GDPR & Your Data Rights

Your rights

Under the GDPR and UK GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Portability — receive your data in a structured, machine-readable format (we provide a JSON export).
• Rectification — correct inaccurate or incomplete data.
• Erasure— have your personal data deleted (the “right to be forgotten”).
• Restriction & objection — limit or object to certain processing, including processing based on legitimate interests.
• Withdraw consent — for anything based on consent (such as analytics cookies), at any time.
• Complain — lodge a complaint with your local supervisory authority.

How to export or delete your data

• If you have an account: sign in and visit your account to download a full JSON export (account, votes, favorites, leads sent, listings owned, and consent records) or to request deletion.
• If you do not have an account — for example, you contacted a company through us as a visitor — use our data request form to request access or deletion of the data tied to your email.

Deletion runs as an asynchronous job. Your account and authentication identity are removed; your votes and favorites are deleted (and any affected vote counts recalculated); leads you sent are anonymized on both sides; company listings you owned are detached and retained (they describe a company, not you), while a personal profile is deleted. We retain consent records and audit history as required by law, minimized and time-limited. Once complete the data is no longer reachable through any normal path.

Legal bases for processing

We rely on the following legal bases:

• Contract — to run your account and provide the directory features you use.
• Legitimate interests — to secure the platform, prevent abuse and vote manipulation, and deliver leads to the correct company representative.
• Consent— for optional analytics cookies and for delivering your lead message to a company’s verified representative.
• Legal obligation — to keep proof of the consents you have given.

Processors

We share data only with the processors that help us operate GCGBS, under data-processing agreements: Vercel (hosting), Supabase (auth, database, storage), AutoSend (transactional email), DeBounce and Bouncer (email verification), Cloudflare (bot protection), and Sentry (error monitoring). Where data is transferred outside the EU/UK, appropriate safeguards such as Standard Contractual Clauses apply. We do not sell personal data. See the full list and purposes in our Privacy Policy.

Retention summary

• Account, listings, votes, and favorites — kept while your account is active; removed or anonymized on deletion.
• Held leads (unclaimed companies) — up to 180 days, then anonymized and purged.
• Analytics view events — pseudonymous, kept 30 days, then purged (aggregate counts retained).
• Consent records — kept 24 months as legal proof, then purged.

Contact & data protection

To exercise any right or ask a question, email gcgbs@gcpit.org or use the data request form. We respond to verified requests within one month, as required by the GDPR.