Privacy Policy

GBCORP is committed to transparent, lawful, and proportionate handling of personal data across our 17-country, 4-continent operations. This Privacy Policy explains the legal frameworks we comply with, the personal data we collect, how we use and share it, your rights, and how we maintain ongoing privacy assurance.

1) Our Commitment

GBCORP believes privacy is foundational to trust. We design every system — from gbcorp.org and the GBCORP network to our e-shop, member areas, and sister sites — on the principles of data minimisation, purpose limitation, security by design, and accountability. We process personal data only when we have a lawful basis, and we are transparent about every step.

2) Frameworks We Comply With

This Policy is designed to satisfy our obligations under, and to grant the rights conferred by:

• EU GDPR — Regulation (EU) 2016/679, in force 25 May 2018
• UK GDPR & Data Protection Act 2018 — United Kingdom
• California CCPA & CPRA — California Civil Code §1798.100 et seq., amended by Proposition 24
• India DPDPA 2023 — Digital Personal Data Protection Act, 2023
• Brazilian LGPD — Lei Geral de Proteção de Dados (Law 13.709/2018)
• Canadian PIPEDA — Personal Information Protection and Electronic Documents Act
• Chinese PIPL — Personal Information Protection Law (effective 1 November 2021)
• South African POPIA — Protection of Personal Information Act 4 of 2013
• Australian Privacy Act 1988 and the Australian Privacy Principles
• Singapore PDPA — Personal Data Protection Act 2012
• UAE PDPL — Federal Decree-Law No. 45/2021 on the Protection of Personal Data

Where local law grants stronger rights than this Policy describes, those local rights apply automatically.

3) Personal Data We Collect

We collect only the personal data we need for the purposes set out in Section 5. Categories include:

Identity & Contact Data

Name, email, phone, postal address, business name — provided directly when you register, place an order, contact us, or join the Elite Member network.

Transaction Data

Order history, invoice details, payment confirmations (we do not store full card numbers — those are tokenised by our PCI-DSS Level 1 payment processors).

Technical & Usage Data

IP address, browser type and version, device identifiers, referring URL, pages visited, time-on-page, geographic region. Collected via server logs, Google Analytics 4 (with Consent Mode v2), and Cloudflare.

Marketing & Conversion Data

Cookies and pixel identifiers from Google Ads (formerly Google AdWords) and Meta (Facebook Pixel) for remarketing and conversion attribution — activated only with your explicit opt-in via our self-hosted Consent Mode v2 banner.

Member & Investor Profile Data

Elite Member tier, sector preferences, investment focus — provided voluntarily when joining our Member Section or Investor Column programmes.

Communications Data

Feedback messages, support requests, contact-form submissions, and email correspondence.

4) Legal Bases for Processing (GDPR Art. 6)

• Consent (Art. 6(1)(a)) — marketing cookies, newsletter subscriptions, optional features
• Contract (Art. 6(1)(b)) — order fulfilment, customer support, member services
• Legal Obligation (Art. 6(1)(c)) — tax records (7 years), AML/KYC checks, regulatory reporting
• Legitimate Interests (Art. 6(1)(f)) — security monitoring, fraud prevention, service improvement — always balanced against your rights

5) How We Use Your Data

• Delivering products and services you order from the GBCORP e-shop
• Managing your Elite Member, Investor Column, or partner relationship
• Responding to feedback, support requests, and partnership enquiries
• Securing our infrastructure against fraud, abuse, and unauthorised access
• Meeting accounting, tax, and regulatory obligations across 17 jurisdictions
• With consent: targeted advertising via Google Ads and Meta, audience analytics, product personalisation

We do not sell personal data. We do not engage in solely-automated decisions that produce legal or similarly significant effects without human review (GDPR Art. 22).

6) Cookies, Pixels, and Consent Mode v2

We use a self-hosted Consent Mode v2 banner (GBCORP-built, not a third-party plugin). On your first visit from the EEA, UK, India, Brazil, or any other consent-required jurisdiction, you will see the banner with three actions: Accept all, Reject all, or Customise. Strictly-necessary cookies are set automatically because the Site cannot function without them; Functional, Analytics, and Marketing categories are opt-in.

Your choices are stored in your browser’s localStorage under the key gbcorp-consent-v1 — never on our servers, never shared with third parties.

For the full cookie inventory and durations, see our Cookie Policy.

7) Sharing With Third Parties (Subprocessors)

We share personal data only with vetted subprocessors who have agreed to GDPR-compliant Data Processing Agreements. Current subprocessors include:

• Cloudflare, Inc. — CDN, edge security, DDoS mitigation
• Google LLC — Google Analytics 4, Google Ads, Google Tag Manager
• Meta Platforms, Inc. — Facebook Pixel for advertising attribution
• GoDaddy Inc. — primary web hosting infrastructure
• WP Mail SMTP / iCloud Mail — transactional email delivery
• Firebase Hosting (Google) — sister-site static hosting

The complete current list with purposes and locations is published at Subprocessors. We do not sell or rent personal data to third parties.

8) International Data Transfers

GBCORP operates across 17 countries and four continents. Personal data may be transferred to, stored in, and processed in any of these jurisdictions. Where data leaves the EEA, UK, or another jurisdiction with data-export controls, we rely on:

• European Commission Standard Contractual Clauses (Decision 2021/914 of 4 June 2021)
• UK International Data Transfer Agreement (IDTA) and UK Addendum to the EU SCCs
• Adequacy decisions where available (e.g., UK adequacy decision under EU GDPR)
• EU-US Data Privacy Framework where the recipient is certified under the DPF (post Schrems II)
• Supplementary Measures — encryption in transit (TLS 1.3) and at rest (AES-256) for personal data

Copies of executed SCCs are available on written request to [email protected].

