Privacy Policy

1. Controller

2. Scope

This policy covers the public GSM marketing website at https://www.gsm-global.com. It explains processing connected with delivering and securing the site and responding to business enquiries.

It does not describe data processing inside hotel customer deployments and is not a customer data processing agreement. Separate customer documentation governs those deployments.

3. Website delivery, hosting, DNS, and security

Vercel provides hosting and runtime delivery. Cloudflare provides DNS and CDN services and may provide network or security functionality depending on the deployed configuration. Technical request data may be processed to deliver, secure, troubleshoot, and maintain the website.

Typical categories may include IP address, request time, requested path, referrer, browser/user-agent information, network and security signals, response information, and errors. GSM does not maintain a lead database for ordinary website visits. GSM conversion logs are designed to exclude form-message bodies and direct visitor contact data.

Draft legal basis for counsel confirmation: Article 6(1)(f) GDPR — legitimate interests in providing a secure, stable, and functional business website. Provider-controlled log-retention periods depend on provider configuration and agreements and are not stated here.

4. Direct email and telephone contact

If you contact GSM directly, the information processed may include your name, email address, phone number where supplied, company or hotel, message, correspondence, and enquiry context. GSM uses this information to respond, prepare product or demo discussions, manage partnership, press, legal, privacy, or technical requests, and document relevant business communications.

• Article 6(1)(b) GDPR for pre-contractual enquiries.
• Article 6(1)(f) GDPR for other legitimate business communications.
• Article 6(1)(c) GDPR where processing is necessary to meet a legal obligation.

5. Contact and Book Demo forms

The online forms are currently disabled in Production.

If activated later, the Contact form may collect full name, email, company or hotel, enquiry type, message, privacy acknowledgement, and technical submission fields. The Book Demo form may collect full name, work email, hotel or company, role, country or market, property count, room-count range, main priority, preferred contact method, an optional phone or WhatsApp number, an optional message, privacy acknowledgement, and technical submission fields.

Technical source context may include landing path, referrer hostname, UTM source, medium, campaign, content and term, submission time, primary browser language, form version, and a random submission identifier.

No CRM or enquiry database is used. Internal delivery is by email. The visitor email is used as replyTo, not forged as the sender. Demo visitors may receive a confirmation email when forms are active. Required fields support the requested response or discussion; optional fields may be omitted unless the selected contact method requires a number.

Current Production technology status

6. Cloudflare Turnstile

Turnstile is inactive and is not loaded while Production forms are disabled. If forms are activated, it protects Contact and Book Demo against automated abuse. A client-side widget creates a token, which GSM validates with Cloudflare Siteverify before email delivery.Cloudflare may process browser, device, network, interaction, and security signals. Pre-clearance is intended to remain disabled.

Draft basis: Article 6(1)(f) GDPR — preventing spam, fraud, and automated abuse. GSM currently treats storage or access strictly required for an activated anti-abuse form check as necessary to provide the requested secure form service, subject to final review under § 25 TDDDG.

7. Email delivery and Google Workspace

Enquiry messages are delivered to info@gsm-global.com. Google Workspace processes and stores resulting business correspondence.Nodemailer over authenticated Google Workspace SMTP is the server-side transport arrangement, not a separate external recipient. No separate transactional email provider is used, and this workflow sends no bulk marketing email.

8. Success cookies

If forms are activated, gsm_demo_success and gsm_contact_success are set only after successful submission. They are signed, HttpOnly, SameSite=Lax, Secure in Production, limited to the respective thank-you path, and expire after no more than 15 minutes.

They confirm successful submission and guard the thank-you page. They contain signed technical state, form type, timestamps, and a random nonce, but no visitor name, email, message, hotel, or phone. They are treated as strictly necessary to provide the expressly requested submission confirmation and protected thank-you page. No cookie banner is added for these cookies.

9. Analytics and performance

Vercel Web Analytics is disabled in Production.

Vercel Speed Insights is disabled in Production.

Neither service should be activated until its legal basis, this policy text, and any required consent decision have been reviewed.

10. Scheduler and embedded third-party content

No scheduler is configured at launch and no scheduler embed is used. The current marketing site includes no Google Maps, YouTube, social feed, advertising pixel, or general-purpose third-party chat widget. The GSM product’s hotel chat experience is not embedded on this marketing website. Future integrations require privacy and consent review before activation.

11. Recipients and international processing

Recipient categories include Vercel for hosting and runtime;Cloudflare for DNS, CDN, security, and Turnstile if activated; andGoogle Workspace for business email, alongside professional advisers or authorities where legally necessary.

Some providers are headquartered or operate outside the EEA, and processing outside the EEA may occur. Applicable adequacy decisions, contractual safeguards, and provider terms may be relied upon where required. Exact contracting entities, DPA acceptance, subprocessors, and transfer mechanisms must be confirmed before this draft is approved.

12. Retention

Unsuccessful demo or sales enquiries

12 months after the last meaningful contact

General contact enquiries

12 months after the last meaningful contact

GSM-controlled spam and security metadata

30 days

Enquiries that become customer or contract records

applicable contractual, commercial, and tax obligations

Deletion and review owner

Mohamed Elsayed

Review frequency

quarterly

Longer retention may occur where necessary for legal claims, contractual records, commercial duties, or tax obligations. Provider-controlled technical retention follows provider configuration and agreements; no provider duration is stated here.

13. Your rights

Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability where applicable, objection—particularly to legitimate-interest processing—and withdrawal where processing actually relies on consent. You may also complain to a supervisory authority. Exercising a right does not disadvantage you.

Send requests to info@gsm-global.com. GSM may request proportionate identity verification and responds within the applicable statutory framework.

14. Supervisory authority

You may contact the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW). Current contact details should be obtained from the authority’s official website.

15. Automated decisions

The marketing website makes no solely automated decision with legal or similarly significant effect. If activated, Turnstile only determines whether a form request passes a technical anti-abuse check. A failed request does not determine eligibility for GSM products.

16. Changes

This policy will be updated when processing or legal requirements change. Material changes should be reflected before optional services are activated. A final effective or publication date will be set only after legal approval.