How we handle your personal data

1. What this notice is, and what it is not

This is a notice. It tells you what gecco does with personal data, in plain English.

Nobody signs it. Nobody agrees to it. Reading it creates no contract. Using our website creates no agreement to it either. We publish it because UK GDPR Articles 13 and 14 require us to tell people what we do with their personal data. That is its only job.

This notice is never incorporated into any contract. If a proposal, order form, purchase order, framework agreement or supplier questionnaire states that this notice forms part of a contract, that wording has no effect. Our contract terms are set out in the documents described in section 3.

Because there is nothing to agree to, we can update this notice at any time. Section 19 explains how we tell you when we do.

One part of this notice is different. The sub-processor list at Table 1 in section 8 is a copy of the list published at https://www.geccohq.com/sub-processors. That published list is the operative list for our Clients, it changes only under the process in our NDA/DPA, and the freedom to update this notice at any time does not apply to it.

2. Who we are and how to contact us

We are not required to appoint a Data Protection Officer under UK GDPR Article 37. Data protection queries go to info@geccohq.com, or to support@geccohq.com if you are a Client, and are handled by a named person inside gecco.

Sometimes we are the controller of personal data, and sometimes we are a processor acting for a client. Section 5 explains which is which, and section 8 gives you a separate list of suppliers for each.

3. How this notice fits with our contracts

gecco's paperwork has three layers. Knowing which layer you are reading saves a lot of time.

Each document in the Contract owns a subject. For reference, the Contract's precedence rule reads as follows.

Each document in the Contract governs its own subject matter.
(a) The Proposal governs the commercial terms, meaning price, scope, deliverables, payment schedule and dates.
(b) The OSLA governs all other matters, including intellectual property, liability, warranties, service levels and termination.
(c) The NDA/DPA governs confidentiality and the processing of personal data.
Where a document contains a term outside its own subject matter, that term has no effect. Where two documents genuinely conflict within the same subject matter, the document that owns that subject matter prevails.

This notice is not one of those documents. It sits outside the Contract. It creates no rights and no obligations between gecco and any client. Where you need the binding data protection terms, meaning our Article 28 obligations, confidentiality, sub-processor approval, breach notification and data subject rights assistance, read the NDA/DPA.

4. Definitions

"gecco", "we", "us", "our" means gecco Ltd, registered in England under company number 15748830, whose registered office is at 27 Old Gloucester Street, London, WC1N 3AX.

"you", "your" means you as an individual, wherever this notice is talking about personal data. "the Client" means the organisation named in the Proposal. This is the one place our documents differ, and it is deliberate: personal data belongs to people rather than organisations, so a privacy notice has to speak to the individual. Everywhere else in our contract documents, "you" means the client organisation.

"Proposal" means the gecco proposal, service order or contract document signed by you, whatever it is titled, which sets out the commercial terms.

"OSLA" means the gecco Online Subscription and Licensing Agreement, published at https://www.geccohq.com/osla.

"NDA/DPA" means the gecco Mutual Non-Disclosure and Data Processing Agreement, published at https://www.geccohq.com/nda-dpa.

"Contract" means the Proposal, the OSLA and the NDA/DPA together.

"AI Solutions" means the skills, projects, artefacts and schedules that gecco designs, deploys or maintains within your Workspace.

"Advanced AI Solutions" means websites, web applications, custom MCP connectors, agent builds and automation builds that gecco designs, builds or maintains for you. They are scoped and priced in your Proposal.

"Solutions" means AI Solutions and Advanced AI Solutions together. gecco uses this word to describe everything it builds. Where this notice describes what gecco does with personal data it names AI Solutions or Advanced AI Solutions, so that it is always clear which is meant.

"Platform" means the third-party AI platform selected for your deployment.

"Platform Provider" means the operator of that Platform.

"Workspace" means the environment in which AI Solutions are built, tested or deployed, whether yours or gecco's.

"Services" means the design, deployment, maintenance, training and consultancy gecco provides under the Contract.

"Privacy Policy" means the gecco privacy notice published at https://www.geccohq.com/privacy-policy.

"Site" means www.geccohq.com.

5. The two ways personal data reaches us

Almost every question we get from a client auditor comes down to one thing. Who is responsible for what, and when. There are two answers, because there are two different data flows. They are separate and we do not merge them.

