Privacy Policy

This policy explains what personal data Paylobby collects when you visit the site, why it is collected, how long it is kept, and what your rights are under UK data-protection law. It applies to the public website at Paylobby only and does not extend to any third-party site we link to. Last updated: 21 June 2026.

Who is the data controller

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller for personal data processed through Paylobby is the publisher of Paylobby. We act as controller in the UK; we do not transfer controller responsibilities to any third party.

What we collect when you read the site

Most visitors to Paylobby leave behind only the data your browser sends automatically when it requests a page. That includes your Internet Protocol (IP) address, the user-agent string identifying your browser and operating system, the referring URL, the page requested, and the date and time of the request. We use this data to serve the page, to detect and mitigate technical abuse, and to maintain aggregated, non-identifying analytics about which guides are read most often. The data is processed under the lawful basis of legitimate interest in operating a public-facing publication.

We do not ask you to register, do not maintain user accounts, do not request your name, address, telephone number, payment details or date of birth, and do not require you to provide any personal data in order to read the guides. If we ever introduce a feature that requires such data — for example a newsletter sign-up — we will publish an updated version of this policy first, and the lawful basis for that processing will be your explicit consent.

Cookies and similar technologies

Paylobby uses a small number of cookies and similar storage mechanisms. Strictly necessary cookies are used to remember your cookie-consent choice and to maintain the integrity of the page across navigation. These are not subject to consent under the Privacy and Electronic Communications Regulations (PECR) because they are essential for the requested service.

Analytics and performance cookies, where used, run only after you have given consent through the cookie banner. They collect aggregated, non-identifying information about how the site is used. You can withdraw consent at any time by clearing your cookies or by changing your choice in the consent banner. A full list of cookies, retention periods and purposes is provided on the Cookie Policy page.

We share personal data with third parties only when it is strictly necessary to operate the site. The categories of third-party processors we may use are: hosting and content-delivery providers (which receive your IP address and request metadata to serve the page); analytics providers (only with your consent); and security services that filter abusive traffic. Each processor acts under a written agreement and processes your data only on our documented instructions. We do not sell personal data, do not share it with advertising networks for behavioural targeting, and do not enrich it with data purchased from third-party brokers.

International transfers

Some processors we use may be located outside the United Kingdom. Where that is the case, we rely on adequacy decisions adopted by the UK Government, on standard contractual clauses approved by the Information Commissioner’s Office, or on equivalent safeguards required under UK GDPR. We do not transfer personal data to a jurisdiction without an appropriate transfer mechanism in place.

How long we keep data

Server logs containing IP addresses and request metadata are retained for up to ninety days for security and operational reasons, then deleted or anonymised. Aggregated analytics with no personal identifiers are retained for up to twenty-six months. Cookie-consent records are retained for as long as the cookie is valid in your browser, typically up to twelve months. Email correspondence — for example a correction you send us — is retained for as long as needed to handle the matter and then archived for a reasonable record-keeping period.

Where we hold personal data about you, you have the right to ask us for a copy of that data; to ask us to correct inaccurate data; to ask us to erase data we no longer need a lawful basis to keep; to object to processing based on our legitimate interests; to ask us to restrict processing while a dispute is resolved; and, where processing is based on consent, to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal.

To exercise any of these rights, write to the editorial inbox listed in the page footer. We will respond within one month of receiving a verifiable request, and in any case within the period required by UK GDPR. There is no charge for a reasonable request.

How to complain

If you believe we have handled your personal data unlawfully, you can complain to the UK Information Commissioner’s Office (ICO). The ICO is the supervisory authority for UK data protection. We would always prefer to resolve a concern with you directly first, so please write to us before escalating; this does not, however, restrict your statutory right to complain to the ICO at any time.

Children

Paylobby publishes content about UK gambling, and gambling in Great Britain is restricted to adults aged eighteen and over. The site is not directed at children, does not market to children, and does not knowingly process personal data of anyone under eighteen. If you believe a child has interacted with the site in a way that requires our attention, please write to us and we will take appropriate action.

Changes to this policy

We review this policy at least once a year and whenever the underlying processing changes. The date at the top of the page reflects the last review. Material changes will be announced on the site for at least thirty days before they take effect; minor edits — for example a clarified phrasing — will be applied directly and reflected in the updated date.