gecco legal
This agreement governs confidentiality between us and how gecco processes personal data on your behalf. It sets out our obligations as your data processor under the UK GDPR and the Data Protection Act 2018.
Where gecco processes personal data on your behalf, we may use sub-processors. The current list is published and kept up to date.
Your proposal, the Online Subscription and Licensing Agreement and this agreement together form your contract with gecco. Each governs its own subject matter.
There is one version of this Agreement. Any copy published online is a reference copy of the same text. gecco may update this Agreement only in the limited way clause 29.2 allows, on 30 days' written notice and without weakening your protections. Every other change needs your signature. See clause 29.
gecco Ltd, a company registered in England under company number 15748830, whose registered office is at 27 Old Gloucester Street, London, WC1N 3AX, and registered with the Information Commissioner's Office under registration number ZC094719 ("gecco"), and
[COUNTERPARTY FULL NAME], a [company / charity / LLP] registered in England under [company / charity] number [NUMBER], whose registered office is at [ADDRESS] (the "Client").
gecco and the Client are each a "Party" and together the "Parties".
The Parties intend to exchange information for the purpose of [DESCRIPTION OF PURPOSE, for example exploring and delivering AI consultancy, AI Solutions, automation and training services] (the "Purpose").
In carrying out the Purpose, gecco may process personal data on behalf of the Client. This Agreement governs the confidentiality of information the Parties share and the processing of personal data under the UK GDPR and the Data Protection Act 2018.
This Agreement can be signed on its own, before any Proposal exists. It can also be incorporated into a Proposal, in which case it forms part of the Contract.
In this Agreement, the following terms have the following meanings.
1.1 The following terms are used across the gecco contract documents and have the same meaning in each.
"gecco", "we", "us", "our" means gecco Ltd, registered in England under company number 15748830, whose registered office is at 27 Old Gloucester Street, London, WC1N 3AX.
"you", "your", "the Client" means the organisation named in the Proposal.
"Proposal" means the gecco proposal, service order or contract document signed by you, whatever it is titled, which sets out the commercial terms.
"OSLA" means the gecco Online Subscription and Licensing Agreement, published at https://www.geccohq.com/osla.
"NDA/DPA" means the gecco Mutual Non-Disclosure and Data Processing Agreement, published at https://www.geccohq.com/nda-dpa.
"Contract" means the Proposal, the OSLA and the NDA/DPA together.
"AI Solutions" means the skills, projects, artefacts and schedules that gecco designs, deploys or maintains within your Workspace.
"Advanced AI Solutions" means websites, web applications, custom MCP connectors, agent builds and automation builds that gecco designs, builds or maintains for you. They are scoped and priced in your Proposal.
"Solutions" means AI Solutions and Advanced AI Solutions together. gecco uses this word to describe everything it builds. Where this Agreement imposes an obligation it names AI Solutions or Advanced AI Solutions, so that it is always clear which is meant.
"Platform" means the third-party AI platform selected for your deployment.
"Platform Provider" means the operator of that Platform.
"Workspace" means the environment in which AI Solutions are built, tested or deployed, whether yours or gecco's.
"Services" means the design, deployment, maintenance, training and consultancy gecco provides under the Contract.
"Privacy Policy" means the gecco privacy notice published at https://www.geccohq.com/privacy-policy.
"Amendment" means a document signed by both parties that varies one or more named terms of a named Contract and leaves everything else unchanged.
1.2 The following additional terms apply to this Agreement.
"Confidential Information" has the meaning given in clause 3.
"Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any other law about the processing of personal data that applies to a Party, in each case as amended or replaced.
"Disclosing Party" means the Party that discloses Confidential Information. "Receiving Party" means the Party that receives it.
"Personal Data Breach" has the meaning given in the UK GDPR.
"Restricted Transfer" means a transfer of personal data to a country outside the United Kingdom that is only permitted under Chapter V of the UK GDPR if the transferring Party puts a safeguard in place.
"Sub-processor" means a third party gecco engages to process Client personal data in performing the Services.
"controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the UK GDPR.
1.3 Where this Agreement is signed before a Proposal exists, "you", "your" and "the Client" mean the organisation named in the Parties section above.
2.1 A reference to a clause or a Schedule is a reference to a clause of, or a Schedule to, this Agreement. The Schedules form part of this Agreement.
2.2 Headings are for convenience only and do not affect the meaning of this Agreement.
2.3 "including" and "in particular" do not limit what comes before them.
