gecco legal
These are the suppliers who may process personal data that gecco handles on behalf of a client, where the client is the data controller and gecco is the processor. This is the list referred to in the Mutual NDA and Data Processing Agreement.
These are gecco's Sub-processors for the processing described as Flow B in Schedule 1 of the Mutual Non-Disclosure and Data Processing Agreement. They are not your Platform Providers, and they are not the website and marketing service providers gecco lists separately in the Privacy Policy for its own controller processing.
This list and Schedule 2 of the Mutual Non-Disclosure and Data Processing Agreement are generated from the same source and are intended to be identical. If they differ, this list prevails, as clause 14.2 of that agreement provides, and clauses 14.3 to 14.7 govern how it changes.
| Provider | Purpose | Processing location, as notified by the provider | Transfer basis |
|---|---|---|---|
| Microsoft Limited, a United Kingdom company, Microsoft Campus, Thames Valley Park, Reading, Berkshire RG6 1WG, VAT GB724594615 | gecco's own Microsoft 365 tenant. SharePoint client folders, Teams client sessions and their recordings and transcripts, OneDrive, email, and Microsoft Forms feedback surveys | United Kingdom for Exchange Online, Microsoft Teams, OneDrive and SharePoint. Microsoft does not publish a location for Microsoft Forms | Covered by UK adequacy regulations. No Article 46 safeguard is required. |
| Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland | Google Workspace. Email, calendar and document collaboration used to run your engagement, and the gecco shared drives holding client contract records | Europe, where gecco's data region is set to Europe. The policy covers certain core services | Covered by UK adequacy regulations for the EEA. The contracting entity is in Ireland rather than the United States. The data region policy covers certain core services only, so logs and cached content sit outside it and gecco records that rather than estimating a location for them. |
| Google Cloud EMEA Limited, in respect of Google Meet | Recording of client kick-off, scoping, onboarding, advisory and showcase sessions held on Google Meet, and the "Notes by Gemini" document Meet writes of the session whether or not it is recorded. Saved to the meeting organiser's personal My Drive | Europe, where gecco's data region is set to Europe | Covered by UK adequacy regulations for the EEA. The contracting entity is in Ireland rather than the United States |
| GitHub, Inc. | Private repositories holding client delivery material and session transcripts, synchronised between gecco devices | United States. No UK region is offered for this service | Article 46 safeguard, being the EU standard contractual clauses with the UK International Data Transfer Addendum issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, incorporated by the provider's data processing agreement. |
| Applications installed on gecco's GitHub organisation | Third-party applications connected to gecco's repositories, which hold client session transcripts, pain-point registers and delivery material. They are Claude and Claude Design Import, published by Anthropic; ChatGPT Codex Connector, published by OpenAI; Netlify, published by Netlify; Supabase; and one application installed for a client's own project | Each provider's own infrastructure. For the Anthropic, OpenAI and Netlify applications, as stated in those providers' entries | The Anthropic, OpenAI and Netlify entries in this table apply to their applications. gecco does not currently use Supabase or the client project's application to process client personal data, so no separate transfer basis is recorded for them |
| Anthropic Ireland, Limited | gecco's own Claude Teams workspace, used to analyse session transcripts and produce delivery documents. Also reached through the Anthropic API from gecco's own automations, for analysis of client session transcripts, extraction of actions and pain points, drafting of client-facing session emails and delivery documents, processing of the files a Client uploads to gecco, evaluation and enrichment of generated documents, session preparation briefs, and mapping of imported lead lists | United States. No UK or EU storage option is offered for this service | Article 46 safeguard, being the EU standard contractual clauses with the UK International Data Transfer Addendum issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, incorporated by the provider's data processing agreement. |
| Wispr AI, Inc., trading as Wispr Flow | Recording and transcription of client sessions through Wispr Flow Notetaker, and dictation through Wispr Flow Dictation, on gecco's own Teams plan. When Notetaker is connected, it also reads the calendar, contacts and directory of the gecco Google account that connects it, to identify meetings and participants | United States, as the provider's privacy policy states | Article 46 safeguard, being the EU standard contractual clauses with the UK International Data Transfer Addendum, incorporated by the provider's data processing addendum, which applies when personal data is sent through the service |
