Who is responsible for your data
Gamitas (“we”) operates gamitas.com and decides how and why personal data on it is processed. In GDPR terms we are the controller.
Data protection questions and requests: [email protected]. A person reads that address; it is not a ticket queue.
What we collect and why
Gamitas is a B2B marketplace, so most of what is on it is information about companies, not people. The personal data we do handle falls into six groups.
1. Enquiries you send to suppliers
Your name, work email, company, the suppliers you selected and your message. We store the enquiry and pass it to the suppliers you chose — and to nobody else. Legal basis: performance of a contract (you asked us to introduce you), or our legitimate interest in running the service you came here to use.
2. Company listings you submit
Your name, work email, job title and the details of the company you are listing. Legal basis: contract — we cannot publish or maintain your listing without it.
3. Your account
Email address, name, the company you are attached to, a session record and the time you last signed in. Staff accounts additionally hold a password, stored only as a salted hash that cannot be reversed. We do not store passwords for supplier accounts at all — those sign in with a one-time link. Legal basis: contract.
4. The market brief, if you subscribe
Your email address, until you unsubscribe. Every email carries an unsubscribe link. Legal basis: consent, which you may withdraw at any time.
5. People named in event programmes and company records
This is the group most directories are quiet about, so we will be direct. The site holds profiles for conference speakers and named company representatives: name, job title, employer, a photograph where the organiser published one, and which sessions they appeared in. It is compiled from published conference programmes and company websites — material the organisers and companies put into the public domain themselves — and each profile links to the source it came from.
Legal basis: legitimate interests — maintaining an accurate professional record of who does what in this industry, which is the reason buyers use the site. We have weighed that against the interests of the people listed: the data is professional rather than private, it was already public, and the profiles carry no personal contact details. If you are named on one and would rather not be, write to [email protected] and we will remove it. You do not need to give a reason, and we will not ask for one.
6. Technical data
Our servers keep short-lived request logs (IP address, page requested, user agent, timestamp) to keep the site up and to spot abuse such as repeated failed sign-in attempts. Legal basis: legitimate interests in security and reliability.
Cookies are covered separately in the cookie policy. Today the site sets only cookies that are strictly necessary plus a record of your cookie choice; nothing is used to track you across other websites.
What we do not do
- We do not sell personal data. There is no version of this where we would.
- We do not pass enquiry details to suppliers you did not select, or to any advertiser.
- We do not build advertising profiles or share data with ad networks.
- We make no automated decisions that produce legal or similarly significant effects about you, and we do not profile you.
- We do not knowingly collect data from anyone under 18. This is a service for people doing their jobs.
Who else sees it
We use a small number of providers, each of which processes data only on our instructions:
- Hosting and database
- Runs the site and stores its records.
- Email delivery
- Sends sign-in links, verification emails and enquiry notifications.
- Analytics
- Only if you consent, and only once we have switched it on — see the cookie policy, which names anything in use at the time you read it.
Beyond that, we share personal data only where the law requires it, or to establish or defend a legal claim. If we are ever acquired, any transfer of data would be subject to this policy and you would be told before it happened.
Where it is stored
Our infrastructure and our providers may process data outside your own country, including outside the UK and EEA. Where data leaves the UK or EEA we rely on the appropriate safeguards the law provides — in most cases the UK or European Commission standard contractual clauses, or an adequacy decision covering the country concerned. Write to [email protected] if you want the specifics for a particular provider.
How long we keep it
- Enquiries
- 24 months, so that both sides can refer back to what was asked.
- Listing submissions
- While the listing is live, and 12 months after it is removed.
- Accounts
- Until you close the account, then 30 days.
- Sign-in links
- 30 minutes, and they stop working once used.
- Sessions
- 30 days, or until you sign out.
- Market brief
- Until you unsubscribe.
- Speaker and representative profiles
- While the underlying source remains public, or until you ask us to remove yours.
- Server logs
- Up to 30 days.
- Editorial change log
- Kept, because it is what lets a correction be audited. It records who changed a record and what it said before — not personal data about visitors.
Your rights
If you are in the UK or the EEA the GDPR gives you the rights below, and we apply them to everyone who asks, wherever they are, because operating two standards would be more trouble than it is worth.
- Access — a copy of the personal data we hold about you.
- Rectification — correction of anything inaccurate.
- Erasure — deletion, where we have no overriding reason to keep it.
- Restriction — a pause on processing while something is disputed.
- Portability — the data you gave us, in a machine-readable file.
- Objection — to any processing we base on legitimate interests, including the speaker and representative profiles described above.
- Withdrawing consent — at any time, without affecting what came before.
- Complaining to a regulator — see below. You can do this without coming to us first, though we would rather you did.
To use any of them, write to [email protected]. We answer within 30 days. We will ask you to confirm your identity only as far as is needed to be sure we are not handing your data to someone else.
If you are not satisfied
You can complain to the data protection authority where you live or work. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EEA it is your national authority, listed by the European Data Protection Board (edpb.europa.eu). We would appreciate the chance to put it right first, but that is your call, not a precondition.
Changes to this policy
When this policy changes, the date at the top of the page changes with it. If a change materially affects how we use data you have already given us, we will tell the people affected directly rather than relying on you to re-read the page.