A visit to Rand Casinos leaves four kinds of trace, and only the last of them depends on the reader's consent. The host keeps a technical record of every request, the place of the connection (its country and, on the pages with operators, its region) is read from its address without the address being stored in a database for that purpose, and a small "cookie" remembers how the reader answered the banner, while the measurement of the pages read and of the links followed exists only after the reader clicks "Accept".
We have written this policy for a reader who wants to know what happens and when, rather than for a lawyer. The legal bases are given with the article of the General Data Protection Regulation ("GDPR", Regulation 2016/679 of the European Union) that supports them, and the first part names the controller, who answers for all of it.
Who controls the data
[OWNER: legal name, address and contact e-mail of the data controller, to be written by the owner]
Hosting and access logs
The site is hosted on Amplify, the hosting service of Amazon Web Services, and every request addressed to rand-casinos.com reaches that service first. Like every host, it keeps technical "access logs" (the record of the requests that reach a server, which includes the address of each connection) for the security of its service, and they last as long as Amazon Web Services keeps them for that purpose, which is the criterion of their retention. The site runs in the Europe (Frankfurt) region of Amazon Web Services, whose network delivers pages from servers in many countries. Where data travel to the United States, Amazon Web Services relies on the EU-US Data Privacy Framework, in which it takes part.
This processing rests on the "legitimate interest" of publishing the site at all, under Article 6(1)(f) GDPR. A page cannot be delivered without the request that asks for it; the request, in turn, cannot travel without an address to answer!
The country and the region of the connection
To show readers who connect from South Africa, the United Kingdom or Australia only what is allowed there, the service that hosts the site (Amazon Web Services) derives from the IP address the country each request comes from and, if it is one of those three, takes the reader to the country's own page (South Africa, United Kingdom, Australia). Nothing is done with the host's result for any other country. The address is not stored for this purpose.
The host recognises countries and not their parts, so the pages with operators also query, for every reader, the Geo Targetly service of TechTurtle, s. r. o., a company of Bratislava, in Slovakia. It receives the IP address, the address of the page and of the previous one, the screen size and the type of browser (the "user agent", the name a browser gives itself), derives from the IP address the region of the connection and, if it is Ontario, Alberta, Québec or one of fourteen American states, takes the reader to the page written for that place.
According to the provider, these data are "processed in real-time" and are "not stored in a database": they appear only in server logs, during debugging, until those logs are deleted, on servers of Google Cloud, at present in the United States, the United Kingdom, Switzerland, Canada, Australia, Singapore and India (each reader reaches the server "closest to their location"). Geo Targetly is among the recipients of the data, which it processes on our behalf as a "processor" (the GDPR's term for whoever processes personal data on behalf of the controller). By the provider's own account, its data processing agreement applies automatically to data from the European Union and the United Kingdom, and for data leaving Slovakia it requires of its suppliers one of the transfer mechanisms of European law.
The robots of the search engines, recognised by their user agent from a list we keep in the service, are not redirected, and the script runs as the page loads, before any answer to the banner, because it profiles nobody: the provider reports to us only how many visits each rule has redirected, in total.
Since the redirect happens in the browser, it does not reach a reader whose browser blocks the script or runs no JavaScript, and the region read from an IP address is an approximation; for those readers the sentence on the markets at the foot of every page still applies.
The reason is the law rather than commerce. Online casino games are not authorised in South Africa or in Australia, in Great Britain they are lawful only on sites licensed by the Gambling Commission, and in the Canadian provinces and the American states above the law reserves them to the sites it authorises or reaches whoever promotes the others, while our links lead to the international sites of the operators; a reader who connects from one of those places is therefore shown the page written for it in place of the pages with operators.
The legal basis of both checks is legitimate interest under Article 6(1)(f), here the interest in not promoting, in a country or a region, what its own law does not allow.
Measurement, only after "Accept"
Nothing designed to measure the reader is loaded before the banner has been answered, and nothing is loaded at all if the answer is a refusal. Google Analytics 4 ("GA4", the audience measurement service of Google) reaches the page through Google Tag Manager (the "container" GTM-TFD39HN, a script whose only task is to load other scripts) after the reader clicks "Accept", never before and never by default.
If you refuse, or leave the banner unanswered, nothing reaches the page from Google and the pages read the same, with the same tables and links, which is as it should be when the measurement serves the site and not the reader!
With consent, GA4 counts the pages viewed and records one "event" defined by the site, called "affiliate_click", which notes, for each click through to an operator, the operator's short name and the link's address. The site is paid by operators when a reader opens an account through its links; the event tells us which pages lead to that click, without telling us who made it.
The legal basis of the measurement is consent (Article 6(1)(a) GDPR), and its recipient is Google, through Google Ireland Limited. The data can reach the United States, where transfers rest on the EU-US Data Privacy Framework and on the "adequacy decision" (the European Commission's finding that data sent there under the framework are adequately protected) adopted on 10 July 2023, still in force when we read the Commission's page on 16 October 2026. GA4 keeps the event data for fourteen months, the retention set in our Google Analytics property, after which Google deletes them.
The choice, and how to change it
The reader's answer to the banner is kept in a "first-party" cookie (one set by rand-casinos.com itself, not by another company) called "rc_consent", which records whether the reader accepted or refused and lasts 182 days, so that the question is not asked again on every page. It stores that answer and nothing else. It is a technical cookie, set whatever the answer, and the cookie policy describes it together with the two cookies of Google Analytics and those of the regional redirect.
Consent can be taken back at any moment, as easily as you gave it: the "Cookie settings" button that every page carries in its footer clears the recorded answer and reopens the banner, and choosing "Reject" there also deletes the "_ga" cookies that Google Analytics had set. From that choice onwards nothing more is measured, on any page, until the reader accepts again.
What the site does not do
Rand Casinos carries no advertising networks and no advertisements served by third parties, and it sells data to nobody, operators included: the commercial side of the site lies entirely in its links to the operators' own sites, and it is there, after the click, that a second set of rules begins.
A click on one of those links takes the reader from rand-casinos.com to a site that applies its own privacy policy and sets its own cookies, and the record of the referral (the "affiliate tracking", the operator's own note of where each new customer came from) is kept on the operator's side. We would advise reading that policy before opening an account, as one reads the terms of a bonus before accepting it.
The rights of every reader
Every reader whose data are processed has, under the GDPR, the right of access (to know what is held and why), of rectification, of erasure, of restriction, of objection (which concerns in particular what rests on legitimate interest, such as the checks of country and region) and of portability. A request needs nothing more than a message to the controller named at the top of this page, or one you send through the contact page.
A reader who considers that these rules have not been respected can also complain to the data protection authority of the country where they live or work; there is no need to write to us first, although we would prefer the chance to answer.
Questions
Does Rand Casinos sell data or show advertising from third parties?
No. The site carries no advertising networks and no ads served by third parties, and it sells no data; its income comes from operators when a reader opens an account through its links.
Is Google Analytics loaded before you click Accept?
No. Google Tag Manager (container GTM-TFD39HN) and Google Analytics 4 wait for the reader to click "Accept"; a reader who refuses, or does not answer, loads nothing from Google.
How can consent be withdrawn?
With the "Cookie settings" button in the footer of each page, which reopens the banner; choosing "Reject" there ends the measurement and removes the _ga cookies that Google Analytics had set.