Privacy Policy
Version 1.0 Effective Date: April 2026
Operated by GIBQ Operations LLC under license from Global Institute for Biomedical Quality.
1. Introduction
This Privacy Policy describes how GIBQ Operations LLC, a Delaware limited liability company ("we," "us," "our," or "GIBQ Operations"), collects, uses, discloses, and safeguards information when you visit gibq.org, submit a vendor application, communicate with us, or otherwise interact with services we operate (collectively, the "Services").
GIBQ Operations is the data controller for personal information processed in connection with the Services. The Services operate under license from Global Institute for Biomedical Quality, a Delaware nonprofit corporation that owns the GIBQ™ and GIBQ Verified™ certification marks and the standards underlying them. Global Institute for Biomedical Quality does not collect, store, or process personal information in the operation of the Services.
By accessing the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, do not use the Services.
2. Scope and Vendor Eligibility
This Policy applies to all visitors to gibq.org, all vendors submitting an application for verification under the GIBQ Verified standard, and all persons who otherwise communicate with us in connection with the Services.
2.1 Phase 1 — United States Vendors Only
During Phase 1, vendor applications for GIBQ Verified status are accepted only from entities legally formed and operating in the United States. Vendor applications submitted from outside the United States will not be processed during Phase 1. We may expand vendor eligibility to additional jurisdictions in subsequent phases; if we do, this Policy will be updated accordingly.
Notwithstanding the Phase 1 vendor restriction above, gibq.org is accessible globally. Visitors from outside the United States, including the European Economic Area ("EEA"), the United Kingdom, and Canada, may browse the website, read about the GIBQ Verified standard, and contact us. Such visitors are entitled to the rights described in Section 9 below.
3. Information We Collect
We collect only information that is reasonably necessary to evaluate vendor applications, operate the Services, communicate with you, and meet our legal obligations. We do not sell personal information.
3.1 Information You Provide
- Vendor application data: legal entity name, business address, contact person's name and title, business email address, business telephone number, website URL, and a description of the products you intend to submit for verification.
- Audit submission data: Certificates of Analysis ("COAs"), product labels, packaging artwork, supporting test methodology documentation, lot numbers, and any sworn attestation forms required as part of the GIBQ Verified audit process.
- Payment information (Phase 2 onward): when paid tiers become available, billing contact information and payment method details. Payment card numbers are processed by our third-party payment processor and are not stored on our systems.
- Communications: emails, contact-form submissions, and any correspondence you send to us, including the metadata associated with those communications.
3.2 Information Collected Automatically
- Technical data: IP address, browser type and version, operating system, device type, referring URL, pages viewed, and timestamps of activity.
- Privacy-friendly analytics: aggregated, non-identifying usage data collected through Vercel Analytics and Vercel Speed Insights. These tools do not set tracking cookies, do not collect personally identifying information, and do not perform cross-site tracking.
- Strictly-necessary cookies: a small number of cookies required for the website to function, such as session and security cookies. These cookies are exempt from consent requirements under applicable law.
3.3 Information We Do Not Collect
We do not knowingly collect personal information from minors under the age of sixteen (16). The Services are intended for business and professional use only. If you believe a minor has provided personal information to us, please contact us using the address in Section 12 and we will delete it.
We do not collect or process special categories of data (such as health, biometric, racial or ethnic, religious, or political data) in the ordinary course of operating the Services.
4. How We Use Information and Our Legal Bases
We use the information described in Section 3 only for the purposes set out in the table below. The legal bases identified are those applicable under the European Union General Data Protection Regulation ("GDPR") and the United Kingdom General Data Protection Regulation ("UK GDPR"). For United States residents, the equivalent purposes are described in Section 9.2.
| Purpose | Categories of Data | Legal Basis (GDPR/UK GDPR) |
|---|---|---|
| Evaluate vendor applications and conduct the GIBQ Verified audit | Vendor application and audit submission data | Pre-contractual measures (Art. 6(1)(b)) |
| Issue, maintain, suspend, or revoke GIBQ Verified status; maintain the public registry | Vendor application data; audit results; communications | Performance of contract (Art. 6(1)(b)) |
| Operate, secure, and improve the website and Services | Technical data; aggregated analytics | Legitimate interests (Art. 6(1)(f)) |
| Communicate with you and respond to inquiries | Contact information; communications | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal, regulatory, accounting, audit, and tax obligations | All categories as required | Legal obligation (Art. 6(1)(c)) |
| Protect, establish, exercise, or defend legal claims | All categories as required | Legitimate interests (Art. 6(1)(f)) |
| Process payments (Phase 2 onward) | Billing and payment information | Performance of contract (Art. 6(1)(b)) |
We do not engage in automated decision-making that produces legal or similarly significant effects on individuals. Vendor audit determinations are reviewed and approved by qualified human reviewers.
5. How We Share Information
We share personal information only as described below. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
5.1 Service Providers and Sub-Processors
We engage third-party service providers to perform functions on our behalf, including website hosting, email delivery, document storage, payment processing (Phase 2 onward), and analytics. These providers process information only as instructed by us and under written agreements that require confidentiality and appropriate safeguards. Categories of providers include:
- Cloud hosting and content delivery (e.g., Vercel)
- Productivity and email infrastructure (e.g., Google Workspace)
- Privacy-friendly analytics (e.g., Vercel Analytics, Vercel Speed Insights)
- Payment processing (Phase 2 onward)
- Document storage and back-office tooling
5.2 GIBQ Standards Body
Pursuant to the trademark license agreement between GIBQ Operations LLC and Global Institute for Biomedical Quality, we provide the nonprofit with summary, aggregated, and anonymized information regarding the operation of the Services and the certification program. We also disclose vendor identity and audit outcome information as necessary to enable the nonprofit to exercise its quality-control rights and to maintain the integrity of the GIBQ Verified certification mark.
5.3 Public Registry
Vendors who pass the GIBQ Verified audit are listed in a publicly available registry on gibq.org. The registry displays the vendor's legal entity name, the date of certification, the certification status, and any product categories covered. The public registry does not include personal information about individual employees of the vendor unless the vendor expressly authorizes such disclosure.
5.4 Legal and Safety Disclosures
We may disclose information when we believe in good faith that disclosure is required by law, court order, or governmental request; necessary to enforce our agreements or this Policy; or appropriate to protect the rights, property, or safety of GIBQ Operations, its affiliates, vendors, users, or the public.
5.5 Business Transfers
If GIBQ Operations is involved in a merger, acquisition, financing, reorganization, sale of assets, or insolvency proceeding, personal information may be transferred to the relevant counterparty as part of that transaction. Any such transfer will remain subject to the protections set out in this Policy or a successor policy that provides equivalent protections.
5.6 With Your Direction
We share information with third parties when you direct us to do so or otherwise consent to the disclosure.
6. International Data Transfers
GIBQ Operations LLC is established in the United States, and the Services and supporting infrastructure are hosted in the United States. If you access the Services from outside the United States, the information we collect about you will be transferred to, stored in, and processed in the United States.
The United States may not provide the same level of legal protection for personal information as your country of residence. For transfers of personal information from the EEA, the United Kingdom, or Switzerland to the United States, we rely on the Standard Contractual Clauses approved by the European Commission (and, as applicable, the UK International Data Transfer Addendum) as the legal mechanism for the transfer. A copy of the relevant clauses is available on request using the contact information in Section 12.
7. Data Retention
We retain personal information only for as long as necessary for the purposes for which it was collected, to comply with our legal, accounting, or reporting obligations, or to establish, exercise, or defend legal claims. The retention periods below are guidelines; specific periods may be longer where required by applicable law or where the information is the subject of a legal hold.
| Category | Retention Period |
|---|---|
| Vendor application and audit records (certified vendors) | Duration of certification plus seven (7) years |
| Vendor application records (declined or withdrawn applicants) | Twenty-four (24) months from final decision or withdrawal |
| Communications and contact-form submissions | Thirty-six (36) months from last interaction |
| Billing and payment records (Phase 2 onward) | Seven (7) years for tax and accounting compliance |
| Server logs and security event records | Up to twelve (12) months |
| Aggregated and anonymized analytics | No fixed period (no longer constitutes personal information) |
When the applicable retention period expires, we will delete or irreversibly anonymize the personal information.
8. Security
We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These safeguards include access controls, encryption of data in transit, secure cloud infrastructure, and ongoing review of our information-security practices.
No method of electronic transmission or storage is completely secure, and we cannot guarantee the absolute security of personal information. You are responsible for maintaining the confidentiality of any account credentials you receive in connection with the Services. If you suspect that your interaction with us has been compromised, contact us immediately using the information in Section 12.
9. Your Rights
9.1 Rights for Persons in the EEA, the United Kingdom, and Switzerland
If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights with respect to your personal information, subject to the conditions and limitations set out in the GDPR and UK GDPR:
- Right of access: you may request confirmation of whether we process personal information about you and, if so, request a copy of that information.
- Right to rectification: you may request that we correct inaccurate or incomplete personal information about you.
- Right to erasure: you may request that we delete personal information about you in defined circumstances.
- Right to restriction of processing: you may request that we limit how we process your personal information in defined circumstances.
- Right to data portability: you may request a copy of personal information you have provided to us in a structured, commonly used, machine-readable format.
- Right to object: you may object to processing of your personal information that is based on legitimate interests.
- Right to withdraw consent: where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
- Right to lodge a complaint: you have the right to lodge a complaint with the data protection authority of the country in which you reside, work, or where the alleged infringement took place.
To exercise any of these rights, contact us using the information in Section 12. We will respond within the period required by applicable law (generally one month, extendable by up to two further months for complex requests). We do not currently maintain a representative in the European Union under Article 27 of the GDPR; this Policy will be updated if we appoint one.
9.2 Rights for United States Residents
Depending on your state of residence, you may have rights under United States state privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the comprehensive privacy statutes of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Indiana, Iowa, Delaware, New Jersey, New Hampshire, and other states with similar laws. Subject to the conditions and limitations of the applicable statute, those rights generally include:
- The right to know what personal information we collect, use, disclose, and share.
- The right to access and receive a copy of your personal information.
- The right to correct inaccurate personal information.
- The right to request deletion of your personal information.
- The right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not currently sell personal information or share it for cross-context behavioral advertising. If this changes, we will provide a clear opt-out mechanism on the website.
- The right to limit the use and disclosure of sensitive personal information. We do not collect sensitive personal information in the ordinary course of operating the Services.
- The right to non-discrimination for exercising any of the foregoing rights.
California residents may designate an authorized agent to make a request on their behalf. We may require verification of the agent's authority and your identity before responding.
9.3 How to Submit a Request
You may submit a privacy rights request by emailing privacy@gibq.org. We will need to verify your identity before responding to certain requests. Verification will be proportionate to the sensitivity of the data and the nature of the request. We will not charge a fee for responding to a request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline to act, as permitted by applicable law.
10. Cookies and Similar Technologies
We use a small number of strictly-necessary cookies for site functionality and security (for example, session and CSRF cookies). We also use privacy-friendly analytics that do not set tracking cookies, do not collect personally identifying information, and do not perform cross-site tracking.
We may, in the future, use additional cookies and similar technologies for advertising, conversion measurement, or behavioral analytics. If we do, we will update this Policy and deploy a consent management tool that permits you to accept or reject those non-essential categories before they are activated. Until that time, no advertising or cross-site tracking technologies are loaded on the Services.
You can configure your browser to refuse all cookies or to alert you when cookies are being sent. If you reject strictly-necessary cookies, parts of the Services may not function correctly.
For full details, see our Cookie Policy.
11. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will revise the "Effective Date" at the top of this Policy and, if the changes are material, provide additional notice through the Services or by other reasonable means. Your continued use of the Services after the Effective Date of an updated Policy constitutes your acknowledgment of the updated Policy.
12. Contact Information
Questions, concerns, and privacy rights requests may be directed to:
GIBQ Operations LLC Attn: Privacy Officer Email: privacy@gibq.org General inquiries: info@gibq.org Website: gibq.org
13. Governing Law and Venue
This Privacy Policy and any disputes arising under or in connection with it shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles. Any action, suit, or proceeding arising under or in connection with this Policy shall be brought exclusively in the state or federal courts located in Wilmington, Delaware, and the parties consent to the personal jurisdiction of such courts and waive any objection based on inconvenient forum.
Nothing in this Section 13 limits any non-waivable rights you may have under the consumer protection or privacy laws of your state, country, or region of residence.
GIBQ Operations LLC · Privacy Policy v1.0 · April 2026 Operated under license from Global Institute for Biomedical Quality.