5.1 Flow A: your own workspace. This is the normal case.

Most gecco work happens inside your own Workspace, on a Platform you licence yourself.

• You buy the Platform licences directly. gecco never buys licences on your behalf and never invoices you for them.
• You are the Platform Provider's customer. You hold the agreement and the data processing terms with the Platform Provider directly. In data protection terms, the Platform Provider is your processor, not ours.
• You are the controller of the personal data your team puts into the Platform.
• gecco holds a licensed seat inside your Workspace, usually delivery@geccohq.com, so we can build and maintain your AI Solutions. For that work gecco acts as your processor, on your instructions, under the NDA/DPA.
• gecco is not the exporter for anything that happens inside your Workspace. Any transfer of data by the Platform Provider is a transfer under your agreement with them, not under ours.

Your use of the Platform is governed by your own agreement with the Platform Provider. We make no statement about where a Platform Provider stores data, how long it keeps it, whether it uses it to train models, or which transfer mechanism it applies. You are responsible for reviewing and accepting those terms and confirming the current position directly with the Platform Provider.

Where the work happens depends on the plan you hold with your Platform Provider.

• If you are on a Teams plan or an equivalent business plan, we may design, prototype and test in our own workspace before deploying into yours. We do not put personal data or sensitive business information into our workspace when we do this. We remove it, or replace it with sample data, first.
• If you are on an Enterprise plan, or you have data residency requirements, we design, build and test only inside your own environment. We do not use our own workspace for your engagement at all. Tell us before delivery starts so we can arrange it.

Some delivery work still happens in our own systems. We hold the documents you send us, we record and transcribe our sessions with you, and we keep our delivery notes and specifications in our own repositories. That work sits in Flow B, and section 8 lists the providers involved.

5.2 Flow B: gecco's own tools. This is where your material sits while we deliver.

Some work happens in gecco's own systems rather than yours. We hold the documents you send us in our own Microsoft 365 tenant. We record and transcribe our sessions with you. We use our own Claude Teams workspace to analyse those transcripts and produce the notes, actions and specifications your engagement needs. We keep those documents in our own private repositories, and we run our own project, file and workflow systems to manage the engagement.

Where personal data belonging to you reaches those tools, the position is different.

• gecco is your processor.
• The providers behind gecco's tools are gecco's sub-processors. They are listed in Table 1 in section 8.
• gecco is the exporter for this flow, and the transfer safeguards in section 9 are ours.

We keep Flow B to what the work needs. Where a task can be done with sample or anonymised data, we use that rather than your real records. Building and testing an AI Solution is one of those tasks, so where we prototype in our own workspace we do not put personal data into it. Delivery working material is different. Your documents, our recordings and transcripts, and our notes and specifications sit in our own systems whichever plan you hold, and section 8 lists the providers involved.

5.3 The two flows side by side

5.4 Website visitors and enquirers

There is a third group of people who are in neither flow. If you visit the Site, download a resource, book a meeting, subscribe to the newsletter or send us an enquiry, gecco is the controller of that data. Nobody instructs us. We decide what to do with it, and this notice tells you what that is.

6. What personal data we handle, and where we get it

6.1 As a controller: website visitors, enquirers, prospects, clients and delegates

• Identity and contact data. Name, job title, organisation, work email address, work phone number.
• Enquiry content. Anything you write in a form, an email or a meeting booking.
• Meeting data. The time you booked, the event type, attendance, and any notes we take.
• Commercial data. Proposals, quotes, orders, purchase order references, contract records.
• Billing data. Billing contact, billing address, invoice and payment records. Card details go straight to Stripe. We never see or store your card number.
• Marketing data. Subscription status, consent records, opt-out records, and whether you opened or clicked an email.
• Training data. Delegate name, work email, organisation, attendance, assessment results and certificates.
• Technical data. IP address, browser and device type, operating system, referring URL, pages viewed, session activity, approximate location at country or region level, and cookie identifiers.
• Session recordings and transcripts. Audio or video of a meeting or training session, and the written transcript produced from it, including anything said while the recording is running.
• Survey and assessment responses. What you tell us in any gecco survey, including the AI Adoption Survey and any adoption, feedback or training survey, or in an AI readiness assessment.
• Delivery working notes. The notes, action lists and specifications we write from a session, which may name you or refer to your role.

We do not seek special category data, meaning data about health, race, religion, sex life, sexual orientation, political opinions, trade union membership, genetics or biometrics. Please do not send it to us through the Site or an enquiry form. If an engagement genuinely requires it, we agree that separately in writing first.

We do not seek criminal offence data, and we do not process it unless a client engagement genuinely requires it and we have agreed the additional safeguards in writing in advance.

6.2 As a processor: personal data inside AI Solutions

When we build and maintain AI Solutions for a Client, we may handle personal data that the Client puts into its own systems. What that data contains is decided by the Client, not by us. In practice it is usually staff names and work contact details, the content of documents and messages the Client asks an AI Solution to work with, and records of the Client's own customers or members.

We process this data only on the Client's documented instructions. The NDA/DPA sets out the subject matter, duration, nature and purpose of that processing, and the obligations we owe.

6.3 Where we get personal data from

Under UK GDPR Article 14 we have to tell you when we did not get your data from you directly. Our sources are:

• You, when you fill in a form, send an email, book a meeting or sign a contract.
• Your employer or a colleague, for example when a Client adds you to an engagement, books you onto training, or names you as a contact.
• Public sources, such as company websites, Companies House, public registers and professional networking profiles.
• Business contact data providers, including Apollo, for bought or supplied lead lists containing work contact details used in business development. Where we contacted you from a list like this, you did not give us your data yourself, and this section is how we tell you where it came from.
• Our own systems, when you use the Site.

If we contacted you and you want to know where we got your details, ask us at info@geccohq.com, or at support@geccohq.com if you are a Client, and we will tell you.

7. Why we process personal data, and our lawful basis

This section covers the processing where gecco is the controller. Where gecco is a processor, the lawful basis is the Client's to identify, not ours.

Where we rely on legitimate interests, we have carried out a balancing test and concluded that our interest does not override your rights and freedoms. You can ask us for a summary of that assessment at any time.

8. Who we share personal data with: the two tables

8.1 Why there are two tables

We use suppliers for two different things, and the law treats them differently, so we list them separately.

When we handle personal data on behalf of a Client, the Client decides what happens to it and we act on the Client's instructions. The Client is the controller and gecco is the processor, so any supplier we bring in is a sub-processor. Those suppliers are in Table 1, which exists to satisfy UK GDPR Article 28. When somebody visits our website or sends us an enquiry, nobody instructs us. We decide what to do with that data ourselves, so gecco is the controller and the suppliers we use are our own processors. Those are in Table 2, which exists to satisfy Articles 13 and 14.

In short. If you are a client auditing us, or you are working through the NDA/DPA, Table 1 is the one you want. If you are a website visitor or a prospect asking what happens to your enquiry, Table 2 is the one you want. Some data does not touch either table, because in Flow A it stays inside your own Workspace with your own Platform Provider.

8.2 Table 1: sub-processors of client data

This is the Article 28 list. It covers the suppliers who may touch personal data that gecco processes on behalf of a Client, where the Client is the controller and gecco is the processor.

This table is reproduced from the list published at https://www.geccohq.com/sub-processors as a courtesy copy. The published sub-processor page is the operative list for Clients, and it changes only under the notice and objection process in clause 14 of the NDA/DPA. If this table and the published page differ, the published page prevails.

How to read the location column. Each location is either the one the provider publishes or the one set in gecco's own account. Where a provider publishes no location, the cell says so rather than estimating one. gecco keeps the record of where each entry came from and will show it to a Client on request.

Three points about this table.

First, Anthropic and OpenAI appear here because gecco uses its own accounts with them for Flow B work, meaning development, testing and problem solving in gecco's own tools. They are not in this table because of any Platform you licence yourself. If you licence a Platform directly, that Platform Provider is your processor under your own agreement, not gecco's sub-processor, and it does not belong in this table at all.

Second, the data locations shown are the regions configured for gecco's own account with each provider at the date of this notice. Providers change their infrastructure and their terms. We do not make claims about any provider's current arrangements on their behalf. Ask us and we will confirm the position at the time.

