We use cookies to improve your experience and measure editorial performance. See our cookies policy.

Legal · Data Protection · UK GDPR

Privacy Notice

Last reviewed: May 2026 · This notice applies to all data processed when you visit HighlandStakes.

1. Who we are and how to contact us

HighlandStakes is the data controller for personal information collected via this website. We are registered in England and Wales. Our ICO registration number is available on request. To exercise your data-protection rights or ask any question about this notice, write to us via our contact form or by post to the address we will provide by email on request.

2. What personal data we collect

We collect only the minimum personal data necessary to operate the site. The categories of data we process are as follows:

  • Contact form submissions: name and email address you provide when you write to us. We do not share this data with third parties and use it solely to respond to your enquiry.
  • Cookies and analytics data: pseudonymous identifiers set by analytics tools when you grant consent. This may include pages visited, time on site, browser type, and operating system. No IP address is stored in identifiable form. See our cookie policy for full detail.
  • Affiliate tracking parameters: if you follow an operator link from this site, a click identifier may be stored in the operator's first-party cookie. HighlandStakes does not receive or store your personal data from that process — the operator is the data controller for clicks on their domain.
  • Age and consent signals: we store a sessionStorage flag (no personal data) to record that you confirmed your age within the current browser session. We store a localStorage flag (no personal data) to record your cookie-preference choices.

3. Legal basis for processing (UK GDPR Article 6)

  • Consent (Art. 6(1)(a)): analytics and marketing cookies — processed only when you select "Accept all" or grant specific consent via the preference panel.
  • Legitimate interests (Art. 6(1)(f)): processing contact form submissions to respond to your message. We have completed a legitimate-interests assessment and concluded that our interest in responding to reasonable enquiries is not overridden by your data-protection rights.
  • Legal obligation (Art. 6(1)(c)): we may retain records where required by HMRC, ICO enforcement, or other statutory obligations.

4. How long we keep your data

  • Contact enquiries: retained for 12 months from the date of last correspondence, then deleted.
  • Analytics data: aggregated and anonymised; raw session data deleted after 14 months per our Google Analytics configuration (where consent is granted).
  • Affiliate click records: stored by the operator, not by HighlandStakes. Refer to each operator's privacy policy for their retention periods.

5. Sharing your data

We do not sell, rent, or trade personal data. We share data only with the following categories of recipient:

  • Analytics providers: only where you have granted consent. Data is pseudonymised and processed under a data-processing agreement.
  • Hosting and email infrastructure: our web host and email provider process data as processors under data-processing agreements.
  • Law enforcement: we will disclose data to police or regulatory bodies when legally compelled to do so.

6. Transfers outside the UK

Some analytics processors operate servers outside the UK and the EEA. Where transfers occur, we rely on adequacy decisions or standard contractual clauses approved by the ICO. You can request a copy of the transfer safeguard in place for any specific processor by contacting us via the contact form.

7. Your rights under UK GDPR

You have the following rights in relation to your personal data. To exercise any of them, use our contact form. We will respond within one calendar month.

  • Right of access (Art. 15): obtain a copy of the personal data we hold about you.
  • Right to rectification (Art. 16): correct inaccurate data.
  • Right to erasure (Art. 17): ask us to delete your data, subject to our legal obligations to retain certain records.
  • Right to restrict processing (Art. 18): ask us to pause processing while a dispute is resolved.
  • Right to data portability (Art. 20): receive your data in a structured, machine-readable format where processing is based on consent or contract.
  • Right to object (Art. 21): object to processing carried out under our legitimate interests.
  • Rights related to automated decision-making (Art. 22): we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with the UK's supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk.

8. Withdrawing consent

Where we process data under consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw cookie consent, click the "Cookie settings" button in the footer and deselect the relevant categories, then save. To withdraw consent for contact-form follow-up, email us and ask us to delete your record.

9. Changes to this notice

We review this notice at least annually and whenever we make material changes to how we process personal data. The "last reviewed" date at the top of this page records the most recent review. Continued use of the site following a material change constitutes acknowledgement of the updated notice.

10. Security

We use HTTPS across the entire domain. Access to any stored personal data (contact form submissions) is restricted to named team members only. We do not store payment card data or financial credentials of any kind on this site — all operator transactions happen on the operator's domain, not HighlandStakes.