Privacy Policy

Last updated: 25 May 2026

This page sets out what personal information Jackpotjoy gathers from visitors, the reasons for it, where the data is held, who it is shared with, and how to exercise your rights under UK privacy law. The technical companion — cookies, analytics, browser storage — sits on the Cookie Policy page; this page is the human-readable side of the same arrangement.

Jackpotjoy runs as an independent informational platform; the wider context is documented on the About page. This privacy policy covers the Jackpotjoy website only. Once a reader clicks through to an operator's site, that operator's own privacy policy takes over; Jackpotjoy does not pass data to operators except in the limited form set out below.

1. What Jackpotjoy is

The output of Jackpotjoy is editorial: casino operator reviews and player-facing guides for the UK market, anchored by the lead write-up at the Jackpotjoy Casino homepage. No games run on this domain, no player accounts are administered here, and no deposits, balances or withdrawals are handled by us. There is nothing to sign up for. There is no login screen. An ordinary read-only visit transfers nothing more than the standard HTTP traffic any website needs. The narrow set of cases where personal data does flow our way — chiefly when a reader writes in via the contact channels — is exactly what this policy is here to spell out.

2. UK privacy law context

All processing of personal information at Jackpotjoy operates inside the framework set by the UK GDPR alongside the Data Protection Act 2018, including the thirteen UK GDPR principles policed by the ICO. EEA visitors are afforded the equivalent GDPR rights set out in EU law. Visitors based in California receive the CCPA rights to the extent that statute reaches them. Whenever two or more of these regimes overlap on a single point, the one offering the stronger protection wins and is the rule we apply.

3. What data Jackpotjoy collects

Three categories: technical traffic data, voluntarily submitted contact data, and aggregated analytics.

A list of categories that Jackpotjoy never gathers: payment-card or banking detail of any kind (no transactions happen on the domain), credentials for gambling accounts (because we don't run any), biometric records, geolocation more granular than country (and that is derived only from a redacted IP), and the GDPR's "special category" personal data — meaning race, religion, health, sexual orientation, political affiliation. Behavioural advertising and audience remarketing are likewise absent; how the site actually keeps the lights on is detailed in full on the Affiliate Disclosure page.

4. Cookies and similar technologies

For an itemised list of every cookie this site sets, the third parties responsible and the granular browser controls available, see the Cookie Policy. The condensed summary: cookies in the strictly-necessary tier — those handling basic page delivery, remembering your consent-banner choice and blocking abusive traffic — are always active. Cookies for analytics and affiliate-attribution only switch on after you opt in via the banner. That decision is reversible at any moment using the footer link on every page.

5. Affiliate links and operator-side tracking

Outbound operator links on Jackpotjoy run through three stages. Stage one: the click hits our internal /go redirect, which records the event for our internal analytics regardless of whether you go on to complete the hand-off. Stage two: the browser is forwarded to the destination operator. Stage three: at that destination, the operator is free to drop its own cookies and to treat the arrival as a referral for attribution accounting. What we never transmit to that operator is anything personally identifying you — no name, no email address, no demographic record. All they receive is the bare signal "this visitor came in from Jackpotjoy". Should you proceed to register on the operator's platform, that registration falls under the operator's privacy policy, which is independent of, and not bound by, this one.

6. How long data is retained

• IP-address retention: a visitor's full IP is held for no more than 24 hours, and only so that abusive or malicious traffic can be filtered out. After that window closes, the address is anonymised — the trailing octet is stripped from IPv4 addresses, and the final 80 bits are stripped from IPv6 addresses. The shortened residual is kept inside aggregated traffic statistics for up to 14 months and then dropped.
• Contact correspondence: emails and any attachments are retained for 24 months to support follow-up and audit, then deleted unless still actively under discussion.
• Analytics events: Google Analytics 4 data is retained for 14 months under our configuration and then automatically purged.
• Cookie consent record: your consent record is held locally in your browser for 12 months, after which the consent banner appears again.

