Skip to content
GCGBS — Global Council of Global Business Services

Privacy Policy

This policy explains what personal data GCGBS processes, why, who we share it with, how long we keep it, and the rights you have.

Last updated 20 June 2026 · Policy version 2026-07-15

Who we are

GCGBS is a directory of Global Business Services (GBS), shared-services, and BPO providers. We act as the data controller for the personal data described below. For any privacy question or to exercise a right, contact us at gcgbs@gcpit.org or use our data request form.

Data we collect

Depending on how you use GCGBS, we may process:

  • Account data — your email address, an optional display name, your role, email-verification status, and authentication metadata (managed by our auth provider; we never store your password).
  • Listing data — company profiles you submit, claim, or manage (name, website, tagline, description, logo, categories and other taxonomy).
  • Leads — when you contact a company through us, the name, email, and message you provide, so they can respond to you.
  • Votes & favorites — the listings you upvote or save, linked to your account.
  • Analytics — pseudonymous listing-view events (hashed session and IP identifiers, user agent, referrer) used to produce aggregate view counts. These are only collected once you accept optional analytics cookies.
  • Consent records — a record of the consents you give (registration, lead contact, cookies), each stamped with the policy version and your IP address as proof.

Why we use your data

  • To operate the directory: create and secure your account, publish and rank listings, and run search.
  • To deliver leads to the verified representative of a company (now or once a company profile is claimed) and to verify that contact emails are deliverable.
  • To prevent abuse, spam, and fraud (rate limiting, bot checks, vote-integrity monitoring).
  • To measure aggregate usage and improve the directory (only with your analytics-cookie consent).
  • To comply with our legal obligations and to keep proof of the consents you have given.

Processors we use

We share data only with the service providers that help us run GCGBS, under data-processing terms:

  • Vercel — application hosting and content delivery.
  • Supabase — authentication, database, and file storage.
  • AutoSend — transactional email delivery.
  • DeBounce and Bouncer — email deliverability verification for leads and sign-ups.
  • Cloudflare — bot protection (Turnstile) and network security.
  • Sentry — error monitoring and diagnostics.

We do not sell your personal data. Some processors operate outside your country; where required, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.

How long we keep data

  • Account, listings, votes, favorites — kept while your account is active; removed or anonymized on account deletion (company listings are detached and retained as they describe a company, not you).
  • Held leads (for unclaimed companies) — kept up to 180 days, then anonymized and purged if not released to a company.
  • Analytics view events — pseudonymous raw events kept 30 days, then purged; only aggregate, non-identifying counts are retained.
  • Consent records — kept as legal proof for 24 months, minimized, then purged.

Your rights

You can request access, a portable export, correction, deletion, restriction, or object to certain processing. Signed-in users can export or delete their data from their account. Anyone — including people who contacted a company through us without an account — can submit a request via our data request form. See our GDPR & data rights page for the full process. You also have the right to complain to your local data-protection authority.

Cookies

We use essential cookies to run the service and optional analytics cookies only after you accept them. See our Cookie Policy to learn more and change your preferences at any time.

Contact

Questions about this policy? Email gcgbs@gcpit.org.