GBC Privacy Policy

1. IMPORTANT INFORMATION AND WHO WE ARE

This Privacy Policy explains how Gibraltar Broadcasting Corporation (“we”, “us”, or “our”) collects and processes your personal data when you use our website https://www.gbc.gi/, our mobile apps (such as the GBC News App and GBC Radio Gibraltar App) and any other related services. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. TYPES OF PERSONAL DATA WE COLLECT ABOUT YOU

We may collect and process the following types of personal data:

  • Identity Data – Name, email address, phone/mobile number, and home/mailing address.
  • Technical Data – Internet Protocol (IP) address, browser type and version, time zone, device type and settings, OS, and geo-location.
  • Usage Data – How you use our website, apps, and services.
  • Communication & Marketing Data – Preferences for receiving marketing from us.
  • App-Specific Data:
    • GBC News App: Email when submitting a news story.
    • GBC Radio Gibraltar App: Email when entering on-air competitions.

We do not intentionally collect special category data (e.g. health, political views), nor do we knowingly collect data from children without parental consent. We encourage parents to engage with us in protecting their children’s privacy, ensuring a safe and enjoyable online experience. Please refer to our Children’s Privacy Policy for more information.

3. HOW IS YOUR PERSONAL DATA COLLECTED?

We collect data using the following methods:

  • Direct interactions – When you provide data by contacting us, submitting a story, entering a competition, etc.
  • Automated technologies – Via cookies, server logs, and similar tracking technologies.
  • Third-party sources – Analytics, advertising, and social media platforms.

We collect your data lawfully, fairly, and transparently, with your knowledge and consent where required.

4. HOW WE USE YOUR PERSONAL DATA

We use your data only when we have a lawful basis under Article 6 of the GDPR. The lawful bases include:

  • Contract performance – To provide the services you request.
  • Consent – For optional communications (e.g. marketing).
  • Legal obligation – For compliance with applicable laws.
  • Legitimate interests – To improve our services, analyse usage, and prevent fraud (balanced with your rights).

We use your personal data to:

  • Deliver content, services, and app features.
  • Understand website/app usage and improve functionality.
  • Communicate with you regarding services, updates, and promotions.
  • Administer competitions and user-submitted content.
  • Comply with legal or regulatory requirements.

You may withdraw your consent for marketing at any time by clicking “unsubscribe” or contacting us directly.

5. DISCLOSURES OF YOUR PERSONAL DATA

We may share your personal data with:

  • Service providers – For web hosting, analytics, email marketing, user authentication, and content management.
  • External consultants or auditors – Under strict confidentiality for internal analysis or service improvement.
  • Regulators or legal authorities – Where required by law or for public interest/safety.

We require all third parties to respect your data and process it only for the specified purpose under contract.

We do not sell, rent, or trade your personal data to any third party.

  1. SENDING DATA OUTSIDE OF THE EEA

We will only send your data outside of the European Economic Area (“EEA”) in cases where we must do so to comply with a legal duty or in cases where we are working with our third-party service providers or partners.

 

If we do transfer your personal information outside of the EEA to our third-party service providers or partners, we will ensure that the information is protected to the same standard as it would be in the EEA. In doing so, we will use one of the following safeguards:

  • Transfer the information to a non-EEA country with privacy laws that give the same protection as the EEA.
  • Put in place a contract with the recipient that means they must protect it to the same standards as the EEA.
  • Transfer it to organisations that are part of Privacy Shield.

 

7. DATA SECURITY

We apply appropriate technical and organisational measures to secure your personal data against:

  • Unauthorised access.
  • Accidental loss.
  • Disclosure or destruction.

These measures include secure servers, encrypted connections, access controls, and staff confidentiality agreements.

However, no electronic storage or transmission method is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security. Except where required by applicable law, we will not be held liable for any loss, damage or unauthorised access resulting from a breach of security beyond our reasonable control.

8. DATA RETENTION

We retain your personal data only as long as necessary for:

  • The purposes we collected it for.
  • Legal, accounting, or reporting obligations.

When data is no longer needed, we delete or anonymise it. If you request deletion and we are not legally required to retain it, we will delete it within a reasonable timeframe.

9. YOUR LEGAL RIGHTS UNDER GDPR

You have the following rights under GDPR:

  • Right to be Informed – You have the right to be informed about the collection and use of your personal data. This includes details about the purpose of processing, data retention periods, and who your data will be shared with. This information is provided in this Privacy Policy and any other notices we issue.
  • Right of Access – You have the right to request a copy of the personal data we hold about you.
  • Right to Rectification – You have the right to request correction of any inaccurate or incomplete personal data.
  • Right to Erasure – You may request that we delete your personal data, also known as the “right to be forgotten,” where there is no valid reason for us to retain it.
  • Right to Restrict Processing – You have the right to request a temporary halt to the processing of your data, for example, if you contest its accuracy or our legal basis for processing it.
  • Right to Data Portability – You can request to receive your personal data in a structured, commonly used, and machine-readable format and have the right to transmit that data to another controller.
  • Right to Object – You have the right to object to the processing of your personal data based on legitimate interests, including profiling, or for direct marketing purposes.
  • Right to Withdraw Consent – Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Journalistic Exemptions

As a news-gathering organisation, we are committed to upholding both data protection standards and the fundamental right to freedom of expression. Under Article 85 of the UK GDPR and related provisions, certain obligations and rights under data protection law may not apply when personal data is processed for journalistic, academic, artistic, or literary purposes (“Special Purposes”).

This exemption will apply to the extent that, as the data controller, we reasonably believe that complying with the relevant provisions would be incompatible with the Special Purposes. This incompatibility must be more than a matter of inconvenience.

Additionally, the exemption will apply when:

  • The processing is carried out with a view to the publication of material that is journalistic, academic, artistic or literary in nature;
  • We reasonably believe that the publication is in the public interest, having regard to:
    • the general importance of freedom of expression,
    • any specific public interest in the subject matter, and
    • the potential impact on individuals, including any risk of harm.

In each case, we will carefully assess and balance the individual’s rights against our editorial and public interest obligations. These determinations will be made in good faith and in accordance with regulatory guidance and best practice.

  1. CONTACT DETAILS

If you have questions about this Privacy Policy, your data, or your rights, contact:

GBC Data Protection Officer:

Jean-Paul Latin

Gibraltar Broadcasting Corporation,
Broadcasting House, 22 Rosia Road, Gibraltar.
Email: jplatin@gbc.gi

 

11. COMPLAINTS

We aim to resolve all data protection concerns directly. However, if you are unsatisfied with our response, you may lodge a complaint with:


Gibraltar Regulatory Authority
info@gra.gi

 

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our practices or legal obligations. When we do, we will post the revised policy on our website and notify registered users if required.

Please check back periodically to stay informed. Continued use of our website and services implies acceptance of the updated policy.

13. THIRD-PARTY LINKS

Our website may include links to third-party sites, plug-ins, or services. Clicking those links may allow third parties to collect or share data about you. We do not control and are not responsible for the privacy policies of third-party websites. We encourage you to read their policies before providing any personal data.