| OpenAI OpCo, LLC, a Delaware company, company number 7063675 | gecco's own ChatGPT Business workspace, used to design, prototype and test AI Solutions where ChatGPT is the Platform for your engagement. Also gecco's own account reached through the API from gecco's own automations, for service order generation and document drafting. The sales pipeline and post-meeting processing uses are prospect data where gecco is the controller and are listed in the Privacy Policy's Articles 13 and 14 table | United States by default. The provider offers a United Kingdom option at gb.api.openai.com for storage only, with no regional processing, which must be configured per project. That option is for the API. Data residency is not available on ChatGPT Business | Article 46 safeguard, being the EU standard contractual clauses as amended by the UK International Data Transfer Addendum issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, incorporated by the provider's data processing agreement. No Data Privacy Framework certification. API data is not used for model training by default. |
| Google LLC, in respect of the Gemini API | Research and drafting within gecco's own automations, including the core documents pipeline. A different service from Google Workspace above | Any country in which Google or its agents maintain facilities, as the provider's Gemini API terms state | Covered by UK adequacy regulations under the UK Extension to the EU-US Data Privacy Framework. The provider holds a current certification under that framework. |
| Zoho Corporation Limited, registered in England and Wales, company number 13424508 | Client relationship management and client communications used to run your engagement. Client personal data sits in Zoho CRM; in Zoho Sign, which holds signed service orders and the names of the people who signed them; in Zoho Campaigns, which holds the client contact subscribed to the onboarding mailing list; and in Zoho Forms. gecco's own task management may incidentally carry the name of a client contact, and holds no client files or client contact records | Netherlands, with Ireland as secondary. The provider states that support staff in India may access data where gecco grants support access | Covered by UK adequacy regulations for the storage locations. Where support access is granted, the provider's own transfer terms apply. gecco has a United Kingdom data processing addendum with the provider |
| n8n GmbH | Workflow automation used to run the pipelines we build and operate for you | Germany and Sweden | Covered by UK adequacy regulations. No Article 46 safeguard is required. |
| Calendly LLC | Scheduling of onboarding, training and delivery sessions with your staff, including any free text your staff type into the booking questions, and the email addresses of additional guests added to a booking | United States | Covered by UK adequacy regulations under the UK Extension to the EU-US Data Privacy Framework. The provider holds a current certification under that framework. |
| Netlify, Inc. | Hosting of gecco's internal delivery site, whose published walkthroughs carry client staff names and the text of client deliverables | United States | Covered by UK adequacy regulations under the UK Extension to the EU-US Data Privacy Framework. The provider holds a current certification under that framework. |
| Lunaweb GmbH, Grünwald, Germany, trading as CloudConvert | Conversion of service order and contract documents to PDF. The whole rendered document, including signatory and contact details, is sent to the provider | Germany or the United States, the provider's two processing regions, as its API documentation states | Covered by UK adequacy regulations for the contracting entity, Lunaweb GmbH, in Germany. gecco and the provider have signed a data processing agreement that covers the UK GDPR. |
Perplexity is not listed here. gecco uses Perplexity only for marketing research from public sources, and no client personal data reaches it. It appears in the list of gecco's own processors in the Privacy Policy.
How to read the location column. Each location is either the one the provider publishes or the one set in gecco's own account. Where a provider publishes no location, the cell says so rather than estimating one. gecco keeps the record of where each entry came from and will show it to a Client on request.
Processing locations are as notified to gecco by each Sub-processor at the date shown above. gecco does not warrant that a Sub-processor's location or practices will stay the same. You can confirm the current position with the Sub-processor directly. gecco will notify you of any change under clause 14.3.
Before adding or replacing a Sub-processor, gecco will give you at least 30 days' written notice. The notice will name the Sub-processor, describe what it will process and why, and state where it will process the data.
You may object to a proposed Sub-processor within 14 days of the notice, on reasonable grounds relating to data protection. You must give your grounds in writing.
Clauses 14.5 to 14.7 of the Mutual Non-Disclosure and Data Processing Agreement set out what happens if you object, and when gecco may replace a Sub-processor urgently with shorter notice.
gecco Ltd. Company number 15748830. Registered with the Information Commissioner's Office, registration ZC094719. 27 Old Gloucester Street, London, WC1N 3AX. Data protection questions: info@geccohq.com