Privacy Policy
Privacy and information handling.
We collect only what we need to answer you, and we measure how the site is used. This website sets no cookies, shows no advertising and builds no profile of you — so what follows is about the one form on this site, the usage we count and how to stop it, and the providers who help us with both.
Who is responsible for your data
Gateway operates as a group. For personal data submitted through this website, [NL entity — registered name and number to be confirmed], at Maria Montessorilaan 3, 2719 DB Zoetermeer, The Netherlands, and [India entity — registered name and CIN to be confirmed], at 8th Floor, Corporate House, Bodakdev, Ahmedabad 380054, India, act as joint controllers. They decide together what is collected here and why, and each is answerable for it.
You may exercise any of the rights described below against either entity, and you will get the same answer. For data protection matters write to DPO@thegatewaycorp.com. For anything else, gateway@thegatewaycorp.com reaches us.
What we collect
What you type into the enquiry form. First name, last name, company, email address, country, and the message itself. Those six fields are the whole of it — the form asks for nothing else, and there is no other form on this site that collects personal data.
What your browser sends by being here. Our hosting provider records ordinary server log data, including your IP address, the pages requested and your browser's user-agent string. That is infrastructure logging, kept for security and diagnostics.
How you move around the site. We measure usage — which pages are read, which links and buttons are clicked, how long a page is open, and whether something broke. This is described in full under how we measure this site, including the one identifier it stores in your browser and the things we deliberately do not collect.
Applying for a job is separate. Vacancies here link out to our recruitment system at connect.thegatewaycorp.com. CVs and applications are submitted there, not on this website — this site accepts no file uploads and hosts no application form.
How we measure this site
We use PostHog to understand how this site is used. We would rather describe it precisely than reassure you vaguely, so here is the whole of it.
What is recorded. Pages viewed and how long for, clicks on links and buttons, searches run on our careers pages, which roles were opened, whether an enquiry was started or sent, page-load performance, and JavaScript errors. Each event carries your approximate location derived from your IP address, your browser and device type, and the page you came from.
The one thing stored in your browser. A random identifier, held in local storage, so that several page views can be recognised as one visit rather than five strangers. It is a random string. It is not your name, your email address or anything derived from them, and it means nothing outside this site.
What we deliberately do not do. No advertising and no advertising pixel. No cross-site or cross-device tracking. No session recording or replay — we cannot watch what you did on a page. No profile is built about you as an individual. Nothing is sold, and nothing is shared with data brokers.
Two engineering choices that limit the exposure. First, analytics traffic is routed through this website's own domain rather than the provider's, so your browser never opens a connection to a third-party analytics host, and your IP address is not handed to one by the mere act of loading a page. Second, before any event leaves your browser we strip query strings from URLs and redact anything shaped like an email address — so that if a message or a link ever carried personal data, it does not travel with the measurement.
Legal basis. Our legitimate interest in understanding whether the site works and where it does not. We consider the impact limited: no profile, no advertising, no third-party connection, and a random identifier that means nothing beyond this site.
How to switch it off. If your browser sends a “Do Not Track” or Global Privacy Control signal, we honour it and collect nothing at all — that is a setting in your browser, not a request you have to make to us. Clearing this site's data removes the identifier and starts you over as someone new. And you can object to the processing at any time by writing to DPO@thegatewaycorp.com.
One thing we would rather say than let you discover: because we serve analytics from our own domain instead of the provider's, the blocklists used by most ad and tracker blockers will not recognise it. That was a decision about data quality, not about evading you — which is exactly why the Do Not Track signal above is honoured, and why this section exists in this much detail.
Why we use it, and on what legal basis
To answer you. When you send an enquiry we use it to reply, to route the message to the right company in the group, and to keep a record of the exchange. Our legal basis is your consent, given when you tick the box and submit the form. You can withdraw it at any time by writing to DPO@thegatewaycorp.com; withdrawing does not undo processing already carried out.
To keep the site standing up. Server logs and spam protection are used to keep the site available and to stop automated abuse of the enquiry form. Our legal basis is our legitimate interest in operating a secure website, balanced against the limited and short-lived nature of the data involved.
To see whether the site works. Usage measurement, on the basis of our legitimate interest in knowing which pages are read, where people give up, and what is broken. The detail, and how to switch it off, is under how we measure this site.
We do not sell personal data, we do not use it for advertising, and no decision about you is made by automated means.
