Play

Privacy Policy

This Privacy Policy explains how Castille Media Ltd processes personal data through the LuckyBoom Casino review portal. The portal publishes independent casino reviews and affiliate content. It does not operate LuckyBoom, provide gambling services, hold player accounts, or process bets and withdrawals.

The governing data-protection framework is Regulation (EU) 2016/679, the General Data Protection Regulation, referred to below as the GDPR.

1. Controller

The controller responsible for personal data processed through this portal is:

Adrian Vella is the responsible person. Questions about this Privacy Policy, a request concerning personal data, or a complaint about processing should be sent to the data-protection email address above.

2. What we collect

When somebody visits the portal, the hosting infrastructure may automatically record server log data. Such records can include the visitor’s IP address, request timestamp, requested page, browser and device user agent, referrer URL, response status, and technical information needed to diagnose errors or security incidents.

Server logs help Castille Media Ltd keep the site available and investigate misuse. They are not used to create gambling profiles. Even so, an IP address can constitute personal data, so access to logs is limited to authorised personnel and relevant service providers.

The portal also stores consent records where a visitor makes a choice about non-essential cookies or analytics. A record may contain the consent selection, date and time, policy or consent-banner version, and a technical identifier needed to remember the preference. Refusing consent is recorded where necessary so that the portal does not repeatedly request the same choice.

Contact-form submissions contain the details supplied by the sender. These may include a name, email address, subject, message, and any personal data voluntarily entered in free-text fields. Readers should not submit casino passwords, payment-card details, identity documents, or sensitive information through the form. LuckyBoom Casino account disputes must be raised with the casino operator rather than this affiliate portal.

3. Legal bases

Castille Media Ltd relies on the following legal bases under Article 6(1) of the GDPR:

Legitimate-interest processing is subject to a balancing assessment. Castille Media Ltd considers the nature of the data, the limited operational purpose, retention period, access controls, and the visitor’s reasonable expectations. A visitor may object to this processing, although compelling security or legal grounds can justify its continuation.

4. Cookies and analytics

Cookies are small data files placed on a visitor’s device. Essential technologies may be used to operate core functions, retain privacy choices, protect forms, and maintain security. Optional analytics or other non-essential cookies are not activated before valid consent has been obtained.

The consent interface should provide a genuine choice. Rejecting non-essential cookies does not prevent access to editorial reviews, although some optional functions or measurement features may not work. No consent should be inferred from silence, inactivity, or continued browsing.

Consent can be withdrawn at any time with the same effort required to give it, using the portal’s privacy or cookie controls. Withdrawal does not affect the lawfulness of processing performed before consent was withdrawn. Visitors can also remove stored cookies through their browser, but browser deletion alone may not update a consent record retained by the portal.

Analytics may measure page views, referral sources, approximate location, device category, and interactions with editorial content. The limitation is clear: even aggregated reports can originate from online identifiers, so optional analytics remains disabled until the visitor consents.

5. Recipients and transfers

Personal data may be disclosed to hosting, infrastructure, security, consent-management, contact-form, and analytics providers acting as processors. These organisations receive only the information reasonably required for their contracted task and must process it under documented instructions, confidentiality obligations, and appropriate security measures.

Professional advisers or public authorities may receive data where disclosure is necessary to establish or defend legal claims, meet a binding legal requirement, or protect the portal against misuse. Castille Media Ltd does not sell contact-form submissions or server logs to casino operators.

Some service providers may process data outside the European Economic Area. Any such transfer rests on safeguards appropriate under the GDPR, such as an adequacy decision or approved contractual safeguards, together with supplementary measures where the circumstances require them. Cross-border infrastructure can make exact processing locations harder to identify, so readers may request further information from the data-protection contact.

6. Retention

Server log data is kept only for as long as necessary to maintain security, diagnose technical faults, investigate abuse, and support legal claims. Logs are deleted or anonymised when those purposes no longer require identifiable records, unless a particular security incident or legal obligation justifies longer retention.

Consent records are retained for the period needed to demonstrate the visitor’s choice and comply with GDPR accountability requirements. Contact-form messages are kept while the enquiry is handled and for a limited period afterwards where correspondence may be needed for follow-up, complaint management, or legal claims.

No single retention period suits every record. Reviews take account of purpose, data sensitivity, security risk, and applicable limitation periods. Outdated records should be deleted, anonymised, or securely restricted.

7. Your rights under the GDPR

Subject to the conditions and limitations in the GDPR, individuals may exercise the following rights: