Privacy Policy: Data, Cookies and Your Rights
This privacy policy describes how lizaro.biz, an independent review site, handles information about the people who visit it. It covers this website only. It does not describe what the Lizaro operator does with the data of its own players — that is governed by the operator's own policy, which is a separate document on a separate domain, and this site has no access to any of it. No account is opened here, no payment is taken here and no identity document is ever uploaded here.
What personal data is collected
The volume of personal data involved is small, because the site sells nothing and registers nobody. Three categories exist. The first is technical information generated automatically by any web request: a truncated IP address, browser type and version, operating system, screen dimensions, approximate country-level location, and the referring page. The second is behavioural: which pages were opened, in which order, how long each was open, and which outbound links were followed. The third arises only when someone chooses to write — an e-mail address and the content of the message sent to legal@lizaro.biz or privacy@lizaro.biz.
What is not collected is worth stating as plainly. No name, no postal address, no date of birth, no payment card, no bank detail, no identity document and no gambling account credential. This site has no login, no user profiles and no shopping function, so those categories never arise. Nothing is sold to data brokers, and nothing is shared with advertisers.
Purpose of data usage and the legal basis under GDPR
Under the General Data Protection Regulation, every processing operation needs a purpose and a lawful basis, and stating both is not a formality. Data usage on this site falls into three purposes.
| Purpose | Data used | Legal basis | Retention |
|---|---|---|---|
| Site operation and security | Server logs, truncated IP, user agent | Legitimate interest, Art. 6(1)(f) | Up to 12 months |
| Audience measurement | Page views, session duration, referrer | Consent, Art. 6(1)(a) | Up to 14 months |
| Answering correspondence | E-mail address, message content | Legitimate interest, Art. 6(1)(f) | Up to 24 months |
Analytics runs on consent and nothing else: refusing it costs no functionality, since every page of this site is readable without any measurement at all. Where consent is the basis, it can be withdrawn at any time and the withdrawal takes effect from that point onwards. Server logs exist because a site without them cannot be defended against abuse, and they are kept no longer than the security purpose requires.
Cookie policy: which cookies are set and why
The cookie policy of this site divides into two categories, and the difference between them is the difference between necessary and optional. Strictly necessary cookies keep the site working — they remember the language version selected, store the answer given to the consent banner so the question is not repeated on every page, and support basic security functions. They carry no advertising identifier and are set without consent because the site cannot function without them.
Analytics cookies are optional and are set only after consent has been given through the banner. They record which pages are read and for how long, so that thin or outdated content can be identified and rewritten. Consent can be changed at any time through the banner, and browser settings offer a second, independent control: every current browser can block or delete cookies for a specific site, and doing so leaves the informational pages fully readable. Following an outbound affiliate link to an operator hands the visit over to that operator's own domain, where its cookies and its policy apply — a boundary this site cannot see across and does not control.
Your GDPR rights and how to exercise them
The GDPR grants a set of rights over personal data, and they apply to the small amount of data described above. The right of access allows anyone to ask what is held about them and to receive a copy. The right of rectification allows inaccurate data to be corrected. The right of erasure allows its deletion where there is no overriding reason to keep it. The right to restriction allows processing to be paused while a dispute over accuracy or lawfulness is resolved. The right to object allows processing based on legitimate interest to be challenged, including analytics profiling. The right to data portability allows data provided under consent or contract to be received in a machine-readable form. And where processing rests on consent, that consent can be withdrawn at any time without affecting what was lawful before the withdrawal.
Requests go to privacy@lizaro.biz and are answered within one month, as the regulation requires. There is no charge for a reasonable request. Anyone who considers a request badly handled has the right to complain to a supervisory authority: in Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), and residents of other EU member states may approach the authority in their own country instead. Filing a complaint here first is welcome but is not a precondition for going to NAIH.
Third parties, transfers and data protection measures
A small number of processors are involved in running the site: a hosting and content delivery provider that serves the pages, and an analytics provider that receives the measurement data described above. Each acts under contract and none is permitted to use the data for its own purposes. Where a processor operates infrastructure outside the European Economic Area, transfers rest on the European Commission's standard contractual clauses. No personal data is sold, rented or passed to advertisers or data brokers, and the operator whose platform is reviewed here receives no visitor data from this site beyond the ordinary referral information any outbound link carries.
On the technical side, the whole site is served over HTTPS, meaning every page and every form submission travels under SSL encryption rather than in readable form. Data protection also means restraint: the least effective way to lose data is not to hold it, which is why no visitor register, no account system and no document upload exists here at all. Administrative access to the publishing system is limited to the editorial team and protected by two-factor authentication (2FA).
Is it safe to play at Lizaro, and what the operator holds
The question of whether a secure casino is handling data properly is separate from this policy, and it deserves a direct answer rather than a reassuring one. On the operator's side the connection to the cashier is protected by encryption, which is the visible baseline any licensed platform is expected to meet; the padlock in the address bar confirms it before a single field is filled. What the operator retains is broader than what this site retains and necessarily so: identity and contact details for KYC, transaction history because financial regulation requires it, and technical records of logins and devices so that unauthorised access becomes visible. Its own privacy policy sets that list out in full.
Whether that adds up to safe and secure depends on facts beyond encryption. Lizaro runs on an international, Curaçao-type licence and does not appear on the SZTFH register of Hungarian licensees, which affects what recourse a player has if data is mishandled — a GDPR request to an operator established outside the EU is a weaker instrument than the same request to one inside it. On the player's side the effective habits are unglamorous: a password used nowhere else, two-factor authentication switched on where the account offers it, and no logging in from a shared machine. Any request for a copy or deletion of player data goes to the operator's own support desk, described on the support page, because this site holds none of it. The terms governing this site are on the terms of use page.
Changes to this policy
This document is revised when the site's practices or the legal framework change, and the version published on this page is the one that applies. Substantive changes — a new processor, a new purpose, a different retention period — are reflected here rather than announced individually. Continued use of the site after a revision means the current version applies to that visit.