The inventory first, because it is short

Regulation 2016/679, article 13, requires a site to tell a reader what it does with data about them, and most sites discharge that duty at a length nobody finishes. The honest shortcut here is an inventory, since this site sells nothing, opens no account, publishes no form and has no login at all, which keeps the list to three items.

Those three are the record a web server keeps of each request, the measurement that follows a deliberate press on "Accept", and the working out of which country, or sometimes which "region" (a province or a state, neither of which a country code can express), a request has come from. Nothing on any page here does anything else with data about a reader.

As this notice stands, the measurement container holds no identifier of its own, which means nothing travels to Google even from a reader who has accepted. What follows describes the behaviour once an identifier is in place, and the date printed above this text moves on the day that changes.

What is absent, which is most of the usual list

No registration, no newsletter, no comment box and no contact form appears anywhere on this domain. Nothing about a reader is sold, let, exchanged or handed to anybody for a purpose that is theirs rather than ours.

There is no advertising network in these pages (nor has there ever been one on this domain), no "retargeting" pixel borrowed from any social platform, no "fingerprinting" and no profiling of any description, and nothing here attempts to know a reader who returns. The three advertising permissions in the "consent signal" (the four categories Google reads before storing anything) are refused outright and for good, rather than being left to a reader's answer, because no site in this group sells advertising.

Article 22 concerns a decision taken about a person by a machine, and there is no decision on this site for a machine to take. That makes the paragraph a short one!

The parties, and the name each one carries in law

The "controller" (whoever settles why and how data is handled, and answers for it) is [OWNER: nome e cognome o ragione sociale, con la sede], and every request under this notice should go to [EMAIL: casella della redazione].

No "data protection officer" has been appointed, because article 37 lists the circumstances obliging an appointment and none of them describes a site of this kind, so appointing one would be decoration rather than protection.

Three outside parties handle anything at all, and we name each of them here. Amazon Web Services hosts the pages and is therefore a "processor" (a party acting on the controller's instructions and for no end of its own); Google provides the measurement, as a processor for that work, and on its own account for the services it sells; and Geo Targetly, run by TechTurtle s. r. o. in Bratislava, answers the regional question described below.

What the server itself records

The "access logs" of this hosting (one line for every request answered) hold what the logs of any web server hold: the network address that asked, the time it asked, the page it wanted, the answer it got, the referring page when a browser offers one, and the "user agent" (a browser's own description of itself).

Those lines exist so that a page can be delivered, and so that abuse or an attack can be examined after the event, which is what article 6(1)(f) means by a legitimate interest. They last as long as the hosting keeps them (a span measured in days), and we add nothing to them, cross-reference them with nothing and infer nothing from them.

The measurement, and the button it waits for

Measurement here is Google Analytics 4, delivered by Google Tag Manager, and it begins only once a reader has pressed "Accept". Consent is the basis, on the footing article 6(1)(a) provides, together with the "e-privacy" rule at article 5(3) of Directive 2002/58/EC, which governs anything written to a reader's own device.

Consent in that sense is an act: a scroll is not one, a pause is not one, and going on reading is not one either, whatever a banner elsewhere may have told you.

Once consent exists, Google receives the usual traffic data for a "property" (the account a site reports into) of this type: which pages were opened and in what order, a rough location worked out from the network address, the sort of device and browser in use, and an identifier held inside a cookie. Those names and their lives are set out on the cookie page, next to the single cookie belonging to this site, which holds either "granted" or "denied" and nothing besides.

The order a refusal happens in

Press "Reject" and no measurement occurs, which is worth describing step by step, because the order is the only proof that a banner does what it claims. The "container" (the file Tag Manager would otherwise deliver) is never requested, so nothing belonging to Google is fetched or executed and no identifier comes into being; an analytics cookie surviving some earlier acceptance is then wiped, for the bare host name and for the "subdomain" (any address sitting below this one) form as well, which is the half most implementations forget.

A reader who accepted and has changed their mind gets the same outcome within the second. The property is switched off, consent is declared denied, those cookies are removed, and the page then reloads with no container in it.

That last step carries more weight than it looks, since a container already resident in memory would otherwise keep recording the scrolling and the departure from the page in front of you, and would write back the very cookies that had just been cleared.

The one event this site sends of its own accord

When a reader opens a link to an operator, a small script of ours places an "event" (a named message dropped into the page's "data layer", where a container collects it) carrying the operator's short name and the address followed. It shows us which of our cards are being opened and reveals nothing whatever about the person opening them.

That script runs on every page, consent or no consent, but it only ever writes into the page itself. With no container present there is nobody on the other end to receive what it writes, which is the state of things at the date above.

