Data Privacy Policy
This page sets out what personal information Paddy Power collects from visitors, why, where it is stored, who it is shared with and how to exercise your rights under UK privacy law. The technical companion — cookies, analytics and browser storage — lives on the Cookie Policy page; this document is the human-readable version of the same setup.
The Paddy Power domain operates as a standalone editorial publication; further background sits on the About page. The terms below cover what happens on the Paddy Power site itself and nothing more. From the moment a visitor follows an outbound link onto an operator's platform, control passes to that operator's own privacy terms, and no reader data is handed across to operators beyond the narrow attribution described later in this document.
1. About Paddy Power
Paddy Power publishes reviews and guides on online casinos accessible to UK players. The flagship operator review sits on the Paddy Power Casino homepage. The site does not host games, run player accounts, accept deposits, hold funds or process withdrawals. There is no signup and no login. A default visit involves no data exchange beyond ordinary web traffic. Where Paddy Power does collect personal data — for example, when you write in through the contact channels — this page sets out exactly what happens to it.
2. UK data-protection legislation
Personal information at Paddy Power is processed against the UK GDPR and Data Protection Act 2018 framework, plus the thirteen principles overseen by the Information Commissioner's Office (ICO). Visitors from inside the European Economic Area get full GDPR rights applied to them as well. Visitors based in California are extended CCPA rights to whatever degree the statute reaches them. If two regimes overlap, whichever one offers the visitor more protection is the one that takes precedence.
3. What information Paddy Power gathers
Three categories in total. Technical traffic data, voluntarily submitted contact data, and aggregated analytics.
| Category | What is collected | Why | Legal basis |
|---|---|---|---|
| Technical traffic data | IP address (anonymised after 24h), browser type, device type, page URL requested, timestamp, referrer. | Serve pages, prevent abuse, debug performance issues. | Legitimate interest under UK GDPR Article 6 legitimate interest. |
| Voluntary contact data | Name, email address, message content, supporting documents you choose to attach. Submitted only if you write to us. | Reply to your enquiry. | Consent under UK GDPR consent basis (you provide the data; we use it for the stated purpose). |
| Aggregated analytics | Pseudonymous traffic statistics generated by Google Analytics 4 with IP anonymisation enabled. | Understand which pages are useful and which are not. | Consent (you can decline analytics cookies on first visit). |
Categories Paddy Power never collects include: financial transaction data (since no payments happen on this domain at all), login credentials for gambling accounts (we run no such accounts), biometric identifiers, location more precise than country level (and even that only inferred from an anonymised IP), and the special protected categories under data-protection law (race, religion, health, sexual orientation, political views). Behavioural advertising and cross-site remarketing technologies are absent from the stack; whatever revenue keeps the site running is laid out on the Affiliate Disclosure page.
4. Cookies and similar tracking tools
The cookies Paddy Power uses, the third-party services that set them and the way to control them are documented in full on the Cookie Policy page. The short version: strictly necessary cookies (page loading, consent banner state, abuse prevention) are always set; analytics and affiliate-tracking cookies are only set once you consent through the cookie banner; you can change your selection at any time via the link in the footer.
5. Affiliate referrals and operator-end tracking
Three things occur whenever someone clicks an outbound operator link on this site. The first is an internal redirect through /go which records the click against our own analytics, with no dependency on whether a registration ultimately happens. The second is a browser-level handoff which lands you on the operator's page. The third is whatever the operator chooses to do on its end — typically dropping its own cookies and crediting the visit as a partner referral. At no point does any identifying personal information — name, email address, anything similar — travel from Paddy Power to the operator alongside the click. The single piece of information that reaches the operator is the fact that a visit originated on Paddy Power. Should you then proceed to create an account, every aspect of that account sits under the operator's privacy policy, not under this one.
6. How long information is kept
- IP addresses: in raw form, an IP is stored for a maximum of 24 hours and only for abuse-prevention purposes; after that window the address is anonymised by stripping the final IPv4 octet or the last 80 bits of an IPv6 value. The anonymised remainder is kept for up to 14 months purely to support aggregate traffic analysis.
