GDPR
How GX360 meets the EU and UK GDPR: our role, legal bases, your rights, sub-processors and international transfers.
Last updated: 12 November 2026
This page explains how GX360 meets the EU General Data Protection Regulation (GDPR) and the UK GDPR, for people in the European Economic Area, the United Kingdom and Switzerland. Read it together with our privacy policy, which lists the data we collect and why.
Our role
- Controller. For visitors to gx360.ai, people who contact us, trial users and the users of our customers' GX360 accounts, Infinite Open Source Solutions LLP (iOSS), Kozhikode, Kerala, India, is the controller.
- Processor. For the data customers connect to GX360 (their CRM contacts, leads, website visitors, social inbox and connected marketing accounts), the customer is the controller and iOSS processes the data only on the customer's documented instructions, under our data processing agreement.
- Contact. For anything about your data, write to us through our contact page with the subject "GDPR request".
Legal bases we rely on
| Processing | Legal basis |
|---|---|
| Providing GX360: your account, the trial, connected accounts, approvals and the changes you approve | Performance of a contract (Art. 6(1)(b)) |
| Invoices and tax records | Legal obligation (Art. 6(1)(c)) |
| Sign-in confirmation, fraud and spam prevention, audit logs, service improvement | Legitimate interests (Art. 6(1)(f)) |
| Answering contact-form requests and trial follow-up emails | Consent (Art. 6(1)(a)), given on the form; withdraw it at any time |
| Website analytics cookies | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for that assessment and object at any time.
Your rights under the GDPR
- Access (Art. 15): a copy of the personal data we hold about you.
- Rectification (Art. 16): correction of inaccurate or incomplete data. Many details can also be changed in the app.
- Erasure (Art. 17): deletion of your data where there is no reason to keep it.
- Restriction (Art. 18): pausing our use of your data while a question is settled.
- Portability (Art. 20): your data in a structured, machine-readable format.
- Objection (Art. 21): to processing based on legitimate interests, and always to direct marketing.
- Withdraw consent (Art. 7(3)): at any time, without affecting earlier processing.
- Automated decisions (Art. 22): GX360 does not make decisions with legal or similarly significant effects about people by automated means alone. AI in GX360 prepares proposals, and a person approves any change.
- Complaint (Art. 77): to the supervisory authority where