Privacy Policy

Who we are and what this policy covers

MCDONALDSMENUUK operates the game discovery website at https://gamebox.mcdonaldsmenuuk.com. The site contact responsible for this service is MOHAMMAD WASEEM YAQUB, reachable at [email protected]. This policy explains information handled through our own pages and the privacy implications of loading independently hosted games. For questions or to make a privacy request, contact [email protected]. We do not require a MCDONALDSMENUUK account to browse or play.

Third-party developers and hosting providers operate the embedded games. Their own notices apply to information they collect inside those games. Our inclusion of a game does not make us its developer or the controller of every use of information by that provider.

Current features and advertising status

The homepage, all eight game category pages and individual game detail pages load the Google Publisher Tag library from Google. The homepage defines two advertising placements, each category page defines a Content3 placement, and each game detail page defines Content2 and Content3 placements. Game detail pages request Content3 advertising below the main game card and above the gameplay introduction. They also request Content2 advertising after the gameplay questions and before the information panel in the document reading order. Each category page requests Google-managed advertising in a placement below the category introduction and above the category navigation. Loading that library connects your browser to Google, which receives connection information such as your IP address and browser details. The homepage requests Google-managed advertising and includes placements between the featured games and the game catalogue, and between the two catalogue sections. A configured placement does not guarantee that an ad will be returned. No first-party analytics tags or third-party consent platform are installed. Browsing a game detail page does not load that game's external frame. A third-party game connects only when you open its dedicated play page using Play. That choice allows the connection; it is not consent to personalized advertising or all processing by the game provider.

The homepage uses Google Ad Manager tags. Google AdSense and Ad Exchange (AdX) are discussed below where relevant to configured or potential demand. This is not a claim that Google has approved this website or that every described processing activity currently occurs. Before enabling advertising we must update actual partner disclosures and implement the required consent and opt-out tools.

Information involved in using the website

• Connection and security information: your browser sends an IP address, request URL, timestamp, browser and device information, and potentially a referring page to the infrastructure serving the site. Hosting and security providers may keep operational logs according to their configuration.
• Saved games: if you select Save game, game identifiers are stored in local storage on your device. No account, name or email is needed. These favorites are not intentionally transmitted to a MCDONALDSMENUUK profile server.
• Recently played: local storage keeps up to 20 game identifiers and the times you opened them, for up to 30 days. This history stays in this browser and does not save your in-game progress. You can clear it from Recently played or Privacy choices.
• Discovery state: session storage holds the previous homepage selection so the next visit can show a different ordering. Search and category filtering run in the browser; our interface does not send search terms to a dedicated analytics endpoint.
• Messages you send: contacting us by email provides your email address, message and any attachments you choose to include. Our email provider processes that correspondence.
• External games: once loaded, a game host receives connection information and may process game actions, identifiers, cookies, local saves, audio settings, progress and advertising data under its own policies.

We do not ask for payment information, a precise location, government identifiers, contacts, camera or microphone access. Please do not include sensitive personal data in support emails.

How Google AdSense, Ad Manager and AdX would work

Advertising can help fund catalogue maintenance and editorial work. Google AdSense provides publisher advertising services. Google Ad Manager can manage advertising inventory and demand, including eligible demand from Google Ad Exchange, commonly called AdX. These products have different account and approval arrangements. Naming them here does not mean that we have an approved account, an active AdX relationship or a guarantee of advertising availability. The homepage includes Google advertising-library setup and a Google-managed advertising placement.

If advertising is enabled, a page containing an advertising unit may send an ad request to Google and, depending on the enabled settings and auction, other participating advertising businesses. These can include exchanges, demand-side platforms, buyers, ad servers, verification and measurement providers. An ad request may be processed even when no ad is ultimately displayed. Recipients depend on actual partners, location, choices and product settings.

Information involved can include the page URL and context, IP address, browser characteristics, device type, language, approximate location derived from IP address, permitted cookie or device identifiers, consent or opt-out signals, and details of ad requests, impressions, viewability and interactions. We do not request GPS location for advertising, upload our support mailbox as an audience list or intentionally put names and email addresses into ad parameters. Local saved games and recent-game history are not uploaded by this website as advertising audiences.

