Privacy policy

• [REGISTERED COMPANY NAME] — the entity that publishes Floath.
• [REGISTERED OFFICE ADDRESS] — the postal address for written notices.
• [DATA CONTROLLER ENTITY] — the controller, if it differs from the publisher.
• [DATA PROTECTION CONTACT] — a named person or role, plus [PRIVACY CONTACT EMAIL].
• [DATA PROTECTION OFFICER, IF ONE IS APPOINTED] — counsel to confirm whether an appointment is required at all rather than assuming one.
• [OPERATING JURISDICTIONS] — the countries Floath is published from and targeted at, which decides which regimes apply.
• [LAWFUL BASIS PER PURPOSE] — one per processing purpose in section 4, not a single blanket basis.
• [RETENTION PERIOD PER RECORD TYPE] — see the table in section 5.
• [HOSTING PROVIDER AND HOSTING REGION] — the processor that receives request data.
• [LOG DRAIN OR ANALYTICS PROCESSOR, IF ANY] — currently none is configured.
• [INTERNATIONAL TRANSFER MECHANISM] — see section 7.
• [SUPERVISORY AUTHORITY AND COMPLAINTS ROUTE] — deliberately blank; see section 9.
• [EFFECTIVE DATE] and [VERSION] — set when the policy is first approved.

Floath is an editorial comparison site for online casinos. It is published by [REGISTERED COMPANY NAME], registered at [REGISTERED OFFICE ADDRESS]. The controller for the processing described on this page is [DATA CONTROLLER ENTITY]. Questions about this policy go to [DATA PROTECTION CONTACT] at [PRIVACY CONTACT EMAIL].

This policy covers the Floath website only. It does not cover the casino operators listed on the site. When you follow a link out of Floath to an operator, you are on that operator's site under that operator's terms and privacy policy, and Floath has no visibility of and no control over what happens there. Counsel to confirm the wording that makes that boundary enforceable rather than merely stated.

The factual position as the site is built today, for counsel to draft against. Floath has no reader accounts: there is no sign-up, no login and no profile for visitors. Nothing in the list below is tied to a name, an email address or a persistent identifier.

One basis per purpose. Do not collapse these into a single line — a blanket "legitimate interests" over the whole page is the failure mode this section exists to prevent.

• Browser storage (saved casinos, comparison tray, theme, consent): held on your device until you clear site data. Floath cannot delete it for you because Floath never receives it.
• Affiliate click records: [RETENTION PERIOD] — counsel to set, with a stated reason rather than a round number.
• Server request and error logs: [RETENTION PERIOD], subject to what [HOSTING PROVIDER AND HOSTING REGION] retains by default.
• Email correspondence: [RETENTION PERIOD].
• Admin sessions: expire on their own, and the cookie is cleared on sign-out.

Floath does not sell data and does not operate a data-sharing arrangement with the casinos listed on the site. The processors that necessarily see request data are [HOSTING PROVIDER AND HOSTING REGION] and, if one is ever configured, [LOG DRAIN OR ANALYTICS PROCESSOR, IF ANY]. Counsel to list every processor with a signed agreement in place and to confirm that this list and the actual infrastructure match before publication — this section goes stale faster than any other on the page.

Following an operator link does not pass any Floath data to that operator. The redirect sends a no-referrer header, so the operator does not receive the page you came from. What the operator collects once you are on their site is governed by their own policy.

Where data leaves [OPERATING JURISDICTIONS], the transfer mechanism is [INTERNATIONAL TRANSFER MECHANISM] and the safeguards are [SAFEGUARDS]. Counsel to complete this against the actual hosting region rather than the region assumed at design time, and to state plainly if no transfer occurs — "we do not transfer data outside X" is a valid and much simpler answer where it is true.

The rights available depend on where you live and which regime applies, which is why they are listed here as a checklist for counsel rather than as a promise. Counsel to state the rights that genuinely apply in each of [OPERATING JURISDICTIONS], the response window, and how identity is verified for a request when Floath holds no account to verify against — that last point is the practical difficulty on a site with no logins.

• Access — a copy of what is held.
• Rectification — correction of anything inaccurate.
• Erasure — deletion, where it applies.
• Restriction — pausing processing while something is disputed.
• Objection — including to any processing based on legitimate interests.
• Portability — where the basis is consent or contract.
• Withdrawing consent — for the analytics and marketing categories, at any time, without affecting anything processed before the withdrawal.
• [ANY ADDITIONAL JURISDICTION-SPECIFIC RIGHTS] — counsel to add or remove per regime.

Counsel to set how changes are notified and whether continued use counts as acceptance. The page footer already records when it was last edited and last reviewed, and who owns it, so the mechanism for showing a change exists — what it needs is the wording.

Privacy questions: [PRIVACY CONTACT EMAIL], addressed to [DATA PROTECTION CONTACT]. Written notices: [REGISTERED OFFICE ADDRESS]. Anything editorial rather than legal — a wrong figure in a review, a listing that should not be there — goes to the editorial address on the contact page instead, so that data requests are not buried in the inbox that handles corrections.