2.4 A reference to legislation includes any amendment or replacement of it.
3.1 "Confidential Information" means any information one Party discloses to the other, whether orally, in writing, electronically or by any other means, that is marked as confidential or that a reasonable person would treat as confidential given its nature and the circumstances of disclosure. It includes:
(a) business plans, strategies, pricing, financial information and client lists;
(b) technical data, software, source code, object code, algorithms, prompts, system designs and architectures;
(c) methodologies, processes, know-how and trade secrets;
(d) personal data; and
(e) any information derived from any of the above.
4.1 Each Party will use the other Party's Confidential Information only for the Purpose. Any other use requires the Disclosing Party's prior written agreement.
5.1 Each Party will keep the other Party's Confidential Information secure and will not disclose it to any third party, except to:
(a) its employees, officers, directors and contractors who need it for the Purpose, who know they owe a duty of confidence to the Disclosing Party, and who are bound by obligations at least as strict as those in this Agreement; and
(b) its professional advisers, provided they are bound by professional duties of confidentiality.
5.2 Partner and accreditation programmes. gecco belongs to partner and accreditation programmes operated by Platform Providers. You permit gecco to disclose to those programmes your organisation's name, a general description of the work gecco has done for you, and the name and business email address of your main contact for the engagement. gecco will not disclose your pricing, your commercial terms, any document you have given gecco, any session recording or transcript, or anything you have marked confidential. gecco will require the programme operator to hold what it receives in confidence and not to publish it without your written consent. You confirm that you may lawfully permit this disclosure. On written request gecco will tell you what it has disclosed about you and when.
6.1 Where a Receiving Party uses subcontractors or third-party tools, including AI platforms and software services, in connection with the Purpose, it will put appropriate confidentiality obligations and technical safeguards in place to protect the Confidential Information. The Receiving Party remains responsible for any breach by those subcontractors.
6.2 Where gecco uses a Sub-processor to process Client personal data, clause 14 applies in addition to this clause.
7.1 Clauses 4 and 5 do not apply to information which:
(a) is or becomes publicly available through no fault of the Receiving Party;
(b) the Receiving Party already knew before the Disclosing Party disclosed it, free of any obligation of confidence;
(c) the Receiving Party receives from a third party who is free to disclose it without restriction;
(d) the Receiving Party develops independently without reference to the Confidential Information; or
(e) the Receiving Party must disclose by law, regulation or order of a court or competent authority. In that case the Receiving Party will give the Disclosing Party prompt written notice where the law allows, and will cooperate with any effort to limit or protect the disclosure.
8.1 On request from the Disclosing Party, or when this Agreement ends, the Receiving Party will promptly return or destroy all copies and records of the Confidential Information, at the Disclosing Party's election, and will confirm in writing that it holds no copies or records.
8.2 Clause 8.1 does not apply to copies held in automated backup systems, or to copies a Party must keep by law. Those copies remain subject to this Part A until they are deleted.
9.1 Nothing in this Agreement grants either Party any licence, interest or right in the other Party's intellectual property, other than the right to use the Confidential Information for the Purpose. Ownership of intellectual property in the Services and the AI Solutions is governed by the OSLA.
10.1 Where gecco processes personal data on your behalf in connection with the Purpose, you are the controller and gecco is the processor.
10.2 Where gecco processes personal data for its own business administration, such as managing its client relationship with you, gecco is a controller in its own right. That processing falls outside this Part B. gecco describes it in the Privacy Policy, which is a notice and is not part of this Agreement.
10.3 Where you use a Platform in your own Workspace, you are the controller and the Platform Provider is your own processor under your own agreement with the Platform Provider. In that arrangement the Platform Provider is not a gecco Sub-processor. Schedule 1 explains this in full.
11.1 gecco will process personal data only to the extent necessary for the Purpose, and only in accordance with:
(a) this Agreement, including Schedule 1;
(b) your documented instructions, including any reasonable written instruction you give from time to time; and
(c) the Data Protection Legislation.
11.2 gecco will not process the personal data for any other purpose.
11.3 gecco will not use your personal data to train, fine-tune or improve any AI model without your explicit written consent. This clause governs your personal data only. It does not restrict any Platform Provider's own data usage policies, which are governed by your own agreement with that Platform Provider. See clause 22.
11.4 If gecco believes an instruction from you breaches the Data Protection Legislation, gecco will tell you without delay. gecco may pause the affected processing until the instruction is resolved.
11.5 Where gecco is required by law to process personal data in a way your instructions do not cover, gecco will tell you before processing, unless the law prohibits that notice.
12.1 Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects, and the environments in which processing takes place.
12.2 Schedule 1 governs the description of the processing. A Proposal, service order or other commercial document cannot vary Schedule 1. This reflects clause 26, under which this Agreement governs the processing of personal data.
12.3 Where an engagement needs a different or more detailed processing description, the Parties will agree it as a written variation to Schedule 1, signed by both Parties under clause 29. Once signed, that variation forms part of Schedule 1.
13.1 gecco will take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Those measures will include, as a minimum:
(a) encryption of personal data in transit and at rest;
(b) access controls that limit personal data to gecco personnel who need it for the Purpose;
(c) multi-factor authentication on gecco accounts that can access personal data;
(d) regular review and testing of the measures to confirm they remain effective; and
(e) holding an appropriate recognised information security certification.
13.2 gecco will make sure everyone at gecco with access to personal data knows it is confidential and is bound by a written duty of confidentiality that survives the end of their engagement.
14.1 You give gecco general written authorisation to engage Sub-processors, under Article 28(2) of the UK GDPR. The Sub-processors authorised at the date of this Agreement are listed in Schedule 2.
14.2 gecco maintains the current list of its Sub-processors at https://www.geccohq.com/sub-processors. That page is the operative list for the purposes of this Agreement, and it changes only under the process in clauses 14.3 to 14.7. Schedule 2 is a snapshot of that list at the date of this Agreement. Where the Privacy Policy reproduces the same list, it does so as a courtesy copy and the published Sub-processor page prevails.
14.3 Before adding or replacing a Sub-processor, gecco will give you at least 30 days' written notice. The notice will name the Sub-processor, describe what it will process and why, and state where it will process the data.
14.4 You may object to a proposed Sub-processor within 14 days of the notice, on reasonable grounds relating to data protection. You must give your grounds in writing.
14.5 If you object, the Parties will work in good faith to agree a solution. If the Parties cannot agree within 30 days of the objection, you may terminate the affected Services without penalty. Termination is carried out under the OSLA, which governs termination.
14.6 Where gecco engages a Sub-processor, gecco will make sure that Sub-processor is bound by data protection obligations no less protective than those in this Agreement. gecco may satisfy this by accepting the Sub-processor's own published data processing terms. Where a Sub-processor fails to fulfil its data protection obligations, gecco remains liable to you for the performance of those obligations, as Article 28(4) of the UK GDPR requires. That liability is subject to clause 23. gecco is not otherwise responsible for a Sub-processor's acts or omissions, and clause 22 governs your own Platform Providers.
14.7 Where gecco must replace a Sub-processor urgently to keep the Services running or to protect security, gecco may do so with shorter notice. gecco will tell you as soon as it can, and clauses 14.4 to 14.6 then apply to the replacement, with your objection period running from the date gecco tells you.
14.8 The website and prospect-facing service providers listed in the Privacy Policy under gecco's own controller processing are not Sub-processors of your personal data under this Agreement. They process data gecco collects through its own website and marketing under a separate legal basis, and they are listed separately.
15.1 gecco may make a Restricted Transfer where it is necessary for the Purpose and where Schedule 2 or a notice under clause 14.3 identifies the Sub-processor and its processing location. That authorisation is given under clause 14.1 and does not need a separate consent for each transfer.
15.2 Where gecco makes a Restricted Transfer, gecco will:
(a) put in place a transfer mechanism that meets Article 46 of the UK GDPR, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or rely on a valid UK adequacy regulation where one applies;
(b) complete and record a transfer risk assessment, being the data protection test required by the Data Protection Legislation, before the transfer begins;
(c) review that assessment when circumstances change materially; and
(d) provide you with a summary of the mechanism and the assessment on written request.
15.3 gecco makes a Restricted Transfer only in respect of the processing described as Flow B in Schedule 1. Where personal data is processed inside your own Workspace, described as Flow A in Schedule 1, gecco is not the exporter. Any transfer arising from your own Platform is governed by your own agreement with your Platform Provider.
15.4 gecco does not make any statement about where any Platform Provider stores or processes data, how long it retains it, or how it uses it. See clause 22.
16.1 gecco will notify you of a Personal Data Breach affecting your personal data without undue delay after gecco becomes aware of it.
16.2 The notification will include, so far as gecco knows at the time:
(a) the nature of the breach, including the categories and approximate number of data subjects and records affected;
(b) the name and contact details of gecco's point of contact;
(c) the likely consequences of the breach; and
(d) the measures gecco has taken or proposes to take to address the breach and reduce its effects.
16.3 If gecco cannot provide all of that information at once, gecco will provide what it has with its notification and the rest in stages, without further undue delay.
16.4 gecco will give you all reasonable assistance you need to meet your own obligations under Articles 33 and 34 of the UK GDPR. That includes helping you prepare and submit a notification to the Information Commissioner's Office within your 72-hour window, and helping you communicate with affected data subjects where that is required.
16.5 gecco will not notify the Information Commissioner's Office or any data subject about a breach of your personal data unless you ask gecco to do so in writing, or the law requires gecco to do so.
16.6 gecco will keep a record of every Personal Data Breach affecting your personal data and will make that record available to you on request.
17.1 gecco will promptly tell you if it receives a request from a data subject to exercise rights under the Data Protection Legislation in respect of your personal data. gecco will not respond to that request itself unless you instruct it to in writing.
17.2 gecco will give you reasonable assistance, using appropriate technical and organisational measures, to help you respond to requests for access, rectification, erasure, restriction, portability and objection.
18.1 gecco will give you reasonable assistance with any data protection impact assessment under Article 35 of the UK GDPR, and with any prior consultation with the Information Commissioner's Office under Article 36, where the processing under this Agreement is likely to result in a high risk to data subjects.
18.2 That assistance may include information about gecco's processing activities, its security measures, its Sub-processors and the processing environments described in Schedule 1.
19.1 When the Purpose is complete, when this Agreement ends, or when you ask in writing, gecco will:
(a) stop processing your personal data;
(b) return or securely delete all of it, at your election; and
(c) confirm in writing, within 30 days, that it has done so.
19.2 Clause 19.1 does not apply to personal data gecco must keep by law. gecco will tell you what it keeps and why. Anything gecco keeps stays subject to this Agreement until gecco deletes it.
19.3 Clause 19.1 does not apply to copies held in automated backup systems. gecco does not use those copies, and they are deleted when the backup cycle expires. Those copies stay subject to this Agreement until they are deleted.
19.4 Deleting personal data under this clause does not release either Party from its obligations in Part A in respect of any Confidential Information it still holds.
20.1 gecco will make available to you all information reasonably necessary to demonstrate that it complies with this Part B, and with Article 28 of the UK GDPR.
20.2 gecco may satisfy a request under clause 20.1 by providing current certifications, audit reports, policies or completed security questionnaires, where these reasonably answer the request.
20.3 Where those materials do not reasonably answer the request, you may audit gecco's compliance, subject to the following.
(a) You may audit once in any 12-month period. You may also audit after a Personal Data Breach affecting your personal data, and where a regulator requires it. Those additional audits do not count towards the annual limit.
(b) You will give at least 30 days' written notice, and will agree the scope, timing and duration with gecco in advance. Audits take place during business hours and must not unreasonably disrupt gecco's business.
(c) You will bear your own costs and the costs of any auditor you appoint. gecco may charge its reasonable costs of assisting with an audit at its standard rates.
(d) Any auditor you appoint must not be a competitor of gecco, and must sign a confidentiality undertaking with gecco before the audit begins.
(e) gecco is not required to give access to information about its other clients, to personal data of any other controller, or to gecco's own commercially sensitive information beyond what is necessary to demonstrate compliance. gecco may redact material for those reasons.
20.4 Each Party will treat the findings of an audit as the Confidential Information of both Parties.
21.1 gecco will keep a written record of the categories of processing it carries out on your behalf, as required by Article 30(2) of the UK GDPR, and will make it available to you or to a regulator on request.
22.1 Your use of the Platform is governed by your own agreement with the Platform Provider. You are responsible for reviewing and accepting those terms and confirming the current position directly with the Platform Provider.
22.2 gecco makes no statement and gives no warranty about any Platform Provider's data residency, retention, security, sub-processing or model training practices. Those matters sit between you and your Platform Provider.
22.3 gecco will help you understand the questions to ask your Platform Provider, and will support your procurement process. That support is not advice about the Platform Provider's terms and does not make gecco responsible for them.
22.4 Responsibility for procuring Platform licences is set out in the OSLA. It is relevant here only because it determines who holds the data processing terms with the Platform Provider.
23.1 The limitation and exclusion of liability set out in the OSLA applies to all claims under or in connection with this Agreement, including claims about confidentiality and claims about the processing of personal data.
23.2 Claims under this Agreement and claims under the OSLA count towards the same single cap. They are not added together and the cap is not applied twice.
23.3 Nothing in this Agreement limits or excludes either Party's liability for:
(a) death or personal injury caused by negligence;
(b) fraud or fraudulent misrepresentation; or
(c) anything else that cannot lawfully be limited or excluded.
23.4 Where this Agreement is in force and no OSLA is in force between the Parties, each Party's total liability under or in connection with this Agreement is limited in aggregate to £50,000, subject to clause 23.3.
