Privacy Policy

Last updated: 23 July 2026.

1. Who Is Processing and Collecting Your Personal Data?

GoodLuckMate Ltd., a company incorporated in the jurisdiction of Malta with the registered business address 34 Wied Ghomor Street, St. Julians, STJ2043, Malta, Company Registration Number C 96551, is principally responsible for looking after your personal data (your Data Controller). Data Controller means the company that determines the means and purposes of the processing of your personal data. 

Where service providers process personal data on our behalf (see Section 4), they do so under our instructions and in line with the standards set out in this Policy.

2. The Personal Data We Process

We do not offer user accounts, and we never collect payment details. The personal data we process depends on how you use the Website:

• If you contact us (contact form or “suggest an edit”): your name, email address, and the content of your message.
• If you submit a casino review: the display name you choose, your review text and star rating (published on the Website), and your IP address, which we keep separately for a limited time to prevent abuse and duplicate or fraudulent reviews.
• Automatically, for security and troubleshooting: server and CDN access logs containing your IP address, browser user agent, and the pages you request. These logs are short-lived (see Section 7).
• A two-letter country code derived from your IP address by our content delivery network. We use it to apply legal restrictions (the Website is unavailable in some countries) and to order casino listings. Long-term statistics (for example, clicks by country) are stored without your IP address or any other identifier.
• If you use the “wrong country?” form on our restriction page: your IP address, the country attributed to you, your browser user agent, and the page you tried to visit.
• If you allow optional cookies in our banner: a randomly assigned A/B test group (the letter “a” or “b”). See our Cookie Policy for details.

The Website is intended for adults aged 18 or over. We do not knowingly collect personal data from minors.

3. What Your Personal Data Is Used For, and When It’s Processed 

We use personal data only for the following purposes:

• To respond to messages you send us (legal basis: our legitimate interest in answering you and, where relevant, taking the steps you request).
• To publish and moderate user reviews, and to prevent fake, duplicate, or abusive submissions (legitimate interest in keeping reviews genuine).
• To keep the Website secure, prevent abuse, and diagnose technical problems, using short-lived server logs (legitimate interest).
• To comply with legal restrictions that apply to gambling-related content in certain countries, by checking which country you are visiting from and, where required, restricting access (compliance with legal obligations and our legitimate interests).
• To understand overall Website usage through aggregate, cookieless statistics that are not linked to you as an individual (legitimate interest; see Section 4 on Plausible Analytics).
• To run simple A/B tests of page variants — only if you have allowed the optional cookie in our banner (consent, which you can withdraw at any time; see our Cookie Policy).

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects, and we do not build individual visitor profiles.

4. Who We Share Your Personal Data With

We work with several third parties to help manage our business and deliver services. These third parties may, from time to time, need to have access to your personal data. The third parties we work with, and their Privacy Policies, are listed below:

• Bunny.net (content delivery network, which serves our website’s pages and files) – You’ll find their Privacy Policy here.
• Proton (email delivery for messages you send us through our contact form) – You’ll find their Privacy Policy here.
• Hostinger International Ltd (hosting of our servers, located in the European Union – Frankfurt, Germany) – You’ll find their Privacy Policy here.

For website statistics we use Plausible Analytics, which we host on our own servers. It is cookieless, collects no personal data, and shares nothing with third parties. We no longer use Google Analytics, Hotjar, or any similar third-party tracking service.

When you follow a link to a casino or any other external website (including our recommendation links), you leave the Website. We do not pass any personal data along with the click. The destination website applies its own privacy policy, which we encourage you to read.

5. International Transfers

Our servers are located in the European Union (Frankfurt, Germany), and our content delivery network (Bunny.net) is an EU company. Proton, which delivers contact form messages to our mailbox, is based in Switzerland, a country covered by an EU adequacy decision. Beyond this, we do not transfer your personal data outside the European Economic Area.

We may also disclose your personal data if we receive a legal or regulatory request from a law enforcement body. Any such request will be carefully checked before personal data is disclosed. You have the right to ask us for more information about the safeguards we have put in place — contact us (see Section 8) if you wish.

6. Direct Marketing

We do not send newsletters or marketing emails, and we do not use your personal data to target advertising at you. Contact details you provide are used only to reply to your message.

If we ever introduce marketing communications, we will ask for your consent first, and every message will include a working unsubscribe option.

7. How Long We Keep Your Personal Data

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. Our current retention periods:

• Contact form and “suggest an edit” submissions: up to 12 months.
• Review IP addresses: up to 12 months from submission (the published review itself — display name, text, rating — remains on the Website for as long as it stays relevant, and you can ask us to remove it at any time).
• “Wrong country?” reports: up to 90 days.
• Server access logs: rotated automatically and kept for no more than 14 days.
• Database backups: 14-day rolling window.
• Your cookie banner choice: stored in your browser for 12 months; the optional A/B cookie for 30 days (see the Cookie Policy).

8. Your Rights

You have a number of rights concerning your personal data. More information about each of these rights can be found below.

To exercise your rights, you may contact us by sending an email to info@goodluckmate.com or by writing to GoodLuckMate Ltd. at the address set out in Section 1 above.

Please note the following if you wish to exercise your rights:

Access

You can ask us to:

• Confirm whether we are processing your personal data;
• Give you a copy of that data;
• Provide you with other information about your personal data; for example, what data we have, what we use it for, who we disclose it to, whether we transfer it outside the EU, how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from, and whether we have carried out any Automated Decision Making or Profiling, to the extent that information has not already been provided to you in this Policy. 

Rectification

You can ask us to rectify inaccurate personal data. 

We may seek to verify the accuracy of the data before rectifying it.

Erasure

You can ask us to erase your personal data, but only where:

• It is no longer needed for the purposes for which it was collected; or
• You have withdrawn your consent (where processing was based on consent); or
• Following a successful right to object (see 'Objection' below); or
• It has been processed unlawfully; or
• To comply with a legal obligation. 

We are not required to comply with your request to erase your personal data if the processing of your personal data is necessary: 

• For compliance with a legal obligation; or
• For the establishment, exercise or defence of legal claims;

There are certain other circumstances in which we are not required to comply with your erasure request, although these two are the most likely circumstances in which we would deny that request.

Restriction

You can ask us to restrict (i.e., keep but not use) your personal data, but only where:

• Its accuracy is contested (see Rectification) to allow us to verify its accuracy; or
• The processing is unlawful, but you do not want it erased; or
• It is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise, or defend legal claims; or
• You have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal data following a request for restriction, where:

• We have your consent; or
• To establish, exercise, or defend legal claims; or
• To protect the rights of another natural or legal person. 

Portability

You can ask us to provide your personal data to you in a structured, commonly used, machine-readable format, or you can ask to have it 'ported' directly to another Data Controller, but in each case, only where:

• The processing is based on your consent or on the performance of a contract with you, and;
• The processing is carried out by automated means.  

Objection

You can object to any processing of your personal data which has our legitimate interests as its legal basis if you believe your fundamental rights and freedoms outweigh our legitimate interests. 

We have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. 

International Transfers

You can ask to obtain a copy of, or reference to, the safeguards under which your personal data is transferred outside of the European Economic Area. 

We may redact data transfer agreements or related documents (i.e., obscure certain information contained within these documents) for reasons of commercial sensitivity. 

Supervisory Authority

You have a right to lodge a complaint with the responsible local supervisory authority about our processing of your personal data.

We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.  

Our lead supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC) in Malta (idpc.org.mt). You may also contact the data protection authority in your own country.

9. Changes to This Policy

We may update this Privacy Policy from time to time; the latest version will always be available on this page, and the “Last updated” date at the top shows when it was last revised.