Privacy Policy

The Gtech Service Portal is operated by Gtech FZE, a free zone establishment registered in the United Arab Emirates. For the personal data described in this policy, Gtech FZE acts as the data controller.

Questions about this policy, or requests relating to your personal data, can be raised with your Gtech account manager or sent to the contact address given in your service agreement.

This policy covers the Gtech Service Portal, the web application through which our customers view the machines we have placed with them, record consumable usage, submit meter readings, and raise service requests. It does not cover correspondence outside the portal, our wider commercial relationship, or any third-party website we may link to.

Accounts are created by Gtech at the request of a customer organisation; there is no public sign-up. We collect and hold:

• Account details: your name, work email address, telephone number, the organisation you belong to, and your role.
• Authentication data: a one-way cryptographic hash of your password (never the password itself), and the date and time of your last sign-in.
• Activity records: an audit trail of significant actions taken in the portal, such as signing in, submitting a meter reading, recording a consumable, or changing a password, together with the time and the account responsible.
• Content you submit: service request descriptions, comments and any notes you add.

We do not collect payment card details, government identification documents, location data, or any special categories of personal data through the portal. We do not use advertising, analytics or tracking technologies, and we do not profile users or take automated decisions producing legal effects.

Most information held in the portal concerns equipment rather than individuals: machine models and serial numbers, installation sites, meter readings, consumable and parts usage, stock balances, contract terms and service history. This is business information rather than personal data, but because each record is linked to the account that created it, it is described here for completeness.

• To provide the portal and give you access to your own equipment and stock records. Necessary for the performance of the contract between Gtech and your organisation.
• To supply and service your equipment, including calculating consumable usage, forecasting replenishment and scheduling technician visits. Necessary for the performance of that contract.
• To bill accurately under click-charge, rental or service agreements, using submitted meter readings. Necessary for the performance of that contract.
• To keep the service secure, including limiting repeated sign-in attempts and maintaining an audit trail. Our legitimate interest in preventing unauthorised access and resolving disputes about what was recorded and when.
• To comply with legal obligations, including retention of commercial, accounting and tax records for the periods required by law.

The portal sets a single, strictly necessary cookie for the purpose of keeping you signed in. It contains your user identifier and a session version, authenticated with a cryptographic signature so that it cannot be altered by anyone holding it. It is marked HttpOnly and Secure, expires after fourteen days, and is cleared when you sign out.

We set no analytics, advertising or third-party cookies. Because the only cookie we use is strictly necessary to deliver a service you have requested, no consent banner is shown. Blocking this cookie will prevent you from signing in.

We do not sell personal data and we do not share it for marketing purposes. We rely on the following categories of service provider, who process data only on our instructions and under written terms:

• Cloud hosting and network security providers, who deliver the application.
• Managed database providers, in which portal records are stored.
• Communication providers, where used to deliver notifications relating to your account or equipment.

We may also disclose personal data where required by applicable law, by a court order, or by a lawful request from a competent authority.

Our hosting and database providers operate infrastructure in a number of countries. As a result, personal data held in the portal may be stored or processed outside the United Arab Emirates.

Where personal data is transferred outside the UAE, we do so only to a jurisdiction recognised as providing an adequate level of protection, or subject to appropriate contractual safeguards, in each case as required by applicable United Arab Emirates data protection law.

• Account records: for as long as the account remains active, and for a reasonable period afterwards to handle any queries arising from its use.
• Meter readings, consumable usage and service history: for the duration of the equipment contract and for at least five years afterwards, since these records support invoicing and may be required to resolve billing disputes or to meet statutory record-keeping obligations.
• Audit trail: for at least five years, for security and dispute resolution purposes.

When a retention period ends, records are deleted or irreversibly anonymised.

• Passwords are stored only as bcrypt hashes and are never recoverable in plain text by anyone, including Gtech staff.
• Session cookies are cryptographically signed and verified in constant time, and can be invalidated immediately if an account is compromised.
• All traffic is served over HTTPS, with strict transport security enforced.
• Access is scoped by account, so a customer can only ever reach their own machines, stock and service records.
• Sign-in attempts are rate limited, and significant actions are recorded in an audit trail.
• Administrative functions are restricted to authorised Gtech personnel on a least-privilege basis.

No system can be guaranteed completely secure. In the event of a personal data breach likely to result in a risk to affected individuals, we will notify the competent authority and, where required, those individuals, within the timeframes set by applicable law.

Subject to the conditions and exemptions in applicable United Arab Emirates data protection law, you may:

• Request confirmation of what personal data we hold about you, and a copy of it.
• Ask us to correct personal data that is inaccurate or incomplete.
• Ask us to erase personal data where we no longer have a lawful basis to retain it.
• Ask us to restrict processing, or object to processing carried out on the basis of legitimate interests.
• Request your personal data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the competent data protection authority.

To exercise any of these rights, contact your Gtech account manager. We will respond within the period required by law. Please note that certain records, such as meter readings underpinning issued invoices, may need to be retained notwithstanding an erasure request, in order to meet our legal and contractual obligations.

We may update this policy from time to time. The date shown at the top of this page indicates when it last changed. Where a change materially affects how we handle your personal data, we will inform you before it takes effect.