Personalised, contextual and limited advertising

Personalised advertising may use permitted information about previous activity on this and other websites or apps to select an advertisement. Google and its partners may use advertising cookies or identifiers to recognise a browser and associate it with interests, subject to applicable choices and law. Contextual advertising instead considers information such as the subject of the current page, general location, language or device type.

Non-personalised advertising may still involve cookies or identifiers for frequency limits, reporting, security and invalid-traffic prevention. It does not automatically mean that no personal data is processed or that consent is unnecessary. Limited advertising and restricted data processing are product-specific modes with their own conditions. We will not describe them as universally exempt from privacy requirements. Where a request cannot lawfully be made, the relevant optional processing should remain disabled.

Clicking an ad can take you to a separate advertiser website. Its privacy notice and terms apply to information you provide there. We do not receive payment information you submit directly to an advertiser. An advertisement is not a recommendation or endorsement by this website.

Advertising partners and separate responsibilities

Google and some advertising participants may act as independent controllers, while other service providers may process particular information on our instructions. Roles depend on actual services and contracts; not every partner is our processor. We have not established a final advertising-vendor list for the configured services. Before advertising starts, the applicable notice and consent interface must identify actual participating vendors, relevant purposes and their privacy information. We do not present an invented network list as a record of current recipients.

Read Google’s Business Data Responsibility information, How Google uses information from sites or apps that use its services, and Google’s Privacy Policy. Manage Google advertising preferences through My Ad Center. These settings do not necessarily stop all ads or erase existing data.

EEA, UK and Switzerland: consent requirements

Where GDPR, UK GDPR, ePrivacy rules or similar requirements apply, optional storage and processing need the appropriate legal basis and any required prior consent. Consent must be informed, specific and withdrawable. Browsing, choosing Play or agreeing to our service terms is not consent to personalised advertising. Consent for one purpose is not permission for unrelated processing.

Before relevant Google advertising is served in the European Economic Area, United Kingdom or Switzerland, applicable Google consent requirements must be implemented, including a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework where required. This privacy notice and a self-written cookie banner cannot substitute for the necessary platform or choice enforcement.

The deployed platform should explain its vendors and purposes and offer the choices required by applicable rules. Where consent applies, you should be able to refuse optional purposes and reopen the platform to change or withdraw your decision. Withdrawal applies to future processing and does not automatically erase information lawfully processed before withdrawal. Security or other essential processing may rely on another lawful basis.

The current footer Privacy choices dialog only manages this website’s local saved games, recent history and discovery state. It is not an advertising consent manager, does not transmit a TCF choice and cannot manage another domain’s storage. An actual advertising-choice route must be supplied when advertising is introduced.

US state rights, sale or sharing and preference signals

If an applicable US state privacy law covers our activities and your request, rights may include access, correction, deletion, portability and opting out of certain targeted advertising, sale or sharing. These terms can cover advertising disclosures even when no money is paid for a particular record. Applicability depends on the law and actual processing; accessibility of a website in a state alone does not establish every legal threshold.

The homepage loads Google’s advertising library and requests Google-managed ads. We do not send a first-party advertising audience list to an exchange. If future advertising involves a regulated sale, sharing or targeted-advertising activity, appropriate notices and opt-out mechanisms must be in place before it starts. Where legally required, recognised universal preference signals, including Global Privacy Control, must be honoured by the deployed system and communicated to relevant partners. The current local-data dialog does not implement those advertising signals.

Send a rights request or applicable opt-out request to [email protected]. An authorised agent should explain their authority; proportionate verification may be needed. We do not require a new account or discriminate for exercising applicable rights. If an appeal right applies, reply with “Privacy appeal” and explain why you seek review. We do not knowingly use sensitive personal information to infer advertising characteristics or permit prohibited child-data advertising. We do not offer financial-incentive programmes linked to personal data.

