Privacy Policy – Gaiasuite

1. Who We Are

Gaiasuite serves as the data controller for personal information processing, with local representatives or subprocessors appointed based on jurisdiction.

2. Personal Data We Collect

We limit collection to the data that is the minimum necessary to perform the functions you authorize.

2.1 Data You Provide

• Name and contact details
• Company information and role
• Account registration information
• Communication preferences
• Information submitted via forms

2.2 Data Collected Automatically

• IP address and approximate location
• Device and browser information
• Usage logs and interaction data
• Cookies and tracking technologies

2.3 Third-Party Integration Data

When connecting Gaiasuite to external platforms, data necessary for integration operation is processed. For order fulfillment, this includes end-customer personally identifiable information (PII) — such as the buyer’s name, shipping address, and contact details — retrieved from connected sales channels.

The connected seller acts as data controller; Gaiasuite functions solely as processor under data processing agreements. Processing enables seller operations exclusively—never for advertising, resale, or any purpose beyond the authorized function. We do not use PII to locate, track, or contact end customers for our own purposes. End customers should contact the seller directly regarding privacy rights.

3. How We Use Your Data

Processing supports:

• Platform provision, maintenance, and improvement
• Account authentication and access management
• Technical and customer support delivery
• Platform reliability, monitoring, and security
• Analytics and performance insights
• Legal, regulatory, and contractual compliance

Personal data is never sold. Automated decision-making requires human involvement. We access and use data only to the extent necessary to provide the requested service.

4. Legal Bases for Processing

Processing relies on:

• Contractual necessity
• Legitimate interest
• Consent
• Legal obligation

5. Sharing and Disclosure

Data is shared only with:

• Trusted subprocessors providing hosting, analytics, security, or infrastructure
• Third-party platforms chosen for integration
• Regulatory or governmental authorities when legally required

All partners maintain strict contractual data protection obligations. Connected sales channel data is used exclusively for requested services, never shared beyond listed parties, and protected per channel requirements. We do not sell, rent, or disclose end-customer data to unauthorized third parties, and we do not share it for advertising purposes.

6. International Data Transfers

Global operations may process data outside your region, ensuring compliance through:

• Standard Contractual Clauses
• Adequacy decisions
• Technical and organizational safeguards
• Data Transfer Impact Assessments

7. Data Storage and Security

Personal data is stored on secure, access-controlled infrastructure hosted by vetted providers. Our safeguards include:

• Encryption at rest using AES-256 and encryption in transit using TLS 1.2 or higher
• Multi-factor authentication on our cloud infrastructure accounts, role-based access, and least-privilege controls that restrict data access to authorized personnel only
• Logical separation of integration and end-customer data, with clear attribution of data origin
• Continuous infrastructure monitoring and logging
• Regular dependency vulnerability checks, annual penetration testing, and secure software development practices
• Confidentiality obligations imposed on all employees and subprocessors handling personal data
• An incident response process to detect, investigate, and notify affected parties of security incidents in accordance with applicable law and platform requirements

8. Data Retention and Deletion

Data retention follows necessity principles with subsequent secure deletion or anonymization:

• Account and user data: Retained during the customer relationship; deleted post-closure except where legally required
• End-customer order data (PII): Retained for the periods defined in our record of processing activities, then deleted or anonymized. Data from connected platforms with stricter requirements follows those requirements: for Amazon, PII is automatically deleted 30 days after the last update of the order.
• Deletion on request or revocation: Upon request from a connected platform (including Amazon), upon revocation of authorization, or upon termination of the integration, we permanently and securely delete all associated Information within 30 days, using industry-standard sanitization processes, except where retention is required by law

Deleted data is permanently removed from our primary systems, and expires from backups within 8 days. Technical logs, which may contain personal data, are retained for 1 year for security purposes.

9. Your Rights

Depending on jurisdiction, rights may include:

• Data access
• Information correction
• Data deletion
• Processing restriction or objection
• Data portability
• Consent withdrawal
• Marketing opt-out
• Supervisory authority complaint filing

Exercise rights by contacting: dpo@gaiasuite.com

10. AI assistant integrations (MCP)

Gaiasuite offers an app for AI assistants, a remote MCP (Model Context Protocol) server, that lets users connect assistants such as ChatGPT, Claude and Gemini to their company’s Gaiasuite data. The app is read-only: it does not create, change or delete company data.

10.1 Who Can Use It

Only users of a Gaiasuite client company, after signing in with their Gaiasuite account and connecting an assistant of their choice. Each user accesses only the data of their own company, with the same permissions and two-factor authentication rules as the Gaiasuite back office.

10.2 Data Sent to the Assistant

When a user asks a question, the app returns the data needed to answer it to that user’s assistant. Depending on the question, this can include:

• The company’s catalogue, stock, sales and revenue, returns, invoices and credit notes
• End-customer order data, such as names, contact details and delivery addresses, when the user asks about orders, customers or returns

For end-customer data, the client company remains the data controller and Gaiasuite acts as processor, as described in section 2.3.

10.3 Recipients

The data is processed by the assistant provider chosen by the user or their company (for example OpenAI, Anthropic or Google), under that provider’s own terms and privacy policy. Gaiasuite does not control how the provider processes it.

10.4 What Gaiasuite Logs

For each request, we log the tool called, its parameters, the company and user, whether it succeeded and how long it took, together with standard request logs. We use these logs to run, secure and support the service. Retention: to confirm.

10.5 What Gaiasuite Does Not Access

The app does not access the user’s conversations, files or assistant account.

10.6 Controls

• A user can disconnect the app at any time from their assistant’s connector settings
• Changing the Gaiasuite password ends every assistant session at once
• When a company administrator blocks or removes a user in the Gaiasuite back office, that user’s assistant access ends

10.7 Contact

To exercise your rights regarding this processing: dpo@gaiasuite.com

11. Cookies

Gaiasuite uses cookies for essential functions, performance improvement, and analytics. A separate Cookie Policy is available.

12. Changes to This Policy

Updates appear here with modified “Last Updated” dates.

13. Contact

For privacy policy or data processing questions: dpo@gaiasuite.com