GDPR
How Gaia handles personal data under UK GDPR when you use the carbon accounting platform, and what you can do to stay in control of it.
Last updated: 7 October 2026
Who is responsible for what
For personal data in your platform account, your organisation is the controller and Gaia Technologies Ltd is the processor. We process that data to provide the platform, on your instructions.
For personal data we collect to run our own business, such as sales enquiries, billing contacts and visits to this website, Gaia is the controller. Our privacy policy covers that.
Personal data in the platform
Carbon accounting runs on activity data: energy use, spend, travel and waste. Most of that is not personal data. The personal data in a typical account is:
- user accounts: name, email address, role and sign-in history
- the email addresses of people you invite to surveys, such as supplier contacts, and of the people who sign off your reports
- uploaded bills, invoices and evidence files, which can include names and addresses
- the audit trail, which records who changed what and when
The platform is not built to hold special category data, such as health information, so please don't upload it.
Where it is stored
The platform is hosted on Amazon Web Services in London, and your data is stored and processed in the UK. A few supporting services, such as email delivery and support chat, process contact details outside the UK. Our subprocessors page lists every provider, what it does and where.
How personal data is protected
The controls that keep your data secure are the same ones that help you meet UK GDPR.
Encrypted and backed up
Need-to-know access
A record of every change
Our security page covers hosting, access control and certification in more detail.
Requests from the people in your account
People whose personal data is in your account have rights under UK GDPR, including access, correction and erasure. As controller, your organisation responds to those requests, and we help you do it:
- users can update their own name and details in their profile settings
- admins can deactivate users who have left
- you can export your data from the platform at any time
- for anything you can't do yourself, such as permanently deleting someone's personal data, email info@gaiacompany.io and we'll help you meet the one-month deadline
Automated processing and AI
The platform doesn't make decisions about people. Bill extraction suggests figures, and a person confirms them before anything counts towards your footprint. The G.AI assistant can read your account to answer questions but can't change anything. It runs on Amazon Bedrock in London, which doesn't use your data to train models.
Personal data breaches
If we become aware of a personal data breach affecting your account, we'll tell you without undue delay and give you what you need to meet your own reporting duties to the Information Commissioner's Office (ICO).
When your contract ends
Export anything you want to keep before your subscription ends. After it ends, ask us and we'll delete the customer data in your account, except anything we're required by law to keep.
Data processing agreement
If your organisation needs a data processing agreement with us, contact us and we'll send one over.
Contact
For questions about data protection, or help with a request, email info@gaiacompany.io.
Gaia Technologies Ltd is registered in England and Wales (company number 15056038), with its registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF. If you're unhappy with how we've handled personal data, you can complain to the ICO, though we'd welcome the chance to put it right first.