Privacy & GDPR Policy

GSA Limited (Gluten Safety Awareness, "GSA", "we", "us") is the data controller for this website. We are responsible for how your personal data is collected and used under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any privacy question or request, contact us at mayssa@dama.team.

Diners and reviewers

• Name or display name, email address and password (stored securely, never in plain text).
• Optional dietary status (for example coeliac or non-coeliac gluten sensitivity).
• Saved restaurants (favourites and want-to-go lists) and your private notes.
• Reviews, messages to restaurants, messages to GSA and safety reports you submit.

Restaurants

• Contact person, business name, address, phone, email, website and social links.
• Kitchen practices, menus, allergen matrices, staff training and food hygiene details.
• Photos, logos and documents you upload, and GSA review notes.

Technical data

• Sign-in session information, IP address, browser type and your cookie choices.
• Anonymised usage data, only if you accept analytics cookies.

• Contract — to run your account, list restaurants, and deliver messages and reviews.
• Legitimate interests — to check restaurant submissions and reviews before they go live, investigate safety reports, prevent misuse, and keep the directory trustworthy for the coeliac community.
• Consent — for optional analytics cookies and any dietary information you choose to share. You can withdraw consent at any time.
• Legal obligation — to keep records we are required to keep by law.

Telling us you are coeliac or gluten sensitive is health information, a special category of data. We only process it with your explicit consent, it is entirely optional, and it is never shown publicly unless you choose to display it. You can change or remove it at any time from your account.

Approved restaurant profiles are public. Reviews appear publicly with your display name once GSA has checked them. Your email, private notes, saved lists, safety reports and messages to GSA are never public.

We never sell or rent your data, and we do not share it with advertisers. We use trusted service providers to host the website, store data securely and send emails. They act on our instructions and must protect your data. If payments are introduced for restaurants, a secure payment provider will process card details — GSA will not store them.

Where a provider stores data outside the UK, we make sure appropriate safeguards are in place, such as UK adequacy regulations or approved contract clauses.

• Account data — while your account is active, then deleted within 30 days of closure.
• Reviews — for the life of the listing, unless you ask us to remove them.
• Restaurant submissions and GSA review notes — up to 6 years after a listing ends.
• Safety reports and messages to GSA — up to 2 years after they are resolved.

Under UK GDPR you have the right to:

• access a copy of your data;
• correct data that is wrong;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format;
• withdraw consent at any time.

Signed-in diners can use Request my data and Delete my account under "My details" on your account page, or email mayssa@dama.team. We respond within one month.

We use essential cookies to keep you signed in and the site working. Analytics cookies are only used if you accept them, and you can change your choice through the cookie banner.

Data is encrypted in transit, access is restricted by account permissions, and uploaded documents are stored privately and shared through time-limited links.

Please contact us first at mayssa@dama.team so we can help. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

We will update this page if anything changes and show the new date at the top.