GDPR & Data Protection Policy.

At GN128 Solutions, responsible use of information is fundamental to the technology we build.

We develop solution-based applications for organisations and design, build and integrate Artificial Intelligence (“AI”) Agents into existing and new business processes.

Our systems may interact with customer information, employee information, business records, CRM platforms, communications systems, databases, applications and other digital services.

We therefore recognise that protecting personal data is not simply a legal requirement. It is an essential part of building trustworthy technology.

GN128 Solutions (“GN128”, “we”, “us” or “our”) is committed to processing personal data lawfully, fairly, transparently and securely.

This GDPR & Data Protection Policy explains our approach to compliance with applicable data-protection laws, including, where relevant:

• the UK General Data Protection Regulation (“UK GDPR”);
• the Data Protection Act 2018;
• applicable amendments to UK data-protection legislation;
• the EU General Data Protection Regulation (“EU GDPR”) where applicable;
• applicable privacy and data-protection laws in the United States;
• the Nigeria Data Protection Act 2023 and associated requirements;
• and other applicable privacy and data-protection legislation.

GN128 operates or intends to operate in:

• United Kingdom
• United States of America
• Nigeria

The legal requirements that apply to personal data may therefore depend on:

• where the individual is located;
• where GN128 or the relevant client is established;
• where processing takes place;
• the services being provided;
• and the applicable data-protection legislation.

The UK GDPR applies to relevant processing carried out in the United Kingdom and may also apply in certain circumstances to organisations outside the UK that offer goods or services to, or monitor the behaviour of, individuals in the UK.

The EU GDPR may similarly apply where GN128 offers relevant goods or services to, or monitors individuals located within the European Economic Area.

GDPR does not automatically govern every processing activity undertaken in the United States or Nigeria. Appropriate local privacy legislation will also be considered.

GN128 may act either as a Data Controller or a Data Processor, depending on the circumstances.

When GN128 Acts as a Data Controller

GN128 acts as a Data Controller when we determine the purposes and means of processing personal data.

This may include information relating to:

• visitors to our website;
• prospective customers;
• GN128 customers;
• suppliers;
• contractors;
• employees;
• job applicants;
• business contacts;
• partners;
• users of GN128-owned services;
• and individuals who communicate directly with GN128.

When GN128 Acts as a Data Processor

GN128 may act as a Data Processor where a customer uses a GN128 application, integration, AI Agent or other service to process personal data under that customer's instructions.

For example, GN128 may process information contained within:

• a client's CRM;
• customer conversations;
• support requests;
• orders;
• bookings;
• enquiries;
• sales opportunities;
• employee workflows;
• or other business systems.

In these circumstances, the customer will generally remain the Data Controller and GN128 will process information according to the customer's documented instructions and applicable contractual arrangements.

Where GDPR applies, GN128 seeks to process personal data in accordance with the applicable data-protection principles.

Lawfulness, Fairness and Transparency

We will seek to ensure that personal data is processed on an appropriate lawful basis and in a way that is fair and transparent to the individuals concerned.

Purpose Limitation

Personal data should be collected for specified, explicit and legitimate purposes and should not subsequently be used incompatibly with those purposes.

Data Minimisation

We seek to collect and process only the personal data reasonably necessary for the intended purpose.

Accuracy

We take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.

Storage Limitation

Personal data should not be retained for longer than reasonably necessary for the relevant purpose, subject to legal, contractual and operational requirements.

Integrity and Confidentiality

We seek to protect personal data using appropriate technical and organisational measures.

Accountability

GN128 accepts responsibility for demonstrating appropriate data-protection compliance where required.

Where the UK GDPR or EU GDPR applies, GN128 will identify an appropriate lawful basis before processing personal data.

Depending on the processing activity, this may include:

Contract

Processing may be necessary to enter into or perform a contract.

Examples include:

• providing contracted services;
• maintaining customer accounts;
• delivering software;
• managing subscriptions;
• processing service requests;
• or carrying out steps requested before entering into a contract.

Consent

We may rely upon freely given, specific, informed and unambiguous consent where appropriate.

Where processing relies upon consent, individuals may withdraw that consent in accordance with applicable law.

Legitimate Interests

GN128 may process personal data where this is necessary for our legitimate interests or those of a third party, provided the applicable requirements are satisfied.

Possible legitimate interests may include:

• operating and improving our services;
• maintaining network and information security;
• preventing fraud;
• managing business relationships;
• improving customer service;
• protecting our legal interests;
• and appropriate business administration.

Where required, we will consider the impact of such processing on individuals' rights and freedoms.

Legal Obligation

Personal data may be processed where necessary to comply with a legal or regulatory requirement.

Vital Interests

In exceptional circumstances, processing may be necessary to protect an individual's vital interests.

Public Task or Other Applicable Legal Grounds

Where relevant, another lawful ground recognised under applicable legislation may apply.

Certain types of personal data may receive additional protection under GDPR.

These may include information relating to:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic data;
• biometric data used for identification;
• health;
• sex life;
• and sexual orientation.

GN128 does not seek to collect special category information unless it is reasonably necessary for an authorised purpose.

Where such information is processed, an appropriate lawful basis and additional legal condition will be identified where required.

Additional technical and organisational safeguards may also be implemented.

Where criminal offence information is processed, GN128 will seek to ensure that an appropriate legal basis and any additional safeguards required by applicable law are in place.

GN128 will not intentionally collect such information without a legitimate and lawful purpose.

Artificial intelligence is a central component of some GN128 solutions.

We believe AI systems must be designed with data protection in mind.

Where an AI Agent processes personal data, GN128 will seek to identify:

• what information the AI requires;
• why it requires that information;
• the lawful basis for processing;
• where the information comes from;
• which systems the AI can access;
• what actions the AI is authorised to perform;
• whether information is shared with an AI provider;
• how long relevant information is retained;
• and whether human intervention is required.

An AI system should not have access to personal information simply because that information exists within an organisation.

Access should be proportionate to the AI Agent's authorised purpose.

GN128 may build AI Agents capable of interacting with authorised business systems including:

• CRM systems;
• databases;
• order-management systems;
• payment systems;
• accounting platforms;
• email;
• WhatsApp and other communications platforms;
• calendars;
• customer-support systems;
• document-management systems;
• and internal applications.

For example, an authorised AI Agent may be able to:

• retrieve customer information;
• create a CRM record;
• qualify a sales lead;
• check an order;
• schedule an appointment;
• prepare a quotation;
• summarise a conversation;
• update a support ticket;
• or trigger another authorised business process.

The level of access provided to an AI Agent should be based on business need, security considerations and applicable data-protection requirements.

GN128 recognises the importance of appropriate human oversight where automated systems are used.

Where applicable, we assess whether an AI or automated system makes decisions about individuals without meaningful human involvement and whether those decisions could have legal or similarly significant effects.

Depending on the circumstances and applicable legislation, safeguards may include:

• informing individuals that automated processing is taking place;
• explaining relevant factors involved in the decision;
• enabling an individual to request human intervention;
• allowing an individual to express their point of view;
• providing a means of challenging an automated decision;
• monitoring the system for errors;
• testing for inappropriate bias;
• and reviewing system performance.

GN128 may restrict certain actions so that they require human authorisation.

These may include, depending on the application:

• significant financial decisions;
• material refunds;
• legal or contractual decisions;
• exceptional discounts;
• account suspension;
• high-value transactions;
• employment decisions;
• and other decisions carrying significant consequences.

Where a proposed processing activity is likely to present a high risk to individuals' rights and freedoms, GN128 will consider whether a Data Protection Impact Assessment (“DPIA”) is required.

A DPIA may be particularly relevant where a project involves:

• significant use of artificial intelligence;
• systematic monitoring;
• large-scale processing;
• special category data;
• new or unfamiliar technologies;
• profiling;
• automated decision-making;
• biometric technology;
• extensive behavioural analysis;
• or combining information from multiple sources.

A DPIA may consider:

1. the proposed processing;
2. its purpose;
3. the necessity and proportionality of the processing;
4. risks to individuals;
5. security measures;
6. organisational safeguards;
7. human oversight;
8. data retention;
9. third-party processors;
10. and steps required to reduce identified risks.

Privacy should be considered when a solution is designed, not after it has been deployed.

GN128 seeks to apply Privacy by Design and Privacy by Default principles to relevant projects.

When designing applications, integrations and AI Agents, we may consider:

• whether each category of personal data is actually required;
• who should have access;
• what permissions should apply;
• whether information can be pseudonymised;
• appropriate encryption;
• retention requirements;
• audit logging;
• security controls;
• user access management;
• third-party integrations;
• and whether the same objective can be achieved using less personal information.

Default settings should, where appropriate, favour appropriate protection of personal data.

AI systems can potentially process large quantities of information.

This does not mean that they should.

GN128 seeks to apply data-minimisation principles to AI by considering:

What information does the Agent actually need to complete this task?

An AI Agent intended only to schedule appointments, for example, should not automatically receive unrestricted access to a customer's entire CRM record if that information is unnecessary.

Where technically and operationally appropriate, access should be restricted by:

• function;
• purpose;
• user role;
• data category;
• system;
• and authorised action.

