Who is responsible for this site, and what it actually collects

This policy is given under article 13 of the General Data Protection Regulation, and it describes a small site with no accounts, no registration form and no payments, which is why the list of "personal data" it processes is an unusually short one.

• The controller of the processing: [OWNER: name or company name, registered office — to be completed by the owner before publication]
• Address for any request or complaint under this policy: [EMAIL: contact address — to be completed by the owner]

Nobody signs in here, because there is nothing on these pages to sign in to! What reaches the site is a request for a page, and that request carries with it the things every request on the public internet carries: an "IP address", the date and time, the address asked for, the page the reader came from, and the string in which a browser announces itself (the "user agent").

Those items are processed for four purposes and no others: serving the pages and keeping the service available and secure, measuring how the pages are used in aggregate (totals, not people), remembering the choice a reader makes about cookies, and sending a reader located in a protected market to the version of a page written for that market.

The legal bases follow from the purposes, and we set them out in the same order so that you can match one to the other. Serving the pages, keeping the access logs and defending the site against abuse rest on the "legitimate interest" of the "controller" under article 6(1)(f); the audience statistics and the cookies behind them rest on "consent" under article 6(1)(a), which we ask for before anything is written and which you can withdraw whenever you choose.

Who receives any of it

The site is hosted on Amazon Web Services, so every request necessarily reaches that company's infrastructure before it reaches a page, and the usual "access log" is produced there (address, timestamp, resource, user agent). The host acts as a "processor" on our instructions, and it is the only recipient that necessarily sees every single request.

Google receives data for the audience statistics, through a tag manager, and only after a reader has accepted statistical cookies. Before that acceptance no identifier is written and no measurement call is made at all, which is a decision taken in the build of the pages rather than a claim about anybody's good intentions.

Where the region of a reader has to be determined on the page itself, a third-party service (Geo Targetly) receives the "IP address", the address of the page, the page the reader arrived from (the "referrer"), the dimensions of the screen and the type of browser, and returns a location derived from them. That service is described in the section below, because its working is the part of this site that readers most often ask about.

Nobody else receives anything at all, and the list above is therefore the whole of it. No profile is built, because there is nothing to build one from. There is no advertising network on these pages, no data broker, no sale of anything to anybody, and the affiliate links carry no identifier of the reader: a click reaches the operator with the "referrer" that any link would carry, and with nothing whatever added by us.

How the site works out which country a reader is in

Two mechanisms do this work, and they are not equivalent, so it is worth separating them. The first lives in the hosting configuration: the redirect rules read the country from the "IP address" at the host that is already serving the pages, which means the determination happens inside a service that has the address anyway and no further recipient is involved.

The second mechanism is the third-party service named above, used for the Canadian provinces and for the United States, where the rules differ from province to province and from state to state. It is the mechanism that sends five items (address, page, referrer, screen size, browser type) out to a service and gets a position back.

Two things the mechanism deliberately does not do, and both of them matter to a reader who arrives from a search engine. The robots of the recognised search engines, identified by the "user agent" they declare, are not redirected at all, so what a "crawler" indexes is the international page rather than a provincial one; and the service writes no cookie of its own, because its cookie lifetime is set to zero and its frequency controls are switched off (nothing is remembered, so nothing is stored).

Two ordinary things defeat it entirely, and a reader may well be glad of either one of them. An advertisement blocker will stop the script, and so will a browser with JavaScript switched off, and in both cases the page simply loads in its international form with nothing lost except the "market notice" at the top.

The last thing to say about any of it is also the most important thing, and we would rather state it twice than once. A region worked out from an address is an approximation and never a fact about a person: an address can belong to a network whose exit sits in another country, a corporate connection can resolve hundreds of miles from the desk using it, and and a reader on a private network is placed wherever that network happens to leave the internet. A region is a guess made from a number! Our own verification work for the casino pages ran from a network whose exit sits in the United States ("not verified" appears on this site for that very reason), which is a demonstration of the problem rather than a theory about it.

Cookies, and how long anything is kept

One cookie ("fbc_consent") records the choice made in the consent banner and lasts six months; the "statistical cookies" are set only after acceptance, and the complete list with names and durations is on our cookie page, which also carries the button that brings the banner back.

Retention is short and it is set in the services rather than invented here. The access log at the host and the aggregate statistics in the analytics account are kept for the periods configured in each of those services, the consent cookie expires on its own six months after the choice was made (six months from the click, not from the visit), and correspondence sent to the address above is kept only while the matter it concerns is open.

Transfers outside the European Union

The host and both of the services named in this policy are United States undertakings or route traffic through infrastructure outside the European Economic Area, so a transfer outside the Union is part of how the site works rather than an exception to it; the three recipients are the host, the analytics provider and the region service, and there is no fourth. Each transfer rests on the mechanism that the recipient publishes for itself, whether standard contractual clauses or an adequacy decision, and the recipients are named above precisely so that a reader can go and read those terms at the source rather than take our word for them.

The rights of a reader, and where to complain

A reader is a "data subject" with the rights given by articles 15 to 22: access to the data concerning him, rectification, erasure, restriction of processing, objection to processing founded on legitimate interest, and portability where it applies. Consent, where it is the basis, can be withdrawn at any moment through the cookie control, with no consequence for the rest of the site.

Those rights can be exercised at the address in the list above, and no particular form is needed. It is worth saying what the honest limit is: with no account and no identifier of a reader, we usually cannot connect a stored record to the person asking about it, and in that situation the most useful answer is a description of what is held rather than a copy of it.

A reader who is not satisfied may complain to the supervisory authority of the member state where he lives, works or believes the breach occurred (article 77 of the regulation). We would rather hear about it first. Writing here first is faster and often enough, and it is not in any way a condition of complaining anywhere else.

By the Free Best Casino editorial team · Last updated October 2026