Privacy Policy
Last updated 12 October 2026
Scope and controller
This Privacy Policy explains how Gambling Consulting Authority LLC (GCA), a Georgian limited liability company with identification number 405200303, processes personal data in connection with gcauthority.com, website enquiries and requests for information. References to “GCA”, “we”, “us” and “our” mean that company. Registered address: 48 A. Politkovskaya Street, Apartment 404, Vake District, Tbilisi, Georgia. Privacy contact: info@gcauthority.com.
This policy covers the public website and related communications. A separate engagement agreement or privacy notice may apply to consultancy projects, client due diligence or paid services. This policy does not replace those documents.
We process personal data under the Law of Georgia on Personal Data Protection, No. 3144 of 14 June 2023, as amended. Other mandatory data protection rules apply where their territorial and material scope covers the processing concerned.
Personal data we collect
Depending on the form you use and the information you provide, we collect your name, work email address, company, job title, jurisdiction or country of interest, the text of your enquiry and related correspondence. If you request a report or briefing, we also process the details needed to deliver the requested material.
Technical information may include your IP address, browser type and version, operating system, request time, referring page and website access or error logs. Forms may capture referral information, including campaign or UTM tags, to identify the source of an enquiry. The website version covered by this notice has no active analytics or marketing trackers. Its necessary cookies and browser preference storage are described in the Cookie Policy. When you answer the cookie banner, we also record your answer on our own server, together with your IP address and browser user-agent string; this is explained under Purposes and legal grounds below.
Please provide only information relevant to your request. Do not send identity documents, payment card information, health information or other sensitive personal data through a general website form. If a project requires additional information, we will explain the purpose and arrange an appropriate collection channel.
Providing enquiry details is voluntary. Without a usable contact address or sufficient information about your request, we may be unable to respond or send the material you requested. Where a form marks a field as required, that requirement relates to completing that form and is not, by itself, a statutory obligation.
Purposes and legal grounds
Enquiries and requested materials. We use contact and enquiry information to respond, clarify your needs, provide requested reports or briefings and maintain the relevant correspondence. Our basis is our important legitimate interest in responding to business requests and communicating with prospective clients, subject to your overriding rights and interests. Where you personally request steps towards a contract with us, we may instead rely on the pre-contractual or contractual basis. For representatives of corporate clients, the relevant basis is generally legitimate interests.
Website operation and security. Technical logs and necessary session information are used where needed to operate the website, handle forms, investigate errors, prevent misuse and protect systems. The basis is our important legitimate interest in maintaining a secure and functional website, subject to the required balancing of interests. No optional audience measurement or marketing tracking is currently active. Introducing such tools requires an updated notice and the necessary consent before activation.
Cookie consent records. When you answer the cookie banner, we record the date and time, the categories you selected, the version of the Cookie Policy then in force, your IP address and your browser user-agent string. We use these records only to demonstrate that a valid choice was obtained and what it covered. The basis is compliance with our obligation to be able to demonstrate consent and, where that obligation does not apply to a particular record, our important legitimate interest in evidencing our own compliance, subject to the required balancing of interests. These records contain no name or email address and are not used to identify you, to build a profile or for marketing.
Newsletter and promotional communications. Where you separately opt in to a newsletter or promotional communications, we use only the information covered by that opt-in to send the communications you selected. The basis is consent. Submitting an enquiry, requesting a report or accepting necessary cookies does not enrol you in marketing. Where marketing uses information beyond basic contact details, such as your job title or jurisdiction preferences, we obtain the written consent required by Georgian law, including through an appropriate electronic opt-in.
Legal requirements and claims. We process information where needed to comply with an applicable legal obligation or, on an appropriate lawful basis, establish, exercise or defend legal claims. We do not treat this as permission to retain all website data indefinitely.
Marketing choices
You may withdraw marketing consent at any time, without charge, through the unsubscribe method in the communication or by emailing info@gcauthority.com. We must stop direct marketing within a reasonable period and no later than seven working days after receiving your request. Withdrawal does not affect the lawfulness of earlier processing.
Stopping marketing does not prevent a response to your enquiry or a necessary service communication. Newsletter consent and cookie consent are separate choices.
How long we keep information
We retain personal data for the period necessary for its stated purpose. Where a fixed period cannot reasonably be determined, we use the criteria below rather than promise an automatic deletion date.
Enquiries and report requests are retained while we handle the request and any reasonably necessary follow-up. Further retention depends on an ongoing business relationship, outstanding issues, applicable legal obligations and the necessity and proportionality of keeping evidence for a legal claim. When none of these reasons remains, the data must be deleted or anonymised.
Where you subscribe to a mailing list, your subscription details are used until consent is withdrawn, the subscription ends or the mailing list is discontinued. A limited record of consent and withdrawal must be retained during direct marketing and for one year after it stops. A minimal suppression record may be retained where necessary to respect your unsubscribe request; it is not used to send marketing.