The use of personal data for AI model development or training requires separate consideration from the use of an AI model to perform an operational task.

GN128 will not assume that personal data supplied by customers may automatically be used to train general-purpose AI models.

Where personal data is proposed to be used for:

• AI training;
• fine-tuning;
• evaluation;
• model improvement;
• or similar purposes,

GN128 will assess the relevant legal basis, contractual arrangements, transparency requirements, data-protection risks and provider terms.

Where GN128 acts as a Data Processor, client information will be processed in accordance with the client's authorised instructions and contractual arrangements.

GN128 may integrate technology supplied by third-party AI providers.

Before using such services for relevant processing, we may assess matters including:

• data-processing terms;
• information retention;
• location of processing;
• security arrangements;
• subprocessor arrangements;
• use of submitted information for model training;
• international transfers;
• confidentiality;
• and mechanisms for deletion.

The particular providers used may vary depending on the GN128 solution and customer requirements.

Depending on the service, GN128 may process categories of personal data including:

• names;
• email addresses;
• telephone numbers;
• business contact details;
• job titles;
• organisation information;
• usernames;
• customer numbers;
• CRM records;
• account information;
• service history;
• communications;
• support tickets;
• orders;
• bookings;
• quotations;
• transaction information;
• IP addresses;
• device information;
• system logs;
• authentication information;
• marketing preferences;
• website activity;
• and information voluntarily provided to applications or AI Agents.

The precise categories depend upon the relevant service.

GN128's primary business services are intended for organisations rather than children.

We do not knowingly seek to collect children's personal data unless the service concerned is specifically intended to process such information and appropriate legal safeguards have been established.

Where a GN128 client uses our systems in connection with children, the client and GN128 will need to consider the enhanced privacy protections that may apply.

Where GDPR applies, individuals may have a number of rights concerning their personal data.

The precise rights available depend upon the circumstances and lawful basis for processing.

Right to Be Informed

Individuals have the right to receive appropriate information about the collection and use of their personal data.

Right of Access

Individuals may request confirmation of whether their personal data is being processed and obtain access to relevant information.

This is commonly known as a Subject Access Request.

Right to Rectification

Individuals may request correction of inaccurate personal data and completion of incomplete information.

Right to Erasure

In applicable circumstances, individuals may request deletion of their personal information.

This is sometimes referred to as the right to be forgotten.

This right is not absolute.

GN128 may need to retain certain information where there is a legal, contractual or other lawful reason for doing so.

Right to Restrict Processing

Individuals may request restriction of processing in certain circumstances.

Right to Data Portability

Where applicable, individuals may request eligible personal data in a structured, commonly used and machine-readable format and may have the right to transmit that information to another organisation.

Right to Object

Individuals may have the right to object to particular processing activities.

This may include processing based upon certain legitimate interests or direct marketing.

Rights Relating to Automated Decisions

Applicable law may provide rights relating to decisions based on automated processing.

Depending upon the jurisdiction and circumstances, individuals may have rights relating to:

• information about the processing;
• human intervention;
• making representations;
• and challenging a decision.

Right to Withdraw Consent

Where processing is based on consent, consent may be withdrawn.

Withdrawal does not ordinarily affect the lawfulness of processing undertaken before consent was withdrawn.

GN128 will maintain appropriate procedures for handling valid requests concerning personal data.

Before releasing, changing or deleting personal information, GN128 may take reasonable steps to verify the identity of the person making the request.

This helps protect individuals from unauthorised access.

Where GN128 acts as a Data Processor, requests relating to client-controlled data may be referred to the relevant client, with GN128 providing reasonable assistance where required.

We will seek to respond within the time period required by applicable law.

GN128 seeks to maintain accurate information where accuracy is necessary for the purpose of processing.

We encourage individuals and clients to notify us when information we hold is inaccurate or outdated.

Where appropriate, systems may also allow authorised users to update information directly.

GN128 will not retain personal information indefinitely simply because storage is technically available.

Retention periods may vary depending on:

• the purpose of processing;
• contractual requirements;
• applicable law;
• regulatory requirements;
• tax and accounting requirements;
• security requirements;
• dispute-resolution needs;
• and legitimate business requirements.

GN128 may establish specific retention schedules for different categories of information.

When personal information is no longer reasonably required, it may be:

• securely deleted;
• anonymised;
• or otherwise disposed of appropriately.

GN128 seeks to implement technical and organisational measures proportionate to the risks associated with the processing.

Depending on the system, these may include:

• encryption;
• secure communications;
• access controls;
• multi-factor authentication;
• role-based permissions;
• secure software-development practices;
• vulnerability management;
• backups;
• monitoring;
• network security;
• audit trails;
• logging;
• password controls;
• incident detection;
• employee training;
• and confidentiality obligations.