Purposes and legal bases

We use information needed to deliver requested pages and features, maintain security, troubleshoot errors, answer correspondence, respect rights requests and comply with applicable obligations. Where the GDPR or UK GDPR applies, relevant bases may include providing a requested service, legitimate interests in a functioning and secure website, compliance with a legal obligation, and consent for processing that legally requires it. We assess the circumstances of the particular processing; a legal basis is not a blanket permission for unrelated use.

Where required, optional cookies, advertising personalization and associated data processing must depend on prior valid consent. You may withdraw consent without affecting the lawfulness of processing carried out before withdrawal. Merely browsing, accepting the service terms, or loading a game does not replace legally required consent.

Cookies and device storage

Browser settings can block or delete cookies and site data, including third-party storage. Blocking storage can affect saved games or game functionality. The Privacy choices controls clear MCDONALDSMENUUK's three storage keys; they cannot delete storage held on another domain.

Planned Google advertising and data use

If we enable Google AdSense, Google Ad Manager or AdX, third-party vendors including Google may use cookies, web beacons, IP addresses, device identifiers and similar technologies to serve and measure ads. Those vendors may serve ads based on your previous visits to this website and other websites. Google's advertising cookies enable Google and its partners to present ads based on visits to this and other sites across the Internet, subject to applicable permissions and settings.

Ad-related processing can include ad delivery, frequency capping, aggregate reporting, viewability and performance measurement, fraud and invalid-traffic detection, security and, when permitted, personalization. Non-personalized advertising can still involve cookies or other storage for functions such as measurement and fraud prevention; it does not automatically remove consent obligations.

Read How Google uses information from sites or apps that use its services, Google's Privacy Policy and Google's advertising technology information. Read Google’s Business Data Responsibility information for its advertising services. Manage Google's personalized advertising through My Ad Center. Additional industry choices are available through DAA WebChoices and Your Online Choices. These controls may be specific to a device or browser and do not necessarily stop all advertising.

We have not supplied an active AdX buyer or advertising-network list for this version because no such MCDONALDSMENUUK integration is enabled. Any future consent interface must identify actual participating vendors, their purposes and privacy notices. We do not send names, email addresses or other directly identifying personal information to Google through advertising tags.

Consent and advertising choices

Before serving relevant Google ads to visitors in the European Economic Area, United Kingdom or Switzerland, we must implement the applicable Google consent requirements, including a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework where required. Optional tags must respect the choices collected by that platform. A generic notice or our local Privacy choices dialog is not a substitute for that certified platform.

You should be able to review, refuse or change optional purposes and withdraw consent through the deployed consent platform when advertising is introduced. At present, Privacy choices explains the current advertising configuration and lets you clear the site's saved game and discovery data. For other requests, email [email protected].

Recipients and international processing

Information may be processed by hosting, security and email service providers as needed to deliver those services; by game hosts you choose to connect to; and, if enabled in future, disclosed advertising and consent-management partners. We may disclose relevant information when legally required, to respond to valid process or to protect users and the service against abuse. We do not operate a first-party personal-data marketplace.

Infrastructure, email and game providers can process information in countries other than your own. Where applicable, transfers of personal data require an appropriate legal mechanism and safeguards. Contact us for details about a specific MCDONALDSMENUUK-controlled transfer; independent game providers are responsible for their own transfers and notices.

Retention and security

Local favorites remain until you remove them or clear browser data. Recently played history retains up to 20 entries for up to 30 days; expired entries are ignored and removed when the history is next read or updated. Discovery state lasts for the browser tab session. We keep support correspondence only as long as reasonably needed to address the matter and meet legitimate legal or security needs. Operational log retention depends on the hosting provider's configuration. We do not claim a fixed log-retention period that has not been verified with the production host.

We use proportionate measures to protect information and minimize unnecessary third-party requests. No website, transmission or external game can be guaranteed completely secure. Report suspected security issues privately to [email protected]; include the affected URL and sufficient detail to reproduce the issue without exposing other visitors' data.