23.5 Clause 23.1 does not limit either Party's obligations to a data subject or to a regulator under the Data Protection Legislation. Nothing in this Agreement purports to limit any liability that the Data Protection Legislation does not allow to be limited.
24.1 Each Party accepts that a breach of this Agreement may cause harm that damages alone cannot put right. Either Party may therefore seek an injunction or other equitable remedy, in addition to any other remedy available to it.
24.2 Nothing in clause 24.1 increases either Party's financial liability beyond the limits in clause 23.
24.3 Clause 24.1 applies without the need to follow the steps in clause 28.
25.1 This Agreement takes effect on the date it is signed. Where it is incorporated into a Proposal, that is the date the Proposal is signed. Where it is signed on its own, it is the date the last Party signs it.
25.2 Where this Agreement forms part of a Contract, it runs for as long as the Contract runs. Termination of the Contract is governed by the OSLA, which owns termination. This Agreement then ends when the Contract ends, subject to clause 25.4.
25.3 Where this Agreement stands alone and no Contract is in force, either Party may terminate it on 30 days' written notice.
25.4 Part A survives termination for 3 years, and indefinitely for trade secrets. Part B survives for as long as gecco holds your personal data. Clauses 19, 20, 23, 26 and 28 survive termination.
26.1 Each document in the Contract governs its own subject matter.
(a) The Proposal governs the commercial terms, meaning price, scope, deliverables, payment schedule and dates.
(b) The OSLA governs all other matters, including intellectual property, liability, warranties, service levels and termination.
(c) The NDA/DPA governs confidentiality and the processing of personal data.
Where a document contains a term outside its own subject matter, that term has no effect. Where two documents genuinely conflict within the same subject matter, the document that owns that subject matter prevails.
26.2 It follows from clause 26.1 that this Agreement governs confidentiality and the processing of personal data, including Schedule 1 and Schedule 2. No Proposal or other document can vary those matters.
26.3 Liability, termination, remedies, dispute resolution and general contractual machinery are the OSLA's subject matter. Clauses 23, 24, 25, 28 and 30 of this Agreement do not create a competing regime. While a Contract is in force, they defer to the OSLA and give effect to it. They apply in their own right only where this Agreement stands alone and no Contract is in force, which is when there is no OSLA to defer to.
26.4 The Privacy Policy is a notice. It is not incorporated into this Agreement or into the Contract, and nothing in it creates a contractual obligation. Clause 14.2 refers to the Privacy Policy only as the place where gecco publishes its current Sub-processor list.
27.1 Nothing in this Agreement obliges either Party to enter into any further agreement or to proceed with the Purpose. Neither Party is liable for costs or losses arising from a decision not to proceed.
28.1 This Agreement is governed by the law of England and Wales.
28.2 If a dispute arises out of or in connection with this Agreement, the Parties will follow these steps in order.
(a) The Parties will negotiate in good faith. Each Party will escalate the dispute to a senior representative with authority to settle it. If the dispute is not resolved within 30 days of written notice of the dispute, step (b) applies.
(b) The Parties will attempt to settle the dispute by mediation under the CEDR Model Mediation Procedure, or under another mediation procedure the Parties agree in writing. If the Parties have not agreed a mediator within 14 days of a written request to mediate, CEDR will appoint one.
(c) If mediation does not resolve the dispute, either Party may bring proceedings. The courts of England and Wales have non-exclusive jurisdiction.
28.3 This clause mirrors the dispute resolution provisions of the OSLA. Where a Contract is in force, the OSLA governs dispute resolution and this clause gives effect to it. Where this Agreement stands alone, this clause applies in its own right. There is no route to court that skips negotiation and mediation.
28.4 This clause does not prevent either Party from applying for urgent injunctive relief at any time under clause 24.
28.5 This clause does not prevent either Party from applying for summary judgment for an undisputed debt.
29.1 Except where clause 29.2 allows, no variation of this Agreement is effective unless it is in writing and signed by both Parties. Continued use of the Services does not amount to acceptance of a change that required your signature.
29.2 gecco may update this Agreement by giving you at least 30 days' written notice, provided the update does not materially reduce the protections this Agreement gives you and does not lessen gecco's obligations as your processor under Article 28 of the UK GDPR. Updates gecco may make this way include changes to reflect a change in law or in regulatory guidance, a replacement transfer mechanism, a change to gecco's security measures that leaves them at least as protective, and changes to contact details or to a process this Agreement describes. Any other change requires a signed variation under clause 29.1.
29.3 Clause 29.1 applies to the Schedules. gecco may update the published Sub-processor list under clause 14 without a signed variation, because clause 14 already sets out the process the Parties have agreed for that.