Who else handles it
Four providers process data on our behalf and on our instructions. Naming them is the point of this section — an enquiry does not stay solely with us.
Vercel hosts this website and runs the code behind the enquiry form. It processes server log data, including your IP address.
Resend delivers the enquiry to us by email. The full contents of your message pass through it. Resend is based in the United States.
PostHog provides the usage measurement described under how we measure this site. Our data is held on its European infrastructure, inside the EU. PostHog is a United States company, so its staff can in principle access what is stored there in the course of supporting the service.
Google provides the reCAPTCHA spam protection on the enquiry form. When it is loaded, your IP address and interaction data are shared with Google. It is not loaded until you allow it — see cookies and embedded content below.
Beyond those, we share enquiry data inside the Gateway group of companies only where it is needed to answer you or to support an existing business relationship. We do not otherwise disclose it, except where the law requires it of us.
Where your data goes
Gateway operates across five continents, and this website's providers are not all in Europe. Personal data submitted here is transferred outside the European Economic Area in two ways: to our India entity as joint controller, and to providers in the United States, principally Resend and Google.
Neither India nor the United States is covered by a European Commission adequacy decision of general application. Those transfers are made under [transfer mechanism to be confirmed], together with the technical and organisational measures described in this policy. You may request a copy of the safeguards in place by writing to DPO@thegatewaycorp.com.
Usage measurement is deliberately not part of that. We chose our analytics provider's European infrastructure so the data described under how we measure this site stays in the EU rather than crossing the Atlantic. The provider is a United States company, so support access from there remains possible and is covered by the same safeguards; the stored data itself does not leave Europe.
How long we keep it
Enquiries are kept for [retention period to be confirmed] from our last correspondence with you, after which they are deleted, unless we are required to keep them longer to meet a legal or regulatory obligation or to establish or defend a legal claim.
Server logs held by our hosting provider are kept for that provider's standard retention period and are not used for any purpose beyond security and diagnostics.
Usage measurement events are kept for [analytics retention period to be confirmed]. They are not linked to your name or email address, so after the identifier in your browser is cleared there is no way for us — or for anyone — to connect what remains to you.
Your rights
If your personal data is processed under the GDPR, you have the right to:
— access the personal data we hold about you, and receive a copy of it;
— have inaccurate data corrected, and incomplete data completed;
— have your data erased, where there is no overriding reason for us to keep it;
— restrict how we process it while a dispute about it is resolved;
— object to processing carried out on the basis of our legitimate interests;
— receive the data you gave us in a portable, machine-readable form; and
— withdraw consent at any time, where consent is the basis we rely on.
Write to DPO@thegatewaycorp.com to exercise any of these. We will respond within one month. There is no charge.
If you are not satisfied with how we have handled the matter, you may complain to a data protection supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens; elsewhere in the EEA, the authority where you live or work. You do not need our permission, and you are not required to come to us first.
Cookies, storage and embedded content
This website still sets no cookies. Not one, first-party or third-party, and no advertising pixel or tag manager. That is unusual for a corporate site and it remains deliberate.
What we do store is two entries in your browser's local storage, and we would rather list them than describe them loosely:
— Your answer to the consent notice. One record of the choice you made, so we do not ask again on every page. It contains no identifier and is never transmitted to us.
— A random analytics identifier. So that several page views can be counted as one visit. It is a random string tied to nothing else about you — see how we measure this site, which also explains how to switch that off entirely.
Clearing this site's data removes both. Neither is a cookie, so neither travels with requests to other websites.
Two features are loaded from third parties, and neither is loaded until you allow it:
— Google reCAPTCHA, the spam protection on our enquiry form. Loading it shares your IP address with Google and allows Google to set its own cookies.
— YouTube, which hosts the films on our Spotlight page. We embed them through youtube-nocookie.com, YouTube's privacy-enhanced domain, which holds back its tracking cookies until you actually play something. Loading a film shares your IP address with Google.
If you decline, neither is requested and the rest of the site works normally. You can change your choice at any time.
One thing the notice does not gate, and we would rather say so than let you find out: the still images on the Spotlight page are the films' own thumbnails, served by YouTube's image servers as you scroll. They set no cookies, but your IP address does reach Google. Everything else — fonts, photography, maps, flags, video — is served from this website itself.
Changes to this policy
We update this policy when what we do changes. Where a change materially affects how your personal data is handled, we will say so here rather than amend it quietly.