Where law requires retention for longer — for example, tax records under the HMRC record-keeping requirements for affiliate-related accounting — the relevant data is held only for the legally required period and is not put to any other use.

7. Who Jackpotjoy shares data with

Recipients fall into three ring-fenced buckets. Service providers running components of the Jackpotjoy stack — hosting, CDN, email handling — each bound by a signed data-processing agreement that confines their use of the data strictly to delivering the contracted service back to us. Analytics vendors (principally Google Analytics 4): they receive traffic data only, with the IP already anonymised, and no personally identifying record reaches them. Law-enforcement and regulatory bodies: only when a valid legal instruction lands on the desk, and only for the specific dataset that instruction actually covers. Selling personal data, renting it, swapping it or trading it is something Jackpotjoy categorically does not do, ever, to anyone.

8. Where data is stored

The servers and storage powering Jackpotjoy sit inside UK-based and EEA-based cloud regions. A small number of upstream services — Google Analytics 4 being the most notable — necessarily process the data they handle on US infrastructure. Any time personal data crosses the UK border in this way, the receiving party is contractually bound by either Standard Contractual Clauses or by some other transfer mechanism that the ICO has formally assessed as offering protection on a par with — or stronger than — UK domestic law.

9. Your rights

Under the UK GDPR and equivalent international laws, you hold the following rights in relation to any personal data Jackpotjoy holds about you.

• Right of access: ask Jackpotjoy to confirm what personal data is on file about you and to send back a copy.
• Rectification: request that anything inaccurate sitting on your record be amended.
• Erasure: request deletion of your data, with the caveat that any retention period imposed on us by law has to be honoured first.
• Withdrawing consent: wherever the legal basis for processing was your consent, that consent can be pulled back at any moment, with no effect on the lawfulness of anything we processed before the withdrawal landed.
• Right to complain to the regulator: readers in the UK who think their personal data has been mishandled by Jackpotjoy can lodge a complaint directly with the Information Commissioner's Office at ico.org.uk. The standard expectation, though, is that you would route the concern through us first so we get a chance to investigate and put it right before any regulator becomes involved.

To exercise any of these rights, write to the privacy address shown on the Contact page. Jackpotjoy will respond within 30 days, the timeframe required under the UK GDPR.

10. Children's privacy

Everything Jackpotjoy publishes is written for an adult UK audience. The site is not targeted at — nor intended to be useful to — anyone below the age of 18. We do not knowingly accept personal data from anyone in that age group. Should it later emerge that information was supplied by an under-18, the relevant data is removed from our systems, and where it is appropriate and feasible to do so, the child's parent or guardian is informed.

11. Security

On the technical side, Jackpotjoy runs the security controls expected for a public-facing UK site: TLS 1.2 (or higher) for data in transit; least-privilege access management across all internal systems; periodic audits of who can reach what; full audit logging of administrator actions; and routine third-party penetration testing of the public-facing site. None of that makes any system invulnerable. In the event a personal-data breach does occur and is judged likely to cause material harm to data subjects, the individuals affected will be notified directly and the ICO will be advised in accordance with the breach-notification regime built into the UK GDPR.

12. Changes to this policy

Any revision to this document refreshes the "Last updated" timestamp shown at the top of the page. Where the change is material — for example, a new category of data being captured, the addition of a third-party processor or an adjustment to a retention window — that update is broadcast via a banner on the home page for a minimum of 30 days. Cosmetic edits such as light copy tweaks or fixing broken links do not warrant a banner and are simply applied silently.

13. Contact

Privacy-related questions are best routed through the privacy contact listed on the Contact page. Editorial questions about Jackpotjoy content go through the editorial channel; correction requests follow the procedure documented on the Editorial Policy page. Player-safety guidance relevant to anyone reading the site sits on the Responsible Gambling page.