29.4 A copy of this Agreement published at https://www.geccohq.com/nda-dpa is a reference copy of the version in force between the Parties. If the published copy and the signed copy differ, the signed copy prevails, unless gecco has updated this Agreement under clause 29.2 and the notice period has ended, in which case the updated version applies.
29.5 An Amendment takes effect from the date it states. It varies only the terms it names, and everything the Amendment does not name continues unchanged. An Amendment that varies this Agreement must be signed by both Parties, as clause 29.1 requires.
29.6 If you reasonably consider that an update notified under clause 29.2 does materially reduce your protections, you may object in writing within 14 days of the notice, giving your grounds. The Parties will then follow clause 14.5, and if they cannot agree a solution you may terminate the affected Services without penalty. The update does not apply to you while an objection is being resolved.
30.1 Entire agreement. This Agreement, together with any Contract into which it is incorporated, is the entire agreement between the Parties on its subject matter and replaces all earlier discussions, negotiations and agreements on that subject matter, including version 2.0 of this Agreement and the separately hosted variant of version 2.0.
30.2 Third party rights. No one who is not a Party has any right to enforce any term of this Agreement under the Contracts (Rights of Third Parties) Act 1999.
30.3 Severability. If any part of this Agreement is found to be invalid, the rest remains in force.
30.4 Assignment. Neither Party may assign or transfer this Agreement without the other Party's written consent, which will not be unreasonably withheld. gecco may assign to a group company or to a buyer of its business on written notice.
30.5 Notices. Notices under this Agreement must be in writing and sent to the addresses on the signature page, or to an email address the Parties have agreed in writing for that purpose. A notice sent by email takes effect when it is sent, unless the sender receives a delivery failure message.
30.6 Counterparts and electronic signature. This Agreement may be signed in counterparts and by electronic signature, including through Google eSignature, DocuSign or a similar platform. An electronic signature has the same legal effect as a handwritten one.
| Item | Detail |
|---|---|
| Subject matter | Designing, building, testing, deploying and maintaining AI Solutions for you, and delivering the related training and consultancy. |
| Duration | For the duration of the Services, or until this Agreement is terminated, whichever is earlier. Clause 19 governs what happens to personal data after that. |
| Nature of the processing | Collection, storage, retrieval, access, analysis, use, transmission, and deletion of personal data, in order to configure, test, refine and maintain AI Solutions and automated workflows. It includes accessing your Workspace for maintenance, troubleshooting and compliance checks. |
| Purpose of the processing | Delivering the Services, being the Purpose defined in the Background and, where a Proposal exists, the Services described in that Proposal. gecco does not process your personal data for any other purpose. |
| Types of personal data | Names, email addresses, job titles, department and team information, business contact details, enquiry and correspondence records, meeting and session notes, survey and feedback responses, and any other personal data you provide or make accessible for the Purpose. |
| Special category data | gecco does not require special category data or criminal offence data for the Purpose. You will not place such data in a Workspace or in any material shared with gecco unless the Parties have agreed it in writing in advance and have recorded the additional safeguards that apply. |
| Categories of data subjects | Your staff, contractors, clients, customers, prospects, suppliers, members and any other individuals whose personal data you hold. |
| Frequency of transfer | Continuous for the duration of the Services. |
Partner and accreditation programmes. Where clause 5.2 applies, gecco discloses your organisation's name, a general description of the work, and the name and business email address of your main contact for the engagement, to a partner or accreditation programme of the kind described in clause 5.2. That disclosure is made on your instruction under clause 5.2 and for no other purpose.
Where this Agreement is signed before a Proposal exists. Clause 25.3 allows this Agreement to be signed on its own. In practice that is the AI showcase, being the session in which gecco uses a limited amount of your real material to show you what it can build for you, before any Proposal is signed. In that case there are no Services and no Proposal, and the table above is read as follows. The subject matter, nature and purpose of the processing are limited to the showcase, or to any other Purpose stated in the Background. The duration runs until the showcase is complete, until either Party terminates under clause 25.3, or until a Proposal is signed and the table above applies in full. The types of personal data and the categories of data subjects are as stated above, limited to what the showcase requires. Once a Proposal is signed, this paragraph stops applying.
Processing under this Agreement happens in two separate environments. They work differently and have different legal effects. gecco keeps them separate and describes them separately below.
This is the normal arrangement and covers most of the processing.
This is narrower and covers development, problem solving and the running of gecco's own delivery operation.