No information system can provide an absolute guarantee against every security risk.

However, GN128 seeks to maintain appropriate controls and continuously improve its security practices.

Access to personal information should be based on legitimate business need.

GN128 seeks to apply principles such as:

Least Privilege

Users should receive only the level of access reasonably required to perform their duties.

Role-Based Access

Permissions may be assigned according to defined responsibilities.

Authentication

Appropriate verification should be required before users access sensitive systems.

Auditability

Where appropriate, actions involving sensitive data may be logged.

The same principles apply to AI Agents.

An AI Agent should receive only those system permissions necessary to perform its authorised functions.

GN128 maintains processes intended to identify and respond to suspected personal-data breaches.

Where an incident occurs, we may:

1. investigate the incident;
2. take steps to contain it;
3. determine what information is affected;
4. assess risks to individuals;
5. preserve appropriate evidence;
6. take corrective measures;
7. notify relevant clients;
8. and make regulatory or individual notifications where required by applicable law.

GN128 will seek to meet applicable legal notification deadlines where notification is required.

Because GN128 operates across the United Kingdom, United States and Nigeria and may use international cloud and technology providers, personal data may sometimes be transferred between countries.

International transfers require careful assessment.

Where UK GDPR transfer restrictions apply, GN128 will seek to ensure an appropriate transfer mechanism is available.

Depending on the destination and circumstances, mechanisms may include:

• adequacy regulations;
• the UK International Data Transfer Agreement;
• an appropriate UK Addendum to recognised contractual clauses;
• binding corporate rules where applicable;
• permitted statutory exceptions;
• or another lawful mechanism.

GN128 may also conduct appropriate transfer-risk assessments where required.

A GN128 service might, for example, involve:

• a UK customer
• a GN128 application
• cloud infrastructure located in the United States
• support or authorised personnel in Nigeria

Such arrangements may constitute international transfers under applicable law.

Before implementing relevant processing, GN128 will seek to identify:

• where information originates;
• where it is stored;
• where it can be accessed;
• which organisation receives it;
• applicable transfer restrictions;
• and appropriate safeguards.

The mere fact that a service is accessible through the internet does not remove these obligations.

Where GN128 processes personal data on behalf of a client, appropriate contractual terms will be used where required.

These may take the form of a Data Processing Agreement (“DPA”) or data-processing provisions within another commercial agreement.

A DPA may address:

• subject matter and duration of processing;
• nature and purpose;
• categories of personal data;
• categories of data subjects;
• documented client instructions;
• confidentiality;
• security;
• subprocessors;
• international transfers;
• assistance with individual rights;
• data breaches;
• audits;
• deletion or return of information;
• and termination.

GN128 may appoint third-party organisations to process information in support of our services.

Potential subprocessors may provide:

• cloud hosting;
• databases;
• artificial intelligence;
• communications;
• email;
• analytics;
• customer support;
• authentication;
• monitoring;
• payment processing;
• security;
• or other infrastructure.

Where GN128 acts as a Data Processor and GDPR requires it, subprocessors will be managed in accordance with applicable contractual and legal requirements.

Where required, GN128 will maintain appropriate records describing processing activities.

These records may include:

• purpose of processing;
• categories of individuals;
• categories of personal data;
• recipients;
• international transfers;
• retention;
• and security measures.

Maintaining these records helps GN128 understand where personal data exists and how it moves through our systems.

GN128 recognises that effective data protection begins with understanding information flows.

For relevant systems, we may document:

• Data Source
• GN128 Application
• AI / Processing Layer
• Connected Systems
• Storage
• Authorised Recipients
• Retention / Deletion

This helps us identify privacy, security and compliance requirements at each stage.

Where GN128 conducts direct marketing, we will seek to comply with applicable privacy and electronic-marketing requirements.

Where appropriate:

• consent will be obtained;
• individuals will be provided with an opt-out;
• marketing preferences will be recorded;
• objections will be respected;
• and suppression records may be maintained to ensure people who opt out are not inadvertently re-added.

Individuals have the right to object to processing of their personal data for direct marketing purposes where applicable.

GN128 websites may use cookies and similar technologies.

Where applicable, we will distinguish between:

• strictly necessary cookies;
• functional cookies;
• analytics cookies;
• and advertising or marketing cookies.

Where consent is legally required for non-essential technologies, users will be given an appropriate opportunity to make a choice.

Further information may be provided in GN128's separate Cookie Policy.

Where GN128 is legally required to appoint a Data Protection Officer (“DPO”), we will do so.

