" are counted.
What comes back to us is a count of registrations and deposits, never a name, an address or an account. No personal data are sold or passed to the operators listed on these pages, and none arrive from the operators about the players who registered, and so, when a reader writes to us about a problem with a casino, the only answer we can give points to the operator's own support.
Writing to the site
Whoever writes to the address above entrusts us with a name, an e-mail address and whatever the message contains, used to answer, which is our legitimate interest as well as the reader's (Article 6(1)(f)). The correspondence is kept for as long as the exchange lasts and for a reasonable time afterwards, in case the same reader writes again. The "newsletter" that the site once offered no longer exists, and the addresses collected at the time were deleted with it, as the law required.
Your rights
The GDPR gives every reader a "right of access", that is to know whether data about them are held and to receive a copy, and with it the right to have those data corrected or erased, to have their processing restricted, to object to a processing based on a legitimate interest, to receive in a portable format the data given to the site, and to withdraw a consent at any moment, without affecting what was done before.
A request is answered within a month. A proof of identity may be asked for when the request concerns data that could belong to someone else, and the answer is free of charge, unless the requests are repeated to the point of being manifestly excessive (Article 12(5)).
Whoever believes that a processing breaks the law can also lodge a "complaint" with a supervisory authority, in particular that of the member state of their habitual residence, of their place of work or of the alleged infringement; the list of the authorities is published by the European Data Protection Board at edpb.europa.eu.
Adults only, and changes
The site is for adults (18 years, or the higher age that applies where the reader lives), and no data of minors are processed knowingly: a message from a minor would be deleted as soon as recognised. This policy changes whenever the site or the rules change, and the date at the top says when it was last revised. The previous versions are not kept online, but can be asked for at the address above.