Third, we tell Clients before we add or replace a sub-processor, and Clients can object, in line with the NDA/DPA. We give at least 30 days' notice, except where we have to replace a supplier urgently to keep the Services running or to protect security, in which case we tell Clients as soon as we can. The objection right applies either way.

Perplexity is not listed here. gecco uses Perplexity only for marketing research from public sources, and no client personal data reaches it. It appears in Table 2.

8.3 Table 2: processors of website and enquiry data

This is the Articles 13 and 14 list. It covers the suppliers who may touch personal data about website visitors, enquirers, prospects and our own commercial contacts, where gecco is the controller.

Processing locations in Table 2 are as notified to gecco by each provider at the date of this notice. gecco does not warrant that a provider's location or practices will remain the same. Where Table 2 records a specific transfer mechanism, it is the mechanism gecco has verified in that provider's published terms at that date.

Some suppliers appear in both tables because we use them for both jobs. Google is the clearest example. That is not a duplication error. The legal basis, the instructions and the responsibilities are different in each case.

8.4 Other people we may share personal data with

• Professional advisers, such as our accountants, insurers and solicitors, where they need it and are bound by confidentiality.
• Regulators, law enforcement and courts, where we are required to disclose by law, regulation or court order.
• A buyer or successor, if gecco is involved in a merger, acquisition or sale of assets. We would tell affected Clients.

We do not sell personal data, and we do not share it with data brokers. If you accept marketing cookies on our cookie banner, the Google Ads and LinkedIn tags listed in Table 2 use cookies to measure our advertising and to show you our adverts on other sites.

9. International transfers

Some of the suppliers we use are based outside the UK, mainly in the United States. When personal data moves outside the UK, UK GDPR Chapter 5 requires an appropriate safeguard.

The mechanisms we rely on are:

• The UK Addendum to the EU Standard Contractual Clauses, issued by the ICO.
• The UK International Data Transfer Agreement, known as the UK IDTA.
• UK adequacy regulations, where the UK government has decided that a country provides adequate protection.

Ask us at info@geccohq.com, or at support@geccohq.com if you are a Client, and we will tell you the position on the date you ask, and give you a copy of the safeguard we rely on.

For Flow A, gecco is not the exporter. Any transfer of data out of your own Workspace by your Platform Provider happens under your own agreement with them. Your use of the Platform is governed by your own agreement with the Platform Provider. You are responsible for reviewing and accepting those terms and confirming the current position directly with the Platform Provider.

10. How long we keep personal data

We keep personal data only for as long as we need it.

When personal data is no longer needed, we delete it or anonymise it so it can no longer identify anyone. Deleted data may survive for a short period inside encrypted backups. We do not use those copies, and they go when the backup cycle expires. Clause 19.3 of our NDA/DPA says the same thing, so the contract and this notice agree.

11. Automated decision-making, profiling and AI

We do not make decisions about you by automated means alone that produce legal effects or similarly significant effects on you, as described in UK GDPR Article 22.

We use analytics tools, including Google Analytics, to understand how people use the Site. These tools group visitors by behaviour so we can improve the Site and our marketing. That is profiling under UK GDPR, but it produces no decision that significantly affects you. You can switch it off through your cookie preferences.

On AI specifically:

• gecco does not build or train AI models. We configure AI Solutions on top of Platforms that other organisations operate.
• We will not use your personal data to train, fine-tune or improve any AI model without your explicit written consent. gecco has no model of its own to train. This matches clause 11.3 of our NDA/DPA.
• What a Platform Provider does with data inside your own Workspace, including whether it is used for model training, is governed by your agreement with that Platform Provider. Check that agreement and confirm the current position with them.
• If a Client configures an AI Solution to make an automated decision with legal or similarly significant effects, the Client is the controller of that decision and is responsible for meeting Article 22 itself. We will flag it if we see it, and we will help, but it remains the Client's call and the Client's obligation.

12. How we protect personal data

• gecco is Cyber Essentials certified.
• gecco is registered with the ICO under registration number ZC094719.
• Multi-factor authentication is on for every account that can reach client data.
• We work on the principle of least privilege. In your Workspace we work through a single identifiable seat, usually delivery@geccohq.com, so you can see what we did and remove our access in one action.
• We select providers that offer encryption of data in transit and at rest, and we configure encryption where the setting is ours to make. What any individual provider does is set out in that provider's own terms, and you should confirm the current position with them.
• Where a task can be done with sample or anonymised data, we use that rather than your real records.
• When someone joins, changes role or leaves, we change or remove their access across every system they used.