Where a formal DPO is not required, GN128 may designate an appropriate person or team responsible for coordinating privacy and data-protection matters.

Contact:

Data Protection / Privacy Contact
GN128 Solutions
Contact: Contact Us or Book a Call

People play an important role in data security.

GN128 will seek to provide appropriate privacy and security awareness to personnel whose responsibilities involve personal data.

Training may include:

• recognising personal information;
• handling personal information securely;
• access control;
• phishing and cybersecurity;
• identifying data breaches;
• responding to data-subject requests;
• responsible use of AI;
• and escalation procedures.

GN128's responsibility extends beyond protecting the information in our own corporate systems.

Privacy should form part of how we build technology for customers.

During relevant projects, we may ask:

• What personal information will this system process?
• Why is it required?
• What lawful basis does the client rely upon?
• Who will have access?
• Which third parties receive information?
• Does the AI genuinely need this information?
• Where will the information be stored?
• How long should it be retained?
• What happens if the information is incorrect?
• Can an individual exercise their rights?
• What happens if there is a security breach?
• Is a DPIA required?
• Does processing involve an international transfer?

Addressing these questions during development can reduce privacy risks later.

Where a customer is the Data Controller, that organisation remains responsible for its independent obligations under applicable data-protection legislation.

This may include responsibility for:

• establishing a lawful basis;
• providing appropriate privacy information;
• responding to individual rights requests;
• ensuring information supplied to GN128 was lawfully obtained;
• establishing appropriate retention periods;
• configuring user access;
• authorising AI capabilities;
• obtaining required consent;
• and complying with relevant marketing laws.

GN128's technology does not remove a client's responsibilities as a Data Controller.

For relevant UK processing, GN128 will seek to comply with applicable requirements of:

• the UK GDPR;
• the Data Protection Act 2018;
• applicable subsequent amendments;
• and relevant guidance issued by the Information Commissioner's Office (“ICO”).

Individuals may have the right to lodge a complaint with the ICO concerning the processing of their personal information.

We encourage individuals to contact GN128 first where appropriate so that we have an opportunity to investigate and resolve concerns.

Where the EU GDPR applies to GN128's activities, we will seek to comply with the requirements applicable to the relevant processing.

Where legislation requires GN128 to appoint an EU representative because of activities involving individuals located within the EEA, an appropriate representative will be appointed and relevant details made available.

The United States does not operate under one universal GDPR-equivalent privacy law applying identically to every organisation and processing activity.

Federal and state privacy requirements may apply depending upon:

• the state;
• type of personal information;
• industry;
• number of consumers;
• processing activity;
• and size or nature of the organisation.

GN128 will assess applicable US privacy requirements according to the services and jurisdictions involved.

Where specific US privacy rights apply, GN128 will seek to honour those requirements.

GN128 may provide additional regional notices where required.

GN128 also operates within the Nigerian data-protection framework.

Relevant processing will be assessed under the Nigeria Data Protection Act 2023, applicable regulations and guidance from the Nigeria Data Protection Commission (“NDPC”).

Where GN128 processes Nigerian personal data, we will seek to ensure that appropriate transparency, lawful processing, security, data-subject rights and international-transfer requirements are considered.

Additional Nigerian privacy information may be included in GN128's general Privacy Policy or other applicable notices.

Depending upon where individuals are located and which law applies, they may have the right to complain to an appropriate supervisory or regulatory authority.

Potential authorities may include:

United Kingdom

Information Commissioner's Office (ICO)

Nigeria

Nigeria Data Protection Commission (NDPC)

European Economic Area

The relevant national Data Protection Authority

United States

The relevant state or federal authority where applicable

GN128 aims to maintain a practical privacy-governance framework appropriate to our size, services and processing activities.

This may include:

• privacy policies;
• data inventories;
• records of processing;
• Data Processing Agreements;
• security controls;
• DPIAs;
• vendor assessments;
• international-transfer assessments;
• incident-response procedures;
• retention schedules;
• privacy training;
• and periodic reviews.

We recognise that data protection is an ongoing process rather than a one-time compliance exercise.

Data-protection laws, artificial intelligence, technology and GN128's services will continue to evolve.

We may therefore update this GDPR & Data Protection Policy periodically.

Where material changes are made, we may provide notice through:

• this website;
• our applications;
• direct communication;
• or another appropriate channel.

The effective date at the top of this document will identify when the policy was most recently updated.

For questions concerning this GDPR & Data Protection Policy or GN128's handling of personal information, please contact:

GN128 Solutions
Data Protection / Privacy Contact
Website: gn128.com
Contact: Contact Us or Book a Call