Privacy Policy

1. Who We Are

Global Group Intelligence Technologies Ltd ("GGIT," "we," "us," or "our") is a company registered in England and Wales under company number 17355071, with its registered office at 41 Rowan Court, Peter Street, Folkestone, England, CT20 1JE.

GGIT provides AI integration consulting, AI voice and chat agents (including our GiGi product), and related software and marketplace services to businesses and their customers.

Contact us:

• General enquiries: info@ggit.ai
• Privacy enquiries / Data Protection contact: privacy@ggit.ai

We are the controller of personal data we collect directly (for example, through our website or as part of our own client relationships), and in many cases we act as a processor on behalf of our clients when we deliver AI voice agents, chatbots, or related services that process our clients' customers' personal data. Section 10 explains this distinction in more detail.

2. Scope of This Policy

This policy applies to personal data processed through:

• The ggit.ai website and any related GGIT-operated domains (including ggit.world, ggit.store, and ggit.shop where applicable);
• Our AI voice agent and chatbot products, including GiGi;
• Our direct communications with prospective and existing clients, partners, and suppliers;
• Our billing and payment processes.

It does not apply to third-party websites or services we link to, which have their own privacy policies.

3. What Personal Data We Collect

Depending on how you interact with us, we may collect:

We do not knowingly collect special category data (e.g., health, biometric, or other sensitive data) through general use of our website or products, unless a specific client use case requires it under a documented lawful basis and contract.

4. How We Use Personal Data and Our Lawful Bases

Where we rely on legitimate interests, we have considered that these interests are not overridden by your rights and freedoms.

5. AI Systems, Automated Processing, and Training

GGIT's core products involve AI voice agents and chatbots. We take the following approach:

• No default training on client/customer data. Personal data belonging to our clients or their customers is not used to train general-purpose AI models by default. We use such data only to deliver the contracted AI service, ensure security, troubleshoot issues, and improve the specific service delivered — subject to the applicable lawful basis and any contractual terms agreed with the relevant client.
• Third-party AI providers. To deliver our services, we may process data using infrastructure or models from providers such as OpenAI, Anthropic, Google, Microsoft Azure, ElevenLabs, and other equivalent AI or cloud providers. These providers act as our subprocessors and are bound by data processing terms consistent with UK GDPR requirements.
• Automated decision-making. Our AI agents may generate responses, summaries, or recommendations automatically. Where any processing could produce a legal or similarly significant effect on an individual without human involvement, we provide for human oversight and a route to request human review. We do not currently carry out fully automated decision-making that produces such effects without the option of human review.
• Your rights in relation to AI processing. You may request information about how your personal data is used in our AI systems, object to certain processing, and request human review of decisions materially affecting you, as further described in Section 11.

6. AI Voice Agents — Specific Provisions

Where you interact with a GGIT AI voice agent (such as GiGi) on behalf of us or one of our clients:

• AI disclosure: The system will identify itself as an AI, not a human, at the outset of the interaction.
• Recording: Calls are recorded only when necessary for the purpose of the service and where appropriately disclosed to you at the start of the call.
• Transcription: Call recordings may be transcribed, and summaries may be generated, to support service delivery, quality assurance, and troubleshooting.
• Retention periods:
  • Voice recordings: retained for 30 days
  • Transcripts: retained for 90 days
  • AI-generated summaries: retained for 90 days
• After these periods, the relevant data is deleted or irreversibly anonymised, unless a longer period is required by law, requested by the relevant client under a signed agreement, or necessary to resolve an active dispute or complaint.

7. Who We Share Personal Data With

We may share personal data with:

• Subprocessors and service providers, including AI model and cloud infrastructure providers (e.g., OpenAI, Anthropic, Google, Microsoft Azure, ElevenLabs), hosting providers, and analytics providers, strictly to the extent needed to deliver our services.
• Payment processors, Stripe and Wise, to process transactions.
• Our clients, where GGIT is processing data on their behalf as a processor (see Section 10) — for example, providing a client with call transcripts relating to their own customers.
• Professional advisers and regulators, where necessary for legal, accounting, or compliance purposes.
• Successors in a business transaction, such as a merger, acquisition, or asset sale, subject to equivalent protections for your data.

We do not sell personal data.

8. International Data Transfers

GGIT and its subprocessors operate internationally, and personal data may be transferred outside the UK, including to the EU, the USA, and Switzerland.

Where we make a restricted transfer of personal data outside the UK, we rely on appropriate safeguards recognised under the current ICO framework, which may include:

• The UK International Data Transfer Agreement (IDTA), or
• The UK Addendum to the EU Standard Contractual Clauses,

together with a transfer risk assessment (data protection test), as appropriate to the destination and receiving party, consistent with the ICO's international transfer guidance.

Where a transfer is made to a country not covered by a current UK adequacy regulation, we take steps to ensure the safeguards above are in place before the transfer occurs.

9. Cookies and Analytics

Our website may use cookies and similar technologies for:

• Essential functionality (no consent required)
• Analytics (to understand website usage)
• Marketing/tracking (where applicable)

Where analytics or marketing cookies are used, we obtain your consent through a cookie banner before non-essential cookies are set, and you can withdraw consent at any time via your cookie preferences or browser settings. A separate Cookie Notice, available on our website, sets out the specific cookies in use and their purposes and durations.

10. Controller and Processor Roles

Depending on the service:

• As controller: When you contact GGIT directly, visit our website, or engage us as a client, we determine the purposes and means of processing and act as controller.
• As processor: When we deliver AI voice agents, chatbots, or related services on behalf of a client, we typically process that client's customers' personal data on the client's instructions, under a Data Processing Agreement (DPA). In these cases, our client is the controller, and individuals should also refer to that client's own privacy notice. GGIT processes such data only as instructed, subject to confidentiality, security, and subprocessor obligations set out in the relevant DPA.

Client DPAs are available on request and set out subprocessor arrangements, security measures, and international transfer mechanisms applicable to that client relationship.

11. Your Rights

Subject to applicable law (UK GDPR, EU GDPR, and/or applicable US state privacy laws), you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data
• Restrict or object to certain processing, including processing based on legitimate interests
• Request data portability
• Withdraw consent at any time, where processing is based on consent
• Request human review of, or object to, decisions based solely on automated processing that significantly affect you
• Lodge a complaint with a supervisory authority

To exercise these rights, contact us at privacy@ggit.ai. We will respond within the timeframes required by applicable law.

UK/EU complaints: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local EU supervisory authority if you are located in the EU.

US residents: Depending on your state of residence, you may have additional rights under applicable US state privacy laws (such as the right to know, delete, correct, or opt out of certain processing or "sale/sharing" of personal data, where applicable). GGIT does not sell personal data. Requests can be submitted to privacy@ggit.ai.

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, including to satisfy legal, accounting, or reporting requirements. Specific retention periods for AI voice/chat data are set out in Section 6. Other data (e.g., account and billing records) is retained in line with our internal retention schedule and applicable legal requirements, after which it is deleted or anonymised.

13. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encryption in transit, and contractual security obligations on our subprocessors. No system is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach that poses a risk to individuals, we will notify affected individuals and/or the relevant supervisory authority as required by applicable law.

14. Children's Privacy

Our services are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@ggit.ai and we will take appropriate steps to remove it.

15. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The "Last updated" date at the top of this policy indicates when it was last revised. Material changes will be highlighted on our website.