Privacy notice
Effective October 28, 2026. Scope: the website igamingthreatlens.online, its contact form and its email inbox. Frameworks considered: UK GDPR, EU GDPR, PIPEDA in Canada, and the privacy statutes of US states.
1. Controller and contact
iGamingThreatLens is responsible for the personal data described here (the data controller). Direct every privacy matter, including rights requests, to hello@igamingthreatlens.online.
2. Data inventory
A security publication should be able to list exactly what it processes. This is the full list.
| Data | Source | Purpose | Lawful basis | Kept for |
|---|---|---|---|---|
| Name, email address, optional organization, chosen subject, message text | You, through the form or by email | Reading, verifying and answering your message | Legitimate interests (operating an accurate publication and corresponding with readers) | Maximum 24 months after the final exchange |
| Keyed hash of IP address plus timestamp | Generated when the form is submitted | Capping submissions at three per hour per source | Legitimate interests (abuse prevention) | One hour |
itl_contact cookie (random anti-forgery token) | Set by the contact page | Confirming that a submission originated from the genuine form | Strictly necessary; no consent required under UK and EU cookie rules | Browser session |
| Web server access records: IP address, timestamp, requested path, user agent, referrer | Recorded by the hosting platform | Diagnosing faults and investigating attacks | Legitimate interests (site security) | Period configured by the host |
The confirmation checkbox on the form records acknowledgment of this notice and does not serve as a lawful basis. Sensitive categories of data are not needed; please do not include them in messages.
3. Processing that does not occur
- No analytics, advertising tags, tracking pixels, social media embeds, externally hosted fonts or third-party JavaScript.
- No cookie on any page except the contact page.
- No transmission of search queries: the search index is a static file and matching runs locally in the browser.
- No marketing use, mailing list enrollment, profiling or automated decision-making.
- No sale of personal information and no sharing for cross-context behavioral advertising.
4. Processors and transfers
4.1. Processor: Hostinger, for web hosting and email, bound by its data processing agreement. Contracting entities named in that agreement: Hostinger International Ltd, registered in Cyprus; Hostinger UK Limited; Hostinger Global S.à r.l., registered in Luxembourg. Sub-processors on Hostinger's list include Amazon Web Services and Google Cloud.
4.2. Infrastructure may be located outside the recipient's home jurisdiction. Safeguard for transfers out of the UK or EEA to a country lacking an adequacy decision: Standard Contractual Clauses approved by the European Commission, supplemented for UK data by the ICO's International Data Transfer Addendum, both incorporated in the Hostinger agreement.
4.3. Disclosure to any other party happens only if a legal obligation requires it or if it is needed to establish, exercise or defend legal claims.
5. Corrections log
When a message leads to a published correction, the correction entry is retained in the public log. It contains no contact details of the person who reported the issue.
6. Rights requests
6.1. Subject to the law that applies to you, available rights are access, rectification, erasure, restriction, objection and data portability.
6.2. Submit requests to hello@igamingthreatlens.online. Response time is within one month. No fee applies. Identity verification may be required before a request is fulfilled.
6.3. California residents and residents of other US states may exercise access, correction and deletion through the same channel. No personal information is sold or shared as those statutes define the terms, and exercising a right carries no penalty or difference in treatment.
7. Regulators
Unresolved concerns may be escalated to a supervisory authority:
- United Kingdom: Information Commissioner's Office
- European Union: the national data protection authority of your member state
- Canada: Office of the Privacy Commissioner of Canada
8. How the site is secured
Transport is HTTPS only. The form enforces anti-forgery tokens and submission rate limits. SMTP credentials reside outside the web root and cannot be requested over HTTP. Residual risk is reduced chiefly by data minimization.
9. Age
The intended audience is security and compliance practitioners. The site is not directed to persons under 18, and no data from children is knowingly processed.
10. Revisions
Material changes to processing will be reflected here with a new effective date. Conditions of use are published separately in the terms of use.