A single provider can appear in both flows in different roles. For example, a provider may be your own processor inside your Workspace under Flow A, under your agreement with it, and separately a gecco Sub-processor for gecco's own tools under Flow B, under gecco's agreement with it. The two roles are separate. Schedule 2 covers the Flow B role only.
This is a snapshot of gecco's Sub-processors at the date of this Agreement. The current list is published at https://www.geccohq.com/sub-processors. Clause 14 governs changes to this list.
These are gecco's Sub-processors for the processing described as Flow B in Schedule 1. They are not your Platform Providers, and they are not the website and marketing service providers gecco lists separately in the Privacy Policy for its own controller processing.
This Schedule and the published Sub-processor list are generated from the same source and are intended to be identical. If they differ, the published Sub-processor list prevails, as clause 14.2 provides, and clauses 14.3 to 14.7 govern how that list changes.
| Provider | Purpose | Processing location, as notified by the provider | Transfer basis |
|---|---|---|---|
| Microsoft Limited, a United Kingdom company, Microsoft Campus, Thames Valley Park, Reading, Berkshire RG6 1WG, VAT GB724594615 | gecco's own Microsoft 365 tenant. SharePoint client folders, Teams client sessions and their recordings and transcripts, OneDrive, email, and Microsoft Forms feedback surveys | United Kingdom for Exchange Online, Microsoft Teams, OneDrive and SharePoint, read from gecco's own tenant Data Location Card. Microsoft Forms is not listed on that card, so the provider publishes no location for it | Covered by UK adequacy regulations. No Article 46 safeguard is required. |
| Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland | Google Workspace. Email, calendar and document collaboration used to run your engagement, and the gecco shared drives holding client contract records | Europe, where the data region is set to Europe, read from gecco's own Google Admin console. The same screen states that this policy applies to Google Workspace Business Plus and Business Plus Archived User licences and covers certain core services. gecco holds Google Workspace Business Plus with 6 licences assigned, read in the Admin console at Billing then Subscriptions on 12 September 2026, so the policy applies and the setting operates | Covered by UK adequacy regulations for the EEA. The contracting entity is in Ireland rather than the United States. The data region policy covers certain core services only, so logs and cached content sit outside it and gecco records that rather than estimating a location for them. |
| Google Cloud EMEA Limited, in respect of Google Meet | Recording of client kick-off, scoping, onboarding, advisory and showcase sessions held on Google Meet, and the "Notes by Gemini" document Meet writes of the session whether or not it is recorded. Saved to the meeting organiser's personal My Drive | Europe, where the data region is set to Europe, at the licence level recorded in the Google Workspace row above | Covered by UK adequacy regulations for the EEA. The contracting entity is in Ireland rather than the United States |
| GitHub, Inc. | Private repositories holding client delivery material and session transcripts, synchronised between gecco devices | United States. No UK region is offered for this service | Article 46 safeguard, being the EU standard contractual clauses with the UK International Data Transfer Addendum issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, incorporated by the provider's data processing agreement at section 7.C.iii. |
| Applications installed on gecco's GitHub organisation | Third-party applications with standing access to gecco's repositories, which are where client session transcripts, pain-point registers and delivery material are stored. Claude, with write access on every repository, and Claude Design Import, with read-only access on every repository, are published by Anthropic. ChatGPT Codex Connector is published by OpenAI and Netlify by Netlify, and both are limited to selected repositories. Supabase holds read access to every repository and write access to actions, checks, pull requests and workflows. One further application, installed for a client's own project, is limited to selected repositories. Access read on 15 September 2026; publishers read from GitHub on 21 September 2026 | Each provider's own infrastructure. For the Anthropic, OpenAI and Netlify applications, as stated in those providers' entries | The Anthropic, OpenAI and Netlify entries in this table apply to their applications. gecco does not currently use Supabase or the client project's application to process client personal data, so no separate transfer basis is recorded for them |
| Anthropic Ireland, Limited | gecco's own Claude Teams workspace, used to analyse session transcripts and produce delivery documents. Also reached through the Anthropic API from gecco's own automations, for analysis of client session transcripts, extraction of actions and pain points, drafting of client-facing session emails and delivery documents, processing of the files a Client uploads to gecco, evaluation and enrichment of generated documents, session preparation briefs, and mapping of imported lead lists | United States. No UK or EU storage option is offered for this service | Article 46 safeguard, being the EU standard contractual clauses with the UK International Data Transfer Addendum issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, incorporated by the provider's data processing agreement. |
