Evidence before authority
We distinguish claims, documentation, observation, testing and independent review. GCSI does not present itself as a regulator, medical authority or guarantee of zero-risk dining.
Trust and accountability
Governance and policies
How we protect independence, handle concerns and make decisions that affect GCSI content and services. These policies apply to the parts of GCSI that are currently live; planned Restaurant Index assessment rules do not take effect before the corresponding workflow is released.
01 · Foundation
Principles that apply across GCSI
People before metrics
People with celiac disease, contributors and food-service teams should be treated with dignity. Scores, engagement and commercial relationships must not override safety evidence or fair process.
Explain important decisions
Material editorial, moderation and future assessment decisions should have a recorded basis, appropriate review and a route for correction when the underlying information is wrong or incomplete.
Commercial independence
Payment, sponsorship or partnership must never determine an assessment score, publication decision, reviewer conclusion or the presentation of evidence.
02 · Privacy and retention
Keep only what has a defensible purpose
Our Privacy page explains the current data flows and optional analytics choice. This governance policy adds the retention rules already enforced by the product and the criteria used where a fixed period would be misleading.
| Record | Current rule | Why |
|---|---|---|
| First-party journey aggregates | 13 months | Directional UX improvement without user-level histories. |
| Zero-result search-gap aggregates | 13 months | Content planning using controlled topic buckets; raw search phrases are not stored. |
| Generic rate-limit attempts | Eligible for cleanup after 48 hours | Short abuse windows only; not behavioural analytics. |
| Verification/reset codes | Short-lived, single-use | Account verification and recovery; reusable plaintext codes are not retained in admin history. |
| Active email suppressions | While needed to prevent unwanted or repeatedly undeliverable mail | Respect complaints and hard-bounce signals. Released records and provider metadata are not a marketing profile. |
| Editorial/version/audit records | While needed to explain a live publication, decision or governance history | Accountability, correction and version provenance. Access is restricted and records are periodically reviewable. |
| Account/profile information | While the account and the corresponding service purpose remain active, subject to applicable rights and operational/legal needs | Account operation, contribution attribution and member-selected profile features. |
A future workflow must not promise a deletion/retention period unless the application can actually enforce it. New data categories require a documented purpose, access boundary and retention decision before release.
Privacy questions and rights
Privacy requests can be sent to contact@globalceliac.org. People may also have a right to complain to the competent data-protection supervisory authority; in Austria, this is the Österreichische Datenschutzbehörde. The Privacy page remains the product-level privacy notice.
03 · Complaints, corrections and appeals
Correct the record without erasing the history
- Use the closest available route. Knowledge articles provide referenced correction/edit requests; recipes provide reporting and contributor-review routes. These are preferable because they preserve the affected item and context.
- Record the issue, not assumptions about the person. Review should focus on the disputed statement, evidence, moderation action or process outcome.
- Separate correction from sanction. A factual correction does not automatically imply misconduct. Suspected fabrication, harassment, coordinated manipulation or serious safety misrepresentation requires a separate governance decision.
- A different eligible reviewer should decide an appeal where practical. The person whose decision is challenged should not be the sole appeal reviewer.
- Preserve version history. Accepted corrections change the current public version through the governed publication workflow rather than silently rewriting historical decisions.
Restaurant Index status
Formal restaurant scoring and assessment appeals are not yet live. GCSI will not present an assessment appeal clock or formal restaurant decision as operational until the assessment methodology, evidence workflow and dedicated complaint/appeal intake are released.
04 · Conflicts of interest
Disclose, recuse, document
A reviewer, editor or future assessor should disclose a relationship that could reasonably affect—or appear to affect—their judgement. Examples include authorship of the material being reviewed, employment by the organisation concerned, paid consulting, direct financial interests, close personal relationships or active disputes.
Disclose
State the material relationship before making the decision. Do not hide a conflict because the reviewer believes they can remain objective.
Recuse
Reviewer self-review is blocked. An administrator may use an explicit operational exception for a self-submitted editorial item only when assigned to it; that exception is audited and earns no reviewer points. Other material conflicts should normally move the decision to another eligible reviewer or assessor.
Document
If participation remains necessary because expertise is scarce, record the reason and add independent review rather than silently waiving the conflict.
05 · Sponsorship and commercial independence
Money cannot buy a conclusion
- Paid training, consulting, sponsorship, listing enhancements or future commercial services cannot raise an evidence score or guarantee a mark, recommendation or publication.
- Sponsored material must be distinguishable from editorial/research material and must not imitate an independent GCSI conclusion.
- Sponsors and commercial partners do not receive unpublished reviewer votes, private member data or the ability to veto critical findings.
- A commercial relationship relevant to an assessment or article should be disclosed where a reasonable reader would consider it material.
- Research or assessment methods must not be changed solely to obtain a more favourable outcome for a payer or partner.
06 · Incident response
Contain first, communicate what is known
An incident may involve security, privacy, email delivery, authentication, publication integrity, service availability or a safety-critical information failure. Severity is based on potential harm and scope, not on how visible the incident is.
- Confirm and contain. Preserve relevant evidence, stop ongoing exposure/failure where possible, and avoid destructive “cleanup” that prevents investigation.
- Protect people and access. Revoke affected sessions/credentials, suspend unsafe automation or hide unreliable public material when that reduces harm.
- Assess scope. Identify affected systems, time window, data/content and people without speculating beyond available evidence.
- Communicate proportionately. Material public impact should receive a clear notice once facts are sufficiently verified. Required notifications to affected people or authorities are handled according to the applicable circumstances and law.
- Recover and learn. Restore from a known-good state, verify the fix, record decisions and add a regression/control when a reasonable preventive measure exists.
GCSI does not currently claim continuous automated public status monitoring. A public status/incident-history surface will be introduced only with a maintenance process that can keep it accurate.
07 · Change control
Policies change visibly
Material changes receive a new policy-set version and effective date. A policy change does not retroactively convert a planned capability into a live one. Product documentation and the public guide must continue to distinguish live, partial, planned and research-dependent workflows.