PRIVACY
Privacy notice.
Last updated: 15 April 2026. UK GDPR + Data Protection Act 2018.
1. Data controller
Whitecosble Press Ltd, 8 Montpellier Walk, Cheltenham GL50 1SD. ICO ZB712034. Companies House 15234891 (E&W). Data protection contact: dpo@whitecosble.co.uk.
Accountable roles: Sole director and Editor-in-Chief Theodora Ashby-Wade. Head of SEO Nicolae Pitula.
2. Data we collect
Contact form (/contact/): name, email, topic, message, privacy-agreement timestamp, IP address at submission (for abuse prevention).
Newsletter subscription (/quarterly/): email, subscription timestamp, double opt-in confirmation.
Browsing data: IP address (last octet discarded), browser string, device type, pages visited — via cookies with consent.
Age verification: localStorage flag wh_age_verified (client-side only, no server record).
Affiliate click data: when you click a "→ Visit [operator]" link, a tracking identifier is passed to the operator by URL parameter. The identifier allows the operator to attribute a registration to Whitecosble for commission purposes. It is not personally identifiable.
CCTV: none. Our Cheltenham office has no CCTV. The office is used for editorial work only.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to contact form | UK GDPR Art. 6(1)(f) legitimate interest |
| Newsletter delivery | UK GDPR Art. 6(1)(a) consent (double opt-in) |
| Affiliate click tracking | UK GDPR Art. 6(1)(f) legitimate interest (commercial) |
| Analytics (Google Analytics 4) | UK GDPR Art. 6(1)(a) consent |
| reCAPTCHA (spam protection) | UK GDPR Art. 6(1)(f) legitimate interest |
| Corrections / complaints record-keeping | UK GDPR Art. 6(1)(c) legal obligation |
4. Retention
- Contact form submissions — 12 months
- Newsletter subscribers — until unsubscribe
- Analytics (Google Analytics 4) — 14 months
- Commercial correspondence — 7 years (UK company record-keeping)
- Cookies — see /cookies/
5. Recipients
- Hosting provider (United Kingdom — London data centre)
- Cookiebot (Cybot A/S, Denmark)
- Google reCAPTCHA (USA — UK IDTA) — on /contact/ only
- Google Maps (USA — UK IDTA) — /contact/ only, consent-gated
- Google Analytics 4 (USA — UK IDTA, consent-gated)
- DuckDuckGo Icons (USA, GDPR-compliant per DuckDuckGo Privacy Policy) — serves the small operator icons on our bookmaker pages. Image-only request, no cookies set, no logging per DuckDuckGo privacy stance. Google Favicons used as fallback where DuckDuckGo does not index the domain.
- Mailgun EU (EU region — GDPR-adequate)
- Brevo (France — EU adequacy) — quarterly newsletter
- Affiliate network partners — receive click-through identifier only
- Backup provider (Backblaze B2 EU region — GDPR-adequate)
6. International transfers
Google services (reCAPTCHA, Analytics, Maps embed): USA, under the UK International Data Transfer Agreement (IDTA) per UK GDPR Art. 46. Mailgun EU + Brevo: EU region (GDPR-adequate).
7. Your rights under UK GDPR
Access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent. To exercise any right, email dpo@whitecosble.co.uk. We respond within 30 days.
8. ICO
You have the right to lodge a complaint with the Information Commissioner's Office — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · ico.org.uk · 0303 123 1113.
9. Security
HTTPS (TLS 1.2+) across all pages. Security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Access control on administrative interfaces. Password policy and 2FA. Regular backups to separate UK/EU region. Incident response procedure reviewed annually.
10. Cookies
Cookies are addressed on a separate page at /cookies/, per ICO guidance. From that page you can open the consent prompt via the Manage cookies button.
11. Children
This site is intended for readers aged 18+. We do not knowingly collect data from users under 18. If we learn we have received data from a person under 18, we will delete it. An 18+ age gate blocks access on first visit.
12. Changes
Material changes will be notified on this page at least 30 days before effect. The change history is preserved in our version control for accountability.