Privacy Policy

1. Controller

The controller responsible for personal data processed through this affiliate review portal is Grand Quay Media Ltd, founded in 2020 and registered with the Malta Business Registry under registration number C 10934.

Our registered address is 141 Triq ir-Rebha, SLM 3010 Sliema, Malta. You can contact us by telephone on +356 2128 3088 or by email at hello@lucky-boom.de.

The data-protection contact is Elena Micallef. For privacy questions, requests concerning your personal data, or concerns about this policy, contact privacy@lucky-boom.de. Editorial responsibility rests with the Editor-in-chief at the registered office. Our VAT ID is MT82119386.

This website is an affiliate review portal. LuckyBoom Casino and other gambling operators reviewed on the site are independent third parties. Grand Quay Media Ltd does not operate a casino, take bets, hold player balances, process gambling payments, or manage operator customer accounts.

2. What we collect

When you visit the portal, our servers may create log files containing technical data needed to run and protect the site. This can include your IP address, the date and time of access, pages requested, browser type and version, operating system, device information, user agent, referrer URL, HTTP status information and data volume transferred.

IP addresses can constitute personal data under the GDPR. We use log data to maintain technical security, investigate errors, detect misuse, defend against attacks and measure server performance. The portal cannot normally identify you from routine logs alone, but that does not remove the need to handle them carefully.

We also retain records of cookie and tracking choices where required. A consent record may include the date and time of your choice, the consent categories selected, technical identifiers associated with that choice, the version of the consent notice shown and evidence of any later withdrawal.

If you contact us through a contact form or by email, we process the information you choose to provide. That may include your name, email address, message content and any supporting details. Please avoid sending sensitive information unless it is necessary for your request.

3. Legal bases

We process personal data only where a legal basis under Regulation (EU) 2016/679, the General Data Protection Regulation, applies.

Server log data is processed under Article 6(1)(f) GDPR. Our legitimate interests are operating a stable website, preventing fraud and security incidents, diagnosing faults and protecting our systems against unauthorised access. These interests are balanced against visitor rights; logs are not used to build advertising profiles.

Consent records are also processed under Article 6(1)(f) GDPR because we have a legitimate interest in documenting whether consent was obtained, refused or withdrawn. Processing of non-essential cookies, analytics tools and comparable technologies relies on your consent under Article 6(1)(a) GDPR.

Contact-form data is generally processed under Article 6(1)(f) GDPR, as responding to genuine visitor enquiries is a legitimate operational interest. Where your message seeks steps before entering into a contract or relates to another legal basis, that relevant basis may apply instead. This portal does not use contact messages for unrelated marketing without consent.

4. Cookies and analytics

Cookies are small text files stored on your device. Strictly necessary technologies may be used where needed for core functions, security, load balancing or recording your privacy choice. These tools do not require consent where they are genuinely necessary for the requested service.

Non-essential cookies and analytics technologies are activated only after your consent. Analytics can help us understand which review pages readers use, whether pages load correctly and which content needs updating. Industry analytics frequently relies on identifiers and aggregated traffic patterns, so your choice matters even where the information appears technical.

You can accept, reject or manage non-essential categories through the consent settings provided on the site. Consent is voluntary and can be withdrawn at any time with the same effort as giving it. Withdrawal does not affect processing carried out before it was withdrawn, although non-essential tracking should stop for future visits once your updated choice is recorded.

Browser settings can also block or delete cookies. Blocking all cookies may affect preference storage or certain site functions. The editorial reviews themselves remain available without requiring consent to non-essential analytics.

5. Recipients and transfers

We may use carefully selected service providers for website hosting, technical maintenance, security, consent management, analytics and email handling. These providers process personal data only on our documented instructions where they act as processors and must apply suitable confidentiality and security measures.

Recipients may receive only the data needed for their role. A hosting provider, for example, may process server logs, while an analytics provider may receive information generated after consent. We do not sell visitor data or provide contact-form messages to gambling operators for their own independent marketing.

Some providers may process data outside the European Economic Area. Where a transfer takes place, it rests on the appropriate safeguards required by the GDPR, such as an adequacy decision, standard contractual clauses or another recognised transfer mechanism. Transfer arrangements can vary by provider, so we review them when selecting or retaining services.

6. Retention

We keep personal data only for as long as necessary for the purpose for which it was collected. Server log data is retained for the limited period needed for security monitoring, troubleshooting and abuse prevention, then deleted or anonymised unless a longer period is required to investigate a specific incident.

Consent records are retained for as long as needed to demonstrate compliance and manage your preference. Contact messages are retained until the enquiry has been resolved and for a reasonable follow-up period, unless continued storage is necessary for legal claims, legal obligations or an ongoing correspondence matter.

Retention periods are reviewed regularly. Keeping data indefinitely simply because storage is inexpensive would not meet our approach under the GDPR.

7. Your rights under the GDPR

Subject to the conditions and limits set by the GDPR, you have the right to request access to your personal data, rectification of inaccurate data and erasure of data where continued processing is no longer justified.

You may also request restriction of processing, receive data you have provided in a portable format where Article 20 GDPR applies, and object to processing based on Article 6(1)(f) GDPR. Where we rely on consent, you can withdraw that consent at any time. A withdrawal affects future processing, not processing that was lawful before withdrawal.

To exercise a right, email privacy@lucky-boom.de and provide enough information for us to identify the relevant request. We may need to verify your identity before releasing data, particularly where the request concerns access, deletion or correction. This protects visitors from unauthorised disclosure.

You