1. Who is the controller
Meridian Review Ltd, a company registered in England and Wales (no. 15982204) at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, is the data controller for personal data processed through meridianreview.co.uk.
Data protection contact: privacy@meridianreview.co.uk. We have not appointed a statutory Data Protection Officer, as we are not required to.
2. What we collect, why, and on what lawful basis
| Data | Why we process it | Lawful basis (UK GDPR Art. 6) | Retention |
|---|---|---|---|
| Name, email address, subject and message you type into the contact form | To read your message and reply to it | Legitimate interests (Art. 6(1)(f)) — responding to a person who has deliberately contacted us | 24 months from our final reply, then deleted |
| Your confirmation that you are 18 or over | To meet our obligation not to direct gambling-related content at minors | Legal obligation and legitimate interests (Art. 6(1)(c), (f)) | Held with the enquiry, 24 months |
| Server logs: IP address, date and time, page requested, referring address, browser user-agent, response status | Keeping the website secure and available, diagnosing faults, detecting abuse | Legitimate interests (Art. 6(1)(f)) — network and information security | 14 days, then automatically deleted |
| Your cookie choice (accepted or rejected) | So that we do not ask you again on every page | Your consent, and our obligation to record it (Art. 6(1)(a), (c)) | 12 months, stored in your own browser only |
| Aggregated, anonymous readership statistics — only if you accept | To learn which reviews are read so we know what to update | Consent (Art. 6(1)(a)), withdrawable at any time | 26 months in aggregate form |
We do not process special-category data, and we ask you not to send us any. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
3. What we never do
- We never sell, rent or trade personal data. There is no circumstance in which we would, and there is no commercial arrangement under which we could.
- We never add contact-form addresses to a marketing list. If you email us, you get a reply and nothing else.
- We never run third-party advertising or retargeting trackers on this website.
- We never share personal data with the casino brands we review. Following a link to an operator does not transmit your name or email address — see section 6.
4. Cookies and similar technologies
This website sets one strictly necessary security cookie and stores your cookie choice in your browser's local storage. Nothing optional is stored unless you accept it. Full detail, including every key by name, is on the Cookie Policy page. You can change or withdraw your choice at any time using the "Cookie settings" link in the footer.
5. Who we share data with
We use a small number of processors, each bound by a written contract that permits them to act only on our instructions:
- Our hosting provider, which operates the servers this website runs on and holds the server logs described above. Hosting is within the United Kingdom or the European Economic Area.
- Our email provider, which carries messages sent through the contact form to our mailbox and our replies back to you.
We will also disclose personal data where we are legally required to — for example in response to a valid court order, or to a regulator or law-enforcement body acting within its powers — and where necessary to establish, exercise or defend legal claims.
6. Following a link to an operator
When you click an outbound brand link, your browser makes a request to that operator's own address. That request may include a tracking parameter identifying MeridianReview as the referring publisher, so that any commission due can be attributed. That parameter identifies us, not you: it carries no name, email address or other information you gave us.
Everything that happens after you arrive at the operator is governed by that operator's own privacy policy, and the operator becomes an independent controller of any data you give it. We have no access to your account with them and no ability to retrieve, correct or delete data held by them. Read their policy before opening an account.
7. International transfers
We keep personal data in the United Kingdom or the European Economic Area wherever possible. If a processor ever needs to transfer data outside the UK, we will ensure an appropriate safeguard is in place — an adequacy decision made by the UK government, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
8. Security
This website is served exclusively over HTTPS with a strict Content Security Policy and modern security headers. Access to the enquiry mailbox is restricted to the members of staff who need it, and protected by multi-factor authentication. We keep no payment details, because we take no payments from readers.
No system is perfect. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly where the risk is high.
9. Your rights
Under UK GDPR you have the right to:
- Be informed about how your data is used — this page.
- Access a copy of the personal data we hold about you.
- Rectification of data that is inaccurate or incomplete.
- Erasure of your data where we no longer have grounds to keep it.
- Restrict processing in certain circumstances.
- Data portability for data you provided under consent or contract.
- Object to processing carried out on the basis of legitimate interests.
- Withdraw consent at any time, where consent is the basis — this does not affect processing carried out before you withdrew it.
To exercise any of these, email privacy@meridianreview.co.uk. We respond within one calendar month and there is no charge. We may ask for enough information to confirm your identity before we act, so that we do not disclose your data to somebody else.
10. Complaints
If you are unhappy with how we have handled your personal data, please tell us first — we would rather fix it. You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline 0303 123 1113 · ico.org.uk ↗
11. Children
This website is for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact privacy@meridianreview.co.uk and we will delete it.
12. Changes to this policy
We may update this policy. The version in force is the one on this page, with its date at the top. Where a change materially affects how we use your personal data, we will make that clear on the website rather than relying on you to re-read this page.