Goblis Group Contact

Goblis Group · Public policies

Privacy Policy

Updated 24 October 2026

This policy explains how Goblis Group Limited handles personal information through www.goblisgroup.com and the Goblis Operating System (GOS). It distinguishes the public website from access-controlled corporate services. It also explains the Google account information used for sign-in when that feature is activated.

1. Who is responsible and how to contact us

Goblis Group Limited is responsible for its corporate website and Group-level GOS processing. Contact info@goblisgroup.com with the subject “Privacy request — Goblis Group”. An operating company or another separate entity may be responsible for its own employment, customer or transaction records; we will identify the appropriate entity when responding. Goblis Foundation is a separate entity, and this policy does not combine its records with Group records.

2. Information we handle

3. Google sign-in and Google user data

GOS is an access-controlled corporate workspace for approved people. Its initial Google integration is for identity verification only and requests openid and email. When enabled and authorised by you, the sign-in flow receives a Google identity token containing an immutable account identifier, email address, email-verification status and relevant token claims, including a hosted-domain claim where supplied. We use these to verify identity, match an explicitly approved GOS account, enforce its permissions and protect the session.

GOS does not request your Google password. The initial sign-in integration does not request access to Gmail messages, Drive files, Calendar events, contacts, or Workspace administration, and does not retain Google API access or refresh tokens. Google sign-in alone does not grant a corporate role. Domain membership or a matching email address does not automatically create an account.

Google login is being prepared and is not yet publicly activated. Broader Google Workspace connections are separate features. Before a feature accesses additional Google data, it must disclose its purpose and requested permissions and obtain the necessary authorisation. We will update this policy before introducing a materially different use of Google data.

Google user information is used for the disclosed identity and security purposes. It is not sold, used for targeted advertising, provided to data brokers or used to train general-purpose AI models. Any use or transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its applicable Limited Use requirements.

4. Why we use information

We use relevant information to provide requested communications, evaluate a business relationship, administer authorised corporate services, authenticate approved users, maintain security and audit records, investigate misuse and meet applicable contractual or legal obligations. We seek consent where appropriate, including optional analytics choices. Other processing may be necessary for a requested relationship, legitimate operational or security purposes, or a legal obligation. We do not treat acceptance of optional analytics as a condition of viewing this site.

5. Cookies and analytics

The website stores your analytics choice locally. Optional analytics is subject to that choice; advertising storage and advertising-personalisation signals are denied in the website baseline. Google tag scripts may be requested by the browser, so Google may receive technical connection information even when analytics storage is denied. When analytics is allowed, measurement helps us understand page use and improve the website. See the Cookies Policy for the current implementation and how to change your choice.

6. Who may receive information

Access is limited to people and service providers who need information for an authorised purpose. Providers may include AWS for hosting and security, Google for sign-in and consented measurement, and communication or professional advisers involved in a specific request. We may disclose information where required by law or to protect legal rights, investigate fraud or address a security incident. A Group relationship does not itself authorise unrestricted sharing between separate legal entities. Private Board, employment, banking and investment records are not public website content.

7. Storage, transfers and security

The primary Goblis workload is hosted on AWS in Cape Town, South Africa. Global delivery and security services, Google services and relevant providers may process technical information in other countries. Where applicable, we assess the purpose and safeguards for a transfer. Security measures include encryption in transit, restricted access, separation of public content from private records, and controlled backups. No online service can guarantee absolute security.

8. Retention and deletion

Information is retained for the purpose for which it is needed and any applicable legal, contractual, security or evidential requirements. There is no single retention period for all corporate records. We review a deletion request against the relevant record and obligations, and explain any necessary retention. Deleted information may remain in restricted backups until their normal expiry; a restore must not be used to reactivate a deleted account. See the Deletion Policy.

9. Your choices and requests

You may ask about access, correction, deletion, restriction, objection or withdrawal of consent where applicable. Email info@goblisgroup.com, identify the service and request, and provide only information needed to locate the record. We may request proportionate identity verification before disclosing or changing private records. We will explain the outcome or any applicable limitation. You may also raise a concern with the relevant data protection authority, including Kenya's Office of the Data Protection Commissioner.

You can revoke a Google connection through your Google Account's third-party connections settings. Revoking Google access and requesting deletion of a GOS record are separate actions; contact us for the latter. Optional analytics consent can be changed using the website privacy controls or by clearing the stored browser preference.

10. Children, external links and policy changes

The corporate GOS workspace is intended for approved business users and is not a children's service. External websites have their own privacy practices. We update this policy when the service or its processing changes and identify the revision date above; material new data uses require appropriate notice and authorisation.