- Contact correspondence: emails and any attachments are retained for 24 months for follow-up and audit purposes, then deleted unless still under active discussion.
- Analytics events: Google Analytics 4 data is held for 14 months under our configuration, then automatically purged.
- Cookie consent record: the consent record itself is held locally in your browser for 12 months, after which the consent banner returns.
Where the law requires longer retention — for example, tax records under the HMRC record-keeping rules for affiliate-related accounting — the relevant data is held only for the legally required window and is not used for any other purpose.
7. Who Paddy Power passes information to
Data leaves the Paddy Power perimeter in only three narrowly defined directions. The first is infrastructure suppliers — hosting, content distribution, transactional email and similar plumbing — every one of which is contractually pinned down to a written data-processing agreement that restricts them to delivering their stated service and nothing else. The second is traffic analytics, specifically Google Analytics 4, where only IP-anonymised volumetric data crosses over, with zero personally identifying content attached. The third is regulators and law-enforcement bodies, and only when presented with a valid legal demand, and even then only the dataset directly covered by that demand. Selling, renting or otherwise trading personal data is something Paddy Power simply does not do under any circumstances.
8. Where information is housed
The hosting stack behind Paddy Power sits inside cloud regions across Britain and the European Economic Area. A small number of downstream services — Google Analytics 4 chief among them — handle data within the United States. Whenever information physically crosses the UK border, the receiving party is held either to Standard Contractual Clauses or to a comparable framework that the ICO has formally judged to meet or exceed UK-level safeguards.
9. Your data rights
Under the UK GDPR and equivalent international laws, you have the following rights in relation to any personal data Paddy Power holds about you.
- Access: ask what we hold and request a copy.
- Correction: ask for inaccurate data to be put right.
- Deletion: ask for your data to be erased, subject to any legal retention requirements.
- Withdrawal of consent: where processing rests on consent, you can withdraw it at any time without affecting prior lawful processing.
- Complaint: if you believe Paddy Power has mishandled your data, you can raise a complaint with the ICO at ico.org.uk. UK readers should ordinarily contact us first so we have a chance to put the issue right.
Any of the rights above can be exercised by writing to the dedicated privacy address detailed on the Contact page. A substantive response will arrive inside the 30-day statutory window that the UK GDPR mandates for this kind of request.
10. Minors' privacy
The audience this site is written for is exclusively adult UK readers. Nothing about the editorial approach, the products covered or the language used is aimed at or appropriate for anyone below the age of 18. There is no knowing collection of personal information from minors. Should it come to light that a submission has originated from someone under 18, the underlying data is purged and the parent or guardian receives a notification where that is feasible.
11. Data security
The security baseline at Paddy Power matches industry norms: data in transit is wrapped in TLS 1.2 or higher; internal systems sit behind least-privilege access controls; the set of who can see what is reviewed on a recurring schedule; every administrative action gets logged; and the public-facing surface goes through scheduled third-party penetration testing. Nothing is bulletproof, however, and in the unlikely event of a personal-data breach that looks likely to cause significant harm to individuals, the people affected receive direct notification while the ICO is informed via the breach-reporting workflow specified by the UK GDPR.
12. Updates and revisions to this policy
Whenever this document is amended, the "Last updated" timestamp at the top of the page is moved forward. Substantive changes — a new data category coming under collection, a new third-party processor entering the chain, a retention window being shortened or extended — are flagged through a banner on the home page that remains visible for at least 30 days. Cosmetic adjustments such as wording tweaks or link refreshes do not warrant the banner.
13. Contact details
Privacy-related questions are best routed through the privacy contact listed on the Contact page. Editorial questions about Paddy Power content travel through the editorial channel; correction requests are governed by the procedure on the Editorial Policy page. Player-safety guidance that applies to anyone reading this site sits on the Responsible Gambling page.