9) Your Rights

Depending on your jurisdiction, you have the following rights, exercisable free of charge by contacting [email protected]. We respond within 30 days (GDPR Art. 12(3)) or 45 days (CCPA §1798.130) unless extended for complex cases.

If you are in the EEA or UK (GDPR / UK GDPR)

• Right of access (Art. 15) — obtain a copy of your personal data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure / right to be forgotten (Art. 17), subject to legal retention obligations
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20) — receive your data in a machine-readable format
• Right to object (Art. 21) — including objection to direct marketing
• Right to withdraw consent at any time (Art. 7(3))
• Right to lodge a complaint with your supervisory authority (Art. 77)

If you are in California (CCPA / CPRA)

• Right to know what personal information is collected, used, disclosed, or sold
• Right to delete personal information collected from you
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing for cross-context behavioural advertising
• Right to limit use and disclosure of sensitive personal information
• Right to non-discrimination for exercising these rights

GBCORP does not sell personal information in the conventional sense. To submit a CCPA verifiable consumer request, email [email protected] with subject “CCPA Request”.

If you are in India (DPDPA 2023)

• Right to access personal data (§11)
• Right to correction and erasure (§12)
• Right to nominate another individual to exercise your rights in case of incapacity or death (§14)
• Right to grievance redressal within reasonable timeframe (§13) — escalation to Data Protection Board if unsatisfied
• Right to withdraw consent (§6(4)) — without affecting prior lawful processing

If you are in any other jurisdiction

You may have rights similar to those above under your local data-protection law — including LGPD (Brazil), PIPEDA (Canada), PIPL (China), POPIA (South Africa), Australian Privacy Act, Singapore PDPA, or UAE PDPL. Email [email protected] and we will respond within the timeframe your local law requires.

10) Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law:

• Account data — for the lifetime of the account, plus 12 months after closure
• Order and transaction records — 7 years (US/UK/EU tax and audit requirements)
• Marketing engagement data — until you unsubscribe, then 90 days on a suppression list
• Server and security logs — 90 days
• Support tickets — 24 months
• Cookie consent records — 12 months (in browser localStorage; renewed on revisit)

11) Data Security

Our security programme is designed to align with international best practice including ISO/IEC 27001 control areas, NIST Cybersecurity Framework principles, and OWASP application-security standards. Specifically:

• Encryption in transit — TLS 1.3 with HSTS enforced
• Encryption at rest — AES-256 for stored personal data
• Web Application Firewall — Cloudflare WAF with custom rules and rate-limit protections
• Access controls — role-based, least-privilege, MFA enforced for administrative access
• Vulnerability management — automated scanning + responsible-disclosure programme (see Vulnerability Disclosure Policy)
• Incident response — documented runbook; data-breach notification within 72 hours per GDPR Art. 33

12) Children’s Data

GBCORP services are not intended for individuals under 16 (GDPR), under 13 (US COPPA), or under the age of majority in your jurisdiction. We do not knowingly collect personal data from children. Parents or guardians who believe their child has provided us personal data should contact [email protected] for immediate deletion.

13) Automated Decision-Making and AI

GBCORP does not make decisions about you using solely automated processing that produces legal or similarly significant effects, within the meaning of GDPR Art. 22 or DPDPA §15. Where automated systems support human decision-making (e.g., fraud-detection scoring, security anomaly detection), a qualified human reviews material outcomes before they affect you. See our AI Use Policy for details on how AI is used within GBCORP services.

14) Data Protection Officer

Our Data Protection Officer (DPO) oversees this Policy and supervises all data-protection matters. The DPO can be reached at:

• Email: [email protected]
• Post: GBCORP Data Protection, One World Trade Center, 285 Fulton Street, Manhattan, New York, USA
• Phone: +1 646 400 0143

15) Supervisory Authorities

If you believe we have not addressed your concern satisfactorily, you have the right to lodge a complaint with your competent supervisory authority — for example:

• EU — your national Data Protection Authority (full list at edpb.europa.eu)
• UK — Information Commissioner’s Office (ICO) at ico.org.uk
• India — Data Protection Board of India (once notified under DPDPA §18)
• California — California Privacy Protection Agency (CPPA) at cppa.ca.gov
• Brazil — Autoridade Nacional de Proteção de Dados (ANPD)
• Canada — Office of the Privacy Commissioner of Canada (OPC)
• Australia — Office of the Australian Information Commissioner (OAIC)

16) Assessment Approach

GBCORP maintains ongoing privacy assurance through a combination of:

• Data Protection Impact Assessments (DPIAs) — for new high-risk processing per GDPR Art. 35
• Subprocessor due-diligence — annual reviews of all third-party data handlers
• Internal privacy reviews — quarterly across product, marketing, and engineering surfaces
• Automated scanning — vulnerability scans and dependency monitoring on every release
• External audit — targeted biennial third-party privacy and security audit
• Responsible disclosure programme — encouraging security researchers to report issues directly

17) Updates and Notification

This Policy is reviewed at least annually and updated when our practices change or new legal frameworks apply. Material changes will be communicated by email to registered users where we have an active relationship, and posted with a refreshed effective date at the top of this page. Continued use of the Site after a material update constitutes acceptance of the updated Policy.

18) Statement Status

This Privacy Policy was last updated on 15 June 2026. Our next scheduled review is December 2026. Our first independent external privacy audit is targeted for Q3 2027; this Policy will be updated to reflect any material findings.

Questions about this Policy or how we handle your personal data? Email [email protected] — we respond within 5 business days.