Your privacy rights

Depending on your location and applicable law, you may have rights to access, correct, delete or receive a copy of personal information, restrict or object to processing, withdraw consent, and complain to your local data-protection authority. If relevant US state privacy laws apply, these may also include rights to know, data portability, and opting out of a sale, sharing for cross-context behavioral advertising or targeted advertising. We do not currently deploy first-party targeted-advertising tags. If future advertising falls within those definitions, appropriate opt-out mechanisms and recognition of legally required preference signals must be implemented before that processing begins.

To request help, email [email protected] with the subject “Privacy request” and describe the request and relevant interaction. We may ask for proportionate verification, will not require unnecessary sensitive documents, and will respond within applicable legal deadlines. We will not discriminate against you for exercising applicable rights. If an applicable right to appeal exists, reply to our decision asking for review. Browser Do Not Track settings do not have a universal response standard; do not rely on that setting alone as an opt-out mechanism.

Children and families

MCDONALDSMENUUK is a general-audience discovery service, not a service specifically directed at children under 13. We do not knowingly solicit personal information from children under 13, or below a higher applicable local age without appropriate authorization. Families should supervise access to external games, which can have separate content, advertising and age requirements. A colorful cover is not an age rating.

If you believe a child has provided us personal information, contact [email protected] so we can investigate and take appropriate action. Do not send additional information about a child beyond what is necessary to identify the concern. We do not knowingly permit personalized advertising based on the data of users for whom that processing is prohibited.

Updates and contact

This policy was updated on November 3, 2026. We will revise the date and disclosures when relevant features, partners or practices change, and provide additional notice or obtain new consent when required. Questions and complaints can be sent to [email protected]. You may also review our Terms of Service, Cookie Policy and Contact page.

How privacy requests are handled

State the right or question involved and enough context to locate the relevant interaction, such as an approximate date and subject of an earlier support message. We may ask for additional information only when reasonably needed to locate records, verify authority or protect another person’s privacy. Do not send identity documents unless we explain the necessity and provide a suitable process. We respond within applicable deadlines and explain permitted extensions where required.

Some information may need to be retained for legal obligations, security, fraud prevention or legal claims. We will explain a refusal or partial response where required. For information held only in browser storage, we can explain the controls but cannot remotely inspect or erase it. Independent game providers and advertisers must handle requests for information they control.

We do not use this catalogue to make solely automated decisions about credit, employment, housing, insurance or comparable significant matters. A shuffled game selection is a discovery feature. You may complain to your competent authority, including the UK Information Commissioner’s Office where relevant. Contacting us first does not remove a right to approach a regulator directly.

Retention, deletion and international transfers in practice

Different records have different purposes and retention periods. Favourites stay until removed; recent-game entries are limited to 20 items and expire after 30 days when the feature is next read or updated. Session discovery data normally lasts for a tab session, although browser session restoration can preserve session state. These are device features, not server-side user profiles.

Support correspondence is kept while reasonably needed to resolve the matter and meet legitimate legal or security needs. Production hosting-log periods and any future advertising-cookie periods must be confirmed against the actual configuration. We do not invent one fixed retention period for every service. Where backups exist, removal from active use may precede expiry of a backup cycle, subject to applicable obligations.

Hosting, email and advertising services may process information across borders. Where applicable, transfers require an appropriate mechanism, such as an adequacy decision or recognised contractual safeguards, with additional measures when needed. The mechanism depends on the recipient and destination. We do not assert that every external game provider belongs to a particular transfer framework. Ask [email protected] about safeguards for a transfer we control; provider-controlled transfers are explained by that provider.

Unexpected content and security reports

External games may load services and advertisements from other domains. A game or destination can change without advance notice. Check its address before sharing information. Stop if a page unexpectedly asks for a software installation, payment, password or sensitive information, and report the listing rather than providing that information.

Send concerns privately to [email protected] with the exact page URL and a short factual description. Do not collect other visitors’ information or test against their accounts. We may restrict or remove access while reviewing a report, but cannot promise a particular provider response. The notice will be updated as actual partners, features or practices change; an update cannot retroactively provide consent.