| Wispr AI, Inc., trading as Wispr Flow | Recording and transcription of client sessions through Wispr Flow Notetaker, and dictation through Wispr Flow Dictation, on gecco's own Teams plan. When Notetaker is connected, it also reads the calendar, contacts and directory of the gecco Google account that connects it, to identify meetings and participants | United States, as the provider's privacy policy states | Article 46 safeguard, being the EU standard contractual clauses with the UK International Data Transfer Addendum, incorporated by the provider's data processing addendum, which applies when personal data is sent through the service |
| OpenAI OpCo, LLC, a Delaware company, company number 7063675 | gecco's own ChatGPT Business workspace, used to design, prototype and test AI Solutions where ChatGPT is the Platform for your engagement. Also gecco's own account reached through the API from gecco's own automations, for service order generation and document drafting. The sales pipeline and post-meeting processing uses are prospect data where gecco is the controller and are listed in the Privacy Policy's Articles 13 and 14 table | United States by default. The provider offers a United Kingdom option at gb.api.openai.com for storage only, with no regional processing, which must be configured per project. That option is for the API. Data residency is not available on ChatGPT Business | Article 46 safeguard, being the EU standard contractual clauses as amended by the UK International Data Transfer Addendum issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, incorporated automatically by the provider's data processing agreement at clause 4.2 and deemed entered into. No Data Privacy Framework certification. API data is not used for model training by default. |
| Google LLC, in respect of the Gemini API | Research and drafting within gecco's own automations, including the core documents pipeline. A different service from Google Workspace above | Any country in which Google or its agents maintain facilities, as the provider's Gemini API terms state | Covered by UK adequacy regulations under the UK Extension to the EU-US Data Privacy Framework. Google LLC's entry on the Data Privacy Framework List is active, read on 21 September 2026. |
| Zoho Corporation Limited, registered in England and Wales, company number 13424508 | Client relationship management and client communications used to run your engagement. gecco holds Zoho CRM Plus. Zoho provisions a separate organisation for each service in the bundle. Client personal data sits in Zoho CRM; in Zoho Sign, which holds signed service orders and the names of the people who signed them; in Zoho Campaigns, which holds the client contact subscribed to the onboarding mailing list; and in Zoho Forms. Zoho Projects is used for gecco's internal task management. Tasks are created from gecco's own meeting notes and may incidentally contain the name of a client contact; they do not hold client files or client contact records. Zoho Desk is not currently in use | Netherlands, with Ireland as secondary. The provider states that support staff in India may access data where gecco grants support access | Covered by UK adequacy regulations for the storage locations. Where support access is granted, the provider's own transfer terms apply. UK data processing addendum initiated per organisation, 19 August 2026 |
| n8n GmbH | Workflow automation used to run the pipelines we build and operate for you | Germany and Sweden | Covered by UK adequacy regulations. No Article 46 safeguard is required. |
| Calendly LLC | Scheduling of onboarding, training and delivery sessions with your staff, including any free text your staff type into the booking questions, and the email addresses of additional guests added to a booking | United States | Covered by UK adequacy regulations under the UK Extension to the EU-US Data Privacy Framework. Calendly LLC's entry on the Data Privacy Framework List is active, read on 21 September 2026. |
| Netlify, Inc. | Hosting of gecco's internal delivery site, whose published walkthroughs carry client staff names and the text of client deliverables | United States | Covered by UK adequacy regulations under the UK Extension to the EU-US Data Privacy Framework. Netlify, Inc's entry on the Data Privacy Framework List is active, read on 21 September 2026. |
| Lunaweb GmbH, Grünwald, Germany, trading as CloudConvert | Conversion of service order and contract documents to PDF. The whole rendered document, including signatory and contact details, is sent to the provider | Germany or the United States, the provider's two processing regions, as its API documentation states | Covered by UK adequacy regulations for the contracting entity, Lunaweb GmbH, in Germany. gecco and the provider have signed a data processing agreement that covers the UK GDPR. |
Perplexity is not listed here. gecco uses Perplexity only for marketing research from public sources, and no client personal data reaches it. It appears in the list of gecco's own processors in the Privacy Policy.
How to read the location column. Every location in this table is either quoted from the provider's own published terms or read from gecco's own account configuration, and the source is named in the cell. Where gecco has no source, the cell says so rather than estimating.
Processing locations are as notified to gecco by each Sub-processor at the date of this Agreement. gecco does not warrant that a Sub-processor's location or practices will stay the same. You can confirm the current position with the Sub-processor directly. gecco will notify you of any change under clause 14.3.
gecco Ltd. Company number 15748830. Registered with the Information Commissioner's Office, registration ZC094719. 27 Old Gloucester Street, London, WC1N 3AX. Data protection questions: info@geccohq.com