Privacy Policy
What we collect, why, how long we keep it, and the rights you have under UK data protection law.
1. Who is responsible for your data
StoneReview is the data controller for personal data processed through this publication. Data protection enquiries go to hello@stonereview.co.uk.
2. Our position in plain words
We are an editorial publication, not a gambling operator. We hold no accounts, no balances, no payment details and no identity documents. There is no login on this publication, no newsletter sign-up, and no way to submit content for publication. The only personal data most readers ever give us is a message sent through the contact form. We do not sell personal data, and we never have.
3. What we collect
a. Information you send us
If you use the contact form, we receive the name, email address, subject and message you type, plus your confirmation that you are 18 or over. Please do not send us identity documents, financial details or account credentials — we neither need them nor want them, and we will delete them on sight.
b. Technical information
Our servers keep standard access logs: IP address, date and time, the page requested, the referring page and your browser's user-agent string. These exist to keep the publication available and secure, and to diagnose faults.
c. Measurement
If you accept optional cookies, aggregated page-view statistics are collected as described in our Cookie Policy. IP addresses are truncated before storage and no attempt is made to identify you. If you reject, none of this happens.
d. What we never collect
We do not collect payment card details, bank details, identity documents, date of birth, gambling activity, location beyond the coarse country implied by an IP address, or any special category data. We do not fingerprint your device and we do not track you across other websites.
4. Why we process it, and our lawful basis
- Answering your enquiry — legitimate interests (responding to someone who has deliberately contacted us). Without this we cannot reply.
- Keeping the publication secure and available — legitimate interests (protecting our infrastructure and our readers, diagnosing faults, preventing abuse).
- Optional measurement — consent, given through the cookie notice and withdrawable at any time.
- Meeting legal obligations — legal obligation, where we are required to retain or disclose information.
5. How long we keep it
- Contact messages — up to 12 months after the enquiry is closed, then deleted. Correction reports may be kept longer as part of our editorial record, with personal details removed.
- Server access logs — up to 90 days.
- Aggregated statistics — up to 13 months, and not linked to an individual.
- Consent record — stored in your own browser, not on our servers, until you clear it.
6. Who we share it with
We do not sell, rent or trade personal data. We share it only with:
- our hosting and infrastructure providers, who process data on our instructions under written contract;
- our email provider, for the purpose of receiving and answering your message;
- professional advisers, or law enforcement and regulators, where we are legally required to do so.
We do not pass your contact details to any gambling operator. If you follow an outbound link and open an account, that operator collects its own data under its own privacy policy, to which we are not a party.
7. International transfers
We aim to keep processing within the UK or the European Economic Area. Where a provider processes data outside those areas, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, with appropriate supplementary safeguards.
8. Your rights
Under the UK GDPR you have the right to:
- be told what personal data we hold about you, and receive a copy (access);
- have inaccurate data corrected (rectification);
- have data deleted where we no longer have grounds to keep it (erasure);
- restrict processing while a dispute is resolved;
- object to processing carried out on the basis of legitimate interests;
- receive data you gave us in a portable format;
- withdraw consent at any time, without affecting processing already carried out.
To exercise any of these, email hello@stonereview.co.uk. We respond within one month and we do not charge. We may ask a question or two to confirm we are dealing with the right person.
9. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office — ico.org.uk, helpline 0303 123 1113 — the UK supervisory authority for data protection.
10. Security
This publication is served over HTTPS with a strict content security policy, and administrative access is limited to the people who need it. No system is perfectly secure, but we hold very little worth taking: no accounts, no balances and no identity documents.
11. Children
This publication is for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it promptly.
12. Automated decision-making
We carry out no automated decision-making or profiling that produces legal or similarly significant effects. Review scores are set by human editors from human testing, not by an algorithm applied to you.
13. Changes
We may update this policy. The current version is always the one on this page, with its version number and date at the top. Material changes will be flagged prominently on the home page.