Reading a country out of an address

Some markets forbid the promotion of an operator holding no licence of theirs, so the pages a reader is offered have to vary by country. Two separate mechanisms do that, and they differ in a way worth understanding.

The first lives in the hosting, where it reads the country from the network address of the request and answers with the page built for that country in place of the general one. That address is not retained for the purpose, nothing leaves the hosting, and no script is involved. The same rules cover the links to operators, not merely the pages, so somebody reading from one of those places cannot follow such a link at all.

The second of them runs inside the browser, for two reasons. A province is invisible to the hosting, which sees a country and no more; and a network address cannot distinguish a reader from a search engine's "crawler" (the program sent out to read a page), most of them working from American addresses, where a robot announcing itself can instead be left alone.

Geo Targetly performs that second check, and its provider states that the service is given the network address, the page address, the referring page, the screen size and the browser type, and that it works a location out of the address; the provider adds that these are handled as they arrive, that they are held in no database, and that they last in server logs only while a fault is under investigation, on Google Cloud machines in several countries.

That check is installed now, and the host it speaks to is g10498469755.co (an address Geo Targetly hands out to the site that buys the service, which is why it carries no recognisable name). It runs on the pages that carry operators and on no other, which leaves the market pages, the legal pages and the one answering for an address we do not have untouched by it. That is not an accident. It also runs before the banner has been answered, because a reader who must not be shown those brands (someone reading from Ontario, say) cannot be shown them first and asked about cookies afterwards. The robots named in what the service calls its "user agent whitelist" are passed over instead of being sent anywhere. Nothing else here reaches outside, since the two stylesheets, the typefaces, the images and the three scripts are served from this domain alone, and the check writes no cookie whatever, because the setting that governs that, the one called "Cookie Time", is left at zero. Not one cookie, then, for what the trade calls a "geo redirect" (a name that says plainly what it does), a mechanism that most sites of this kind would happily have remember you from one visit to the next, and that is a choice rather than an oversight!

Both mechanisms rest on the legitimate interest of obeying each country's advertising rules for gambling, which is the ground article 6(1)(f) provides, and an objection can be sent to us at the address above. Two limits on them are worth your knowing. A location worked out this way is an "approximation" and never a fact, while a browser set to block scripts simply leaves its reader where they were.

What crosses the Atlantic, and on what footing

All three outside parties are established in the United States, so a portion of what is described above is handled beyond the European Economic Area. Where a party holds EU-US Data Privacy Framework certification, a transfer stands on the "adequacy decision" the Commission took on 10 July 2023; absent certification, the footing is those "standard contractual clauses" that the Commission has published, with whatever additional measures the party in question documents.

The framework keeps a public list of who is certified and who has fallen off it, and that list is a better authority on the question than any sentence of ours could be!

How long each of the three lasts

The server logs last for the days the hosting keeps them, and nobody here extends that. The measurement data lasts for whatever "retention" the property is set to, and a standard property may be set to one of two figures only (two months, or fourteen), so fourteen is our ceiling; two would leave a year with nothing to be compared against.

The record of your own answer to the banner lasts 182 days (the span of the single cookie we write for ourselves), after which the question comes round again. Nothing is held on the chance that it proves useful later, which explains why most notices of this kind print a retention period with no number in it.

The rights, and a complaint that needs nobody's permission

The rights that articles 15 to 22 confer are available here in the ordinary way: to see the data concerning you, to have it corrected, to have it erased, to have the processing restricted, to object where it rests on a legitimate interest, and to have it ported wherever consent or a contract is the basis. A consent given at the "banner" can be withdrawn whenever you like, through the control labelled "Cookie settings" in the footer of every page, and taking it back costs you precisely what giving it cost.

Requests reach us at the address near the top, and an answer follows inside the month that article 12(3) allows. Where a request cannot be met it is refused with the reason attached, because a reasoned refusal gives you something to push against and a silence gives you nothing.

Anyone who believes the handling described here to be unlawful can complain to a "supervisory authority" (a national regulator for data protection), choosing either the one covering the controller's establishment or the one covering their own home or workplace. Nobody has to write to us before writing to them.

Where this notice runs out

Several links on these pages open an operator's own site, and this notice has nothing to say about what happens after you arrive at one. From that point the operator is the controller of whatever it gathers, on its own terms and under its own licence, and no one here has any sight of an account, a document or a balance held there. The clicks themselves reach us as totals only, and only when consent is in place.

Gambling belongs to adults, and eighteen is the floor on every page of this site, nineteen in the provinces setting it there, and nothing published here is aimed at children or knowingly collects anything about them. A changed version of this notice carries a fresh date above it, and a change to what is collected, or to the reason for collecting it, goes on the banner rather than between two paragraphs where nobody would meet it.