Technical logs are retained according to their operational and security purpose, including whether an incident remains under investigation. The two necessary cookies have a configured lifetime of two hours, which may be renewed when the server sets them again during use. The gca_consent preference record remains in your browser’s local storage with no automatic expiry; the website asks for your choice again 365 days after the recorded date, and sooner if the version of the Cookie Policy changes. Entries in our cookie-consent log are retained for 24 months from the date of the entry and are then deleted automatically. Because we ask for a cookie choice again after 365 days, an entry older than that already relates to a superseded or expired choice; the remaining period leaves room for a question about that choice to be raised and answered. Legal holds or binding retention duties may justify keeping specific information longer, without authorising unrelated continued use.
Recipients and service providers
Our website hosting and business email provider is ProService LLC, identification code 204929168, located at 3 P. Kavtaradze Lane, Tbilisi, Georgia (proservice.ge). ProService hosts our website and the info@gcauthority.com mailbox. Its services involve processing website technical logs and storing or transmitting enquiry emails and related correspondence; website form submissions may also be stored where the form configuration provides for this. ProService’s own privacy notice is available at https://www.proservice.ge/en/privacy-policy; contact: contact@proservice.ge.
Personal data may be accessed by authorised GCA personnel and, where engaged for the relevant function, providers of form delivery and IT support. We do not currently use a separate third-party newsletter or bulk-email platform. No Google Tag Manager or Google Analytics service, marketing tracker, embedded social widget, externally hosted font service or embedded map is active in the website version covered by this notice. If an additional provider is introduced, we will identify it and explain the relevant processing and transfers before using it for personal data.
Providers acting on our behalf may process information only for the authorised purpose and under the applicable data protection arrangements. A provider may act as a separate controller for some of its own activities; its notice governs those activities. Data may also be disclosed to competent authorities or professional advisers where a lawful request, legal duty or specific legal matter requires it.
Contacting GCA does not authorise unrestricted distribution of your enquiry to partners or advisers. If your project requires disclosure to a local adviser or another organisation outside ordinary website administration, we will identify the relevant purpose and lawful basis before that disclosure.
International transfers
Our hosting and email provider, ProService LLC, is established in Georgia and publicly describes a data centre in Tbilisi. This does not, on its own, establish the location of every backup or subcontractor or rule out access from abroad. Technical support or additional service arrangements may involve storage or access outside Georgia; the destination, recipient and transfer mechanism depend on the service concerned. Emails sent to an external recipient may also be processed by that recipient’s email provider outside Georgia.
Any transfer must meet the applicable Georgian data protection requirements. Where an agreement-based safeguard requires authorisation from the State Audit Office of Georgia, that authorisation must be obtained before relying on that route. Accepting this policy is not blanket consent to an international transfer.
You may request information about the destinations, recipients and safeguards relevant to your data by emailing info@gcauthority.com.
Your rights and how to exercise them
Subject to the applicable conditions and lawful exceptions, you may request confirmation of processing, information about its purposes and grounds, access to and a copy of your data, correction or completion, termination of processing or deletion, and blocking or restriction of data. You may withdraw consent and, where the statutory conditions and technical feasibility requirements are met, request a structured machine-readable copy or transmission to another controller.
You may also challenge the justification for processing based on legitimate interests and exercise the statutory protections concerning solely automated decisions with legal or similarly significant effects. Withdrawal of consent does not require deletion of information that must lawfully be retained on another ground.
Send requests to info@gcauthority.com with enough information to identify the relevant interaction. We may request proportionate information to verify your identity, but not unnecessary identity documents. Requests are generally free, subject to the limited exceptions allowed by law. We respond within the applicable statutory period; access and information requests generally have a ten-working-day deadline, with a justified extension of up to ten further working days where permitted and notified.
You may complain directly to the State Audit Office of Georgia, the supervisory authority for personal data protection, or seek an available judicial remedy. You do not have to contact us first. Official authority website: https://sao.ge. The law is available at https://matsne.gov.ge/en/document/view/5827307.
Security and third party websites
We are responsible for applying technical and organisational measures appropriate to the nature and risks of processing and for restricting access to people who need it for an authorised purpose. No internet transmission or storage method can be guaranteed to be completely secure. This does not reduce our statutory security obligations.
External websites and services have their own privacy practices. Social sharing controls are ordinary links to Facebook and LinkedIn; they do not load embedded social tracking on our pages. Clicking a sharing link or another external link opens a third-party website, which can receive your IP address and other request information under its own privacy arrangements. No third-party map is currently active.
Changes and contact
We will update this policy when relevant processing arrangements change. The date above identifies this version. A change to this policy does not substitute for obtaining new consent where the law requires it. For privacy matters, contact Gambling Consulting Authority LLC, at info@gcauthority.com.