No system is perfectly secure, and we will not pretend otherwise.

If a personal data breach happens:

• Where gecco is a processor for a Client, we notify the Client without undue delay after becoming aware, in line with the NDA/DPA.
• Where gecco is the controller, we report to the ICO within 72 hours where the breach is likely to result in a risk to people's rights and freedoms, and we tell the people affected without undue delay where the risk to them is high.

13. Your rights

Under UK GDPR and the Data Protection Act 2018 you have the following rights.

• Right of access. Ask for a copy of the personal data we hold about you.
• Right to rectification. Ask us to correct data that is wrong or incomplete.
• Right to erasure. Ask us to delete your personal data in certain circumstances.
• Right to restrict processing. Ask us to pause what we do with your data while something is checked.
• Right to data portability. Ask for the data you gave us in a structured, commonly used, machine-readable format.
• Right to object. Object to processing we base on legitimate interests. You can object to direct marketing at any time and we will always stop.
• Right to withdraw consent. Where we rely on consent, withdraw it at any time. That does not make our earlier processing unlawful.
• Rights relating to automated decision-making. See section 11.

To exercise any of these, email info@geccohq.com, or support@geccohq.com if you are a Client.

• We respond within one month. For complex or multiple requests we can extend by up to two further months, and we will tell you within the first month if we need to.
• There is no charge, unless a request is manifestly unfounded or excessive.
• We may ask you for proof of identity before we release personal data.

If your employer is a gecco client

If your data sits inside an AI Solution we built for your employer, your employer is the controller and gecco is only the processor. Send your request to your employer. If you send it to us instead, we will pass it to them promptly and help them answer it. We are not allowed to act on it ourselves without their instruction.

14. Complaining to the ICO

If you think we have handled your personal data unlawfully, you can complain to the Information Commissioner's Office.

You can complain to the ICO at any time. We would like the chance to put it right first, so please contact us at info@geccohq.com, or at support@geccohq.com if you are a Client, if you can, but you are under no obligation to do so.

15. Marketing

You can stop marketing emails at any time. Click the unsubscribe link in any email we send, or email info@geccohq.com. We action opt-outs without undue delay and in any event within 30 days.

We may still send you service messages after you opt out of marketing. That covers things like billing notices, changes to the Contract, security notices and delivery updates. Those are necessary to run your account and are not marketing.

16. Cookies

We use cookies and similar technologies such as pixels and tags. We ask for your consent to non-essential cookies through a Cookiebot banner, which keeps a record of your choice.

Full details of every cookie we use and how to change your preferences are in our Cookie Policy at https://www.geccohq.com/cookies-policy.

You can opt out of Google Analytics across all sites using the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

Most browsers offer a Do Not Track setting. There is still no agreed standard for how websites should respond to it, so we do not currently act on Do Not Track signals. If a standard is adopted that applies to us, we will follow it and update this notice.

17. Children

gecco sells to businesses. The Site and the Services are not directed at children and we do not knowingly collect personal data about anyone under 18.

If you believe a child has given us personal data, email info@geccohq.com and we will delete it.

18. Other websites

The Site links to other websites, including our providers, client case studies and social media. We are not responsible for how those sites handle personal data. Read their privacy notices before you give them anything.

19. Changes to this notice

We review this notice at least once a year, and whenever we change a supplier, add a sub-processor or change what we do with personal data.

When we update it, we change the version number and the "Last updated" date at the top. Where a change materially affects you, we will post a notice on the Site and, for Clients, tell you by email. Sub-processor changes are notified to Clients under the NDA/DPA, not through this notice.

Version history

We keep a full record of changes and will share it with a Client on request.

20. Contact us

Questions about this notice, requests to exercise your rights, and requests for a copy of a transfer safeguard all go to the addresses below.

Email: info@geccohq.com, or support@geccohq.com if you are a Client
Post: Data Protection, gecco Ltd, 27 Old Gloucester Street, London, WC1N 3AX

gecco Ltd. Company number 15748830. ICO registration ZC094719.