Website Privacy Policy

Version 1 | Approved 19 November 2025 | Reviewed 22 September 2026

Introduction

GMA Consultancy S.A.R.L (“GMA”, “we”, “us”, “our”) is committed to protecting privacy and confidentiality. This Privacy Policy explains how we collect, use, retain and safeguard personal data when you visit our website, contact us, submit professional information, participate in a project or interact with GMA’s Community Initiative / CSR activities. Where relevant, it should be read together with GMA’s Corporate Social Responsibility & Governance Framework and Governance Notices.

1. What Information We Collect

We may collect the following personal information:

• Name, job title, organisation/company name, email address and phone number when you contact GMA through forms, email or other official channels.
• Information contained in enquiries, correspondence and supporting documents voluntarily provided in connection with prospective or existing services and projects.
• CVs, professional profiles, qualifications, employment history and related information submitted for recruitment, project resourcing, professional-visibility or Community Initiative purposes.
• Information relating to Community Initiative / CSR cases and participants where needed to verify, administer, monitor or communicate a supported initiative. Medical and other sensitive information is subject to the confidentiality, consent, data-minimisation and need-to-know controls in GMA’s CSR & Governance Framework.
• Technical data such as IP address, browser type, operating system, and website usage analytics (via cookies or similar technologies).
• Any other information voluntarily provided to GMA for a legitimate operational, contractual, governance or communication purpose.

2. How We Use Your Information

We use personal data for the following purposes:

• Responding to enquiries and requests for information about GMA’s services.
• Assessing, establishing, administering and supporting prospective or existing professional engagements and projects.
• Reviewing CVs and professional information for recruitment, project resourcing, professional-visibility or Community Initiative purposes.
• Administering, verifying, monitoring and documenting Community Initiative / CSR activities in accordance with GMA’s CSR & Governance Framework.
• Publishing names, profiles, case information or other personal details only where appropriate and with the required consent. Patient identity in medical fundraising or community-support cases is not published without explicit, documented consent from the individual or legal representative.
• Providing updates about our consultancy offerings (only with your consent).
• Improving our website performance and visitor experience.
• Maintaining appropriate governance and accountability records and complying with applicable legal, regulatory and professional obligations.

3. Cookies

Our website uses cookies to enhance your browsing experience and analyze website traffic. You can accept or reject cookies through your browser settings. Essential cookies are required for site functionality. A detailed cookie notice is available in the website footer.

4. Legal Basis for Processing

We process personal data based on:

• Consent, including where required for marketing communications or public disclosure of personal information.
• Legitimate interests in responding to enquiries, administering professional relationships and projects, operating the website, maintaining governance records and protecting GMA’s legitimate institutional interests, subject to applicable individual rights.
• Steps necessary in connection with a prospective or existing contractual relationship.
• Compliance with applicable legal, regulatory or professional obligations.

5. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, for an ongoing professional or project relationship, for governance and accountability purposes, or as required by applicable law. Website enquiry/form submissions are ordinarily deleted after 12 months unless communication, a prospective engagement, an active engagement or another legitimate retention purpose continues. CVs, project records and Community Initiative / CSR records are retained only for the period reasonably required for their relevant purpose and any applicable governance, consent, legal or accountability requirements.

6. Your Rights

You have the right to access, correct, delete, or restrict processing of your personal data. You may also withdraw your consent or object to processing. To exercise your rights, contact GMA’s Data Protection Contact at: Contactus@Gmaconsultancy.com.

7. Data Security

We employ technical and organizational measures to safeguard your personal data from unauthorized access, loss, or misuse.

8. Contact

For privacy questions or to exercise your rights, contact GMA’s Data Protection Contact at:

Approval

This Website Privacy Policy is approved and issued by: