Writing about online casinos, among them operators that are not on GamStop, for readers in Great Britain, playatlasuk.com handles only that small amount of personal data which running a purely editorial information site requires. The legal frame is set by the UK GDPR and the Data Protection Act 2018, and the information below answers the duty to inform placed on a controller by Article 13 of the UK GDPR.
What is collected and why
Every request for a page leaves an entry in the server log. Recorded in it are the IP address, the date and the time, the address that was requested, how much data was sent, the page from which the reader arrived, and which browser was used. Security and the detection of abuse are what those logs are for. They are erased or shortened after 90 days, so that from that point on no person can be identified through them. A message to the editors carries a name, an e-mail address and the wording of the message; the sole purpose to which those are put is answering it. Since this site keeps no reader accounts, takes no deposits and receives no stakes, no payment details and no identity documents are gathered.
Lawful bases and purposes
Answering a message and keeping the logs rest on one and the same ground: the legitimate interests of the controller in a site that works and stays secure (Article 6(1)(f) UK GDPR). Two other things, namely every cookie that is not strictly necessary and the measurement of the audience, are set only after consent has been given (Article 6(1)(a) UK GDPR together with regulation 6 of PECR). That consent may be withdrawn whenever the reader wishes, and no earlier processing becomes unlawful because of the withdrawal (Article 7(3)). Automated decision-making is not used here, and no profiling takes place.
Who receives the data
Nothing is sold. Those who receive data are the processors that host the site, deliver its content and carry its e-mail, all acting on the instructions of the controller (Article 28 UK GDPR), together with public authorities where a legal duty demands it. Data leaves the United Kingdom only for a country covered by adequacy regulations, or else under appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum (Article 44 onwards).
Rights
Access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing that rests on legitimate interests (Article 21) belong to every person. One month from receipt is the period within which a request is answered, without undue delay, and Article 12(3) permits that period to be lengthened by two further months where the matter calls for it.
Retention
How long data stays is decided by its purpose alone: correspondence is held until the matter is closed and then for as long as a possible claim could still be defended against, while server logs are held no longer than 90 days. A message cannot be answered without the data in it, though sending one is never obligatory.
Supervision and complaints
The Information Commissioner's Office (ICO) is the supervisory authority. Where a person takes the view that data protection law has been breached in the handling of their data, Article 77 UK GDPR gives that person the right to complain to the ICO.
Last updated: 13.11.2026.