Ask Grace Media for Each Lawful Basis in Writing

27/10/2026 By

Data protection requests to Grace Media (Gibraltar) Limited, the company behind Lady Luckmore, are not a single button press. They are a paper trail, and the operator has to answer each part of it with a specific lawful basis. The myth worth killing is that a blanket “delete everything” email does the job. It does not, and it never will while UK gambling law requires records to be kept. What follows is a working checklist for getting Grace Media to put its reasoning in writing, category by category.

Why a blanket erasure request rarely gets the answer you expect

Under UK GDPR, erasure is not an absolute right. An organisation can refuse when it has a legal obligation to keep the data, and licensed gambling operators have a long list of retention duties tied to their UK Gambling Commission licence 057869-R-334655-008. Grace Media must keep transaction records, identity verification evidence and responsible gambling interactions for set periods. Ask for deletion without naming the categories, and you will likely get a polite refusal citing “legal obligation” as a catch-all.

The fix is to ask for the lawful basis for each data category separately: account registration data, KYC documents, payment records, marketing consent, bonus and promotion history, and self-exclusion flags. A response that lumps all six together under one basis is a response you can push back on. The Information Commissioner’s Office expects controllers to identify the basis for each processing purpose, not just for the relationship as a whole.

There is also a practical point about the Lady Luckmore welcome package, which is hidden until registration. Anything you claim, wager or lose on a bonus is logged against your account and forms part of the processing record. That history matters when you ask what is held and why, so download your account statement before you submit the request.

The self-exclusion check that changes your checklist

Before you send anything, verify whether your account is linked to a GamStop or GamCare self-exclusion record. This is the step most people skip, and it is the one that shapes the whole response. If a self-exclusion flag exists, Grace Media may treat retention of your data as a legal obligation under its licence conditions, even where you have asked for erasure. That is a defensible position, but only if the operator says so explicitly.

Your checklist should therefore include a line asking for the specific lawful basis cited for each data category, and a second line asking whether any GamStop or GamCare record has been applied to the account. If the answer is yes, ask which data categories are retained on that basis, for how long, and whether the flag itself is shared with any third party. If you have never self-excluded, say so in the request. It removes an easy excuse and narrows the basis the operator can rely on.

A category-by-category request template worth sending

Write the request as a numbered schedule, one item per data category, and ask for three things against each: the lawful basis, the retention period, and the recipients or categories of recipient. That format makes a vague reply obvious. It also makes a subject access request easier to satisfy, because Grace Media can answer in the same order rather than assembling a narrative.

Include a line on marketing consent specifically. Consent is a distinct lawful basis from legal obligation, and it can be withdrawn at any time without affecting the lawfulness of earlier processing. If your account has been used for promotional emails about Lady Luckmore promotions, such as those described at https://ladyluckmore-casino.uk/promotions/, or Sweetest Slots prize drops, ask which basis applied to that marketing and confirm the date consent was recorded.

Add a line on automated decision-making. Operators use automated checks at registration and at withdrawal, and you are entitled to know whether any decision that significantly affects you was made solely by automated means. Most answers will be “no, with human review”, but the question is worth asking because the reply is a written record you can rely on later.

Request type What you ask for Typical lawful basis cited Practical trade-off
Subject access request Copy of all personal data plus supplementary information Legal obligation and legitimate interests Broad but slow; expect a month, extendable by two
Erasure request Deletion of named categories only Legal obligation for gambling records Partial success is normal; marketing data is easier to erase
Consent withdrawal Stop marketing processing Consent Fast and usually uncontested
Restriction request Limit processing while a dispute is open Legal obligation Account may be frozen, including withdrawals
Portability request Machine-readable copy of data you provided Consent or contract Narrow scope; excludes derived and inferred data

Timelines, verification and the parts people forget

Grace Media has one month to respond to a data request, extendable by a further two months where the request is complex. In practice, identity verification is the usual source of delay. Expect to supply photo ID and proof of address even though the operator already holds KYC documents from registration. That is lawful, but it is also an opportunity to ask why the existing verification is not sufficient, and to get the answer in writing.

Payment data is another area where the answer is rarely simple. Transactions through PayPal or Google Pay involve processors who are separate controllers for their own purposes. Ask Grace Media to identify which payment data it holds as controller and which sits with the processor. The reply should distinguish the two, and it should name the retention period applied to deposit and withdrawal records.

Bonus and promotion data deserves its own line in the schedule. If you have claimed a Lady Luckmore bonus code, used promo code MEGA for 10 spins on a £10 slots wager, or taken the Weekly Rewards, which awards 10 free spins for a £25 deposit and wager and 20 free spins for a £50 deposit and wager, that history is personal data. Ask what is retained, including the 25 percent max bet rule checks applied to bonus play, and whether any of it feeds automated profiling.

Withdrawal caps and stake limits applied to your account are also personal data. Ask for the record of any limit set, by whom, and on what basis. If the account carries a self-exclusion flag from GamStop or GamCare, this is where the operator should explain how that flag interacts with retention and with any restriction on your data rights.

Finally, name your escalation route in the request itself. State that if the response is incomplete, you will complain to the Information Commissioner’s Office, and that you have noted the operator’s registration with the UK Gambling Commission. Mention that you are aware of GamCare, BeGambleAware and Gamblers Anonymous support routes if the process becomes stressful. That is not a threat; it is a signal that you know the landscape and expect a substantive answer rather than a template.

Send the schedule by email so you have a dated record, keep the acknowledgement, and diarise the one-month deadline. If the reply cites legal obligation for a category, ask for the specific statutory or licence provision relied on. If it cites legitimate interests, ask for the balancing assessment. Two follow-up questions, asked in writing, will do more than a dozen angry emails, and they leave you with a documented chain that a regulator can follow. Do the GamStop and GamCare check first, build the schedule around your actual account history, and treat every reply as a draft until each category has a named basis attached to it.