Last updated: 2026-05-24. This page describes what BonusOracle collects, why, how long we keep it, and how you exercise your rights. If our data collection changes, this page is updated the same day.
Who we are
Data controller: BonusOracle editorial team. Contact for privacy matters: [email protected]. We respond within 30 days as required by GDPR.
What we collect
Cookies (first-party only). We do not load any third-party trackers before you accept the cookie banner. Pre-consent we set four functional cookies:
rev_consent— your choice on the cookie banner (acceptoressential). 180 days.rev_locale— your selected language. 1 year.rev_click— a random 12-character click identifier when you visit an operator via one of our tracked links. Used for affiliate-conversion attribution. 90 days.rev_age_confirmed_24— only set in the Netherlands after you confirm the 24+ age gate. 1 year.
Affiliate click-tracking. When you click /go/casino/{slug} we record in our database: the random click_id, timestamp, your IP address, user-agent string, referrer URL, page placement (which CTA you clicked), position (which rank), and the casino slug. IP + user-agent are personal data under GDPR; we collect them for fraud detection + attribution of affiliate revenue. Retention: 18 months, after which we hash IP + user-agent into a non-reversible aggregate.
Server-side analytics. Page-view counts are aggregated via Cloudflare’s server-side Tag Manager (sGTM) Worker. The Worker strips PII before it reaches any analytics destination. We do not load Google Analytics, Meta Pixel, Hotjar, or any other third-party tag in your browser.
Legal basis
Under GDPR Article 6: (1)(f) legitimate interest for affiliate click logs (operating the publishing business), (1)(a) consent for any optional analytics or marketing cookies that load after you accept the banner, (1)(c) legal obligation for age-gate confirmation (18+/24+ enforcement).
Recipients + international transfers
Affiliate networks (e.g. V.Partners, Cellxpert, direct operator APIs) receive your click_id when you visit an operator — they need it to attribute conversions back to BonusOracle. The click_id alone is non-identifying; the operator’s own account creation flow is what links your identity to it. Our hosting (WordPress + Cloudflare) processes data in EU + US. Standard Contractual Clauses (SCC) apply to US transfers.
Your rights
You have the right to: access the data we hold on you, request rectification, request erasure (“right to be forgotten”), object to processing, restrict processing, and data portability. Email [email protected]; we respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk if you are in the UK, or with your country’s supervisory authority elsewhere in the EEA.
Cookies you can revoke
Click “Manage cookies” in the footer to reopen the consent banner and change your choice. Deleting your browser cookies for bonusoracle.com clears the consent record entirely (the banner re-appears on next visit).
Children
BonusOracle is for adults only. We do not knowingly collect data from anyone under 18 (24 in the Netherlands per Dutch regulation). If you believe a minor has supplied data, email [email protected] and we erase it within 7 days.
Changes to this policy
Material changes are flagged via a banner at the top of the site for 30 days. The “Last updated” date at the top of this page always reflects the current version.