Privacy Policy

1. Who is responsible

GoodLuckMate Ltd., registered in Malta under company number C 96551, is the controller of personal data processed to operate GoodLuckMate. Our registered address is 34 Wied Ghomor Street, St. Julians, STJ2043, Malta. Contact info@goodluckmate.com for privacy questions or to exercise your rights.

This notice is available even where gambling-related content is restricted. The site is intended for adults aged 18 or over. We do not offer visitor accounts, accept gambling deposits, collect payment-card details or knowingly collect children's personal data.

2. Information we process and why

• Messages and problem reports: the name and email you provide, message, subject and relevant page. We store submissions in our restricted administration system and may deliver an email notification to our mailbox. We use these to answer enquiries and investigate website faults, based on our legitimate interests in responding and maintaining the service. Avoid including payment details, identity documents or other sensitive information.
• Wrong-location reports: your IP address, attributed country, the actual country you enter, browser user agent and requested page path. We investigate location errors and prevent repeated or abusive reports, based on our legitimate interests in operating accurate access restrictions. Reports do not override access rules.
• Location and security: our CDN processes the requesting IP address and supplies country and, where available, subdivision. We use this information for access restrictions and regional eligibility, under applicable legal obligations and our legitimate interests in avoiding unlawful promotion. Security logs record request information, including IP address, user agent and requested URL. Access restrictions do not depend on optional-cookie consent.
• Existing player reviews: display name, text and rating may remain public. Reviews closed to new submissions on 22 August 2026. Associated IP addresses are retained temporarily for abuse prevention. Likes on reviews use an IP address and country to recognise and reverse a vote and deter duplicates. We rely on our legitimate interests in maintaining review integrity.
• Legacy age checks: the previous demo age-check endpoint recorded IP addresses and age-check references. New requests no longer create these records. Remaining historical records expire under the schedule below.
• Optional visit measurement: only after you allow optional cookies, an A/B group and the first page recorded after consent, with a broad referral category, help compare pages and attribute recommendation clicks. Neither cookie contains your name, email or search terms. Consent is the legal basis for this cookie-based measurement.
• Cookieless statistics and technical diagnostics: page paths, broad country/device categories, event categories, performance timings and limited error/source details help us understand use and find faults. IP addresses and browser headers are processed in transit by our self-hosted Plausible service to derive aggregate statistics; this is different from storing raw IPs in analytics reports. Our own performance and journey records use random identifiers limited to a page lifecycle, not a persistent visitor profile. Search measurement uses bounded, short-lived in-memory receipts derived from request information; typed search terms and raw IPs are not written into those event records. Our legitimate interests are measuring service use and diagnosing faults, with minimisation and limited retention. You may object using the privacy contact. Declining optional cookies also stops our performance, journey and search-event collection.

Providing contact details and messages is voluntary, but we need enough information to answer you. An actual country is required if you choose to report a location error. Ordinary request information is necessary to deliver and protect the service. We do not sell personal data, send newsletters or marketing emails, or use individual profiles for advertising. We do not use solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR.

Voluntary page feedback: when you submit a page rating, we store the 0–10 score, optional comment, page path (without query parameters) and reported page status in our restricted administration inbox for up to 12 months. We use this feedback to investigate faults and improve the site as part of our legitimate interest in operating a useful, reliable service. No name or email is requested. Your IP is used transiently to limit abuse but is not saved in the feedback record; ordinary infrastructure logs follow the separate retention below. Please leave personal information out of comments.

3. Recipients and external services

Authorised personnel and service providers receive information only for their relevant tasks. Providers include Bunny.net for delivery, security, IP geolocation and offsite storage; Hostinger for server hosting; and Proton for email. Plausible runs on our own infrastructure. We no longer use Google Analytics or Hotjar. We may disclose information where a valid legal obligation requires it, after checking the request.

Following a recommendation link connects you to an external operator. Affiliate identifiers identify our referral relationship; we do not add your name or email to those URLs. Launching an embedded game also connects your browser to its provider, which receives normal request information and may use storage or cookies. That provider's privacy rules apply to its service. Our optional-cookie choice does not grant blanket consent to a provider's tracking. External content is not loaded on these privacy pages.

4. Locations and international transfers

Our main application and databases are hosted in Frankfurt, Germany. Proton provides email services from Switzerland, which benefits from a European Commission adequacy decision. Bunny operates a global CDN; our offsite database backups are replicated in Germany and New York, United States. These arrangements can involve processing outside the EEA.

Hostinger's published data processing addendum includes EU Standard Contractual Clauses for relevant transfers. Proton publishes its data processing agreement. Bunny provides account-specific processing terms; its GDPR information explains how customers obtain them. Contact us for the recipients, applicable contractual safeguards and a copy or reference for a particular transfer.

5. Retention

• Contact, edit suggestions and problem submissions in the administration database: up to 12 months, with scheduled removal.
• Wrong-location reports: up to 90 days, with scheduled removal.
• IP addresses associated with reviews and review likes: anonymised after 12 months. Public review text, display names, ratings and aggregate like counts remain while relevant; you can request removal.
• Historical age-check records: removed after 90 days; no new age-check records are collected.
• First-party performance, error and journey records: removed after 90 days. Search receipts expire after 10 minutes and are held only in bounded application memory.
• Server access logs: rotated by size and time, with a retention limit below 14 days. Security incidents may be documented separately with only the information necessary to investigate them.
• Database backups: approximately two weeks locally and 30 days offsite. A removed record may remain in a protected backup until rotation. Access to backups is restricted; retention and applicable erasure requests must be reapplied before restored data returns to ordinary use.
• Cookie choices: 12 months. Optional A/B cookie: 30 days. Optional visit-origin cookie: the browser session; some browsers restore session cookies.

Email correspondence is held separately from the administration database. We review it for ongoing enquiries and legal or business recordkeeping, and delete personal information when no longer needed. Removing an administration entry does not itself remove an email copy. Where a specific legal obligation or dispute requires longer retention, we limit it to the necessary information and period. Aggregate statistics which no longer identify an individual may be retained longer.

6. Your choices and rights

Use Cookie settings or Decline optional cookies on this page or in the site footer. Withdrawal removes both optional first-party cookies and stops their use; it does not affect the lawfulness of earlier processing based on consent. You can continue using the available site without accepting them.

You may request access and a copy of your personal data; correction; erasure where the legal conditions apply; restriction; and, where applicable, portability of data you provided and which we process automatically under consent or contract. You may object to processing based on legitimate interests on grounds relating to your situation. We will stop that processing unless we demonstrate compelling overriding grounds or need the information for legal claims.

Write to info@goodluckmate.com or the postal address above. Include enough information to locate your records; we request additional verification only where reasonably necessary and do not routinely require identity documents. We normally respond within one month. If complexity or the number of requests requires an extension of up to two further months, we explain this within the first month. Requests are normally free. Erasure and other rights are subject to applicable legal exceptions, which we will explain if relevant.

You may complain directly to the Information and Data Protection Commissioner in Malta or the competent authority where you live or work, without first contacting us. This notice may be updated as processing changes; the date above identifies this version.