The controller at the railing
GloucesterWin Editorial is the data controller for personal data processed through this website. Correspondence address and ICO registration number are on file and available on request — write in via the paddock post and we will reply within five working days. We are registered in England and Wales (company number on file).
What goes into the form book
We process the following categories of personal data:
- Server log data — IP address, browser type, requested URL, referrer URL, timestamp. Processed automatically on every page request.
- Analytics identifiers — anonymised session IDs and interaction data collected only when you consent via the cookie panel. We do not use full-IP analytics.
- Attribution tokens — click-through identifiers appended to affiliate links, used to attribute sign-up commissions to this site. Processed only when you click a sponsored link.
- Correspondence content — name, email address, and message body submitted via the contact form. Retained only while the correspondence is active and for up to 24 months thereafter for editorial record purposes.
- Consent records — the timestamp and category choices you make in the cookie panel. Retained for the life of the consent plus 12 months.
The lawful bases — reading the going
We rely on the following lawful bases under UK GDPR Article 6:
- Legitimate interests (Article 6(1)(f)) — server log processing for operational security and performance. We have conducted a legitimate interests assessment; the processing is proportionate to the interests pursued.
- Consent (Article 6(1)(a)) — analytics and attribution cookies. You consent via the cookie panel; you may withdraw at any time by re-opening the panel (link in every page footer) and saving revised preferences. Withdrawal does not affect the lawfulness of prior processing.
- Contract performance / pre-contractual steps (Article 6(1)(b)) — correspondence data, where you have written in with a query or correction that requires a reply.
Who sees the data
GloucesterWin uses a small number of sub-processors:
- Hosting provider — server-log data is held on our web host's infrastructure. Hosting is in the UK or EEA.
- Analytics platform — if you consent to analytics cookies, anonymised interaction data is sent to the analytics provider named in the cookie panel. The processor agreement is in place.
- Affiliate network — attribution tokens are shared with the affiliate network through which operator referrals are tracked. The network acts as a processor under a current DPA.
We do not sell personal data. We do not share data with operators for their own marketing purposes.
International transfers
Where any sub-processor operates outside the UK, transfers are made under UK adequacy regulations, Standard Contractual Clauses (SCCs), or the UK International Data Transfer Agreement (IDTA), as applicable. Details of the transfer mechanism for each sub-processor are available on request.
The retention card
| Data category | Retention period |
|---|---|
| Server log data | 30 days rolling |
| Analytics data | 14 months (standard analytics platform limit) |
| Attribution tokens | Duration of affiliate network contract window (typically 30–90 days) |
| Correspondence | 24 months from last contact, then deleted or anonymised |
| Consent records | Lifetime of consent plus 12 months |
Your rights under UK GDPR
You hold the following rights in relation to your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to erasure — request deletion of personal data where there is no continuing lawful basis for retention.
- Right to rectification — request correction of inaccurate data.
- Right to restriction of processing — request that we limit how we use your data while a dispute is resolved.
- Right to data portability — receive data you provided on a consent or contract basis in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests. We will cease unless we can demonstrate compelling legitimate grounds.
- Right to withdraw consent — withdraw analytics or attribution consent at any time via the cookie panel. This does not affect prior processing.
- Right to lodge a complaint — if you believe your rights have been breached, you may complain to the Information Commissioner's Office (ICO).
To exercise any of the above rights, write to us via the paddock post. We will respond within one calendar month.
This is an adults-only publication
GloucesterWin is aimed exclusively at persons aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we become aware that data from a person under 18 has been submitted, we will delete it promptly. If you believe this has occurred, contact us immediately via the paddock post.
When this notice is revised
We review this notice annually and when material changes occur in our processing. The revision date below reflects the most recent substantive update. Continuing to use the site after a revision constitutes awareness of the updated notice; we will flag significant changes via the cookie panel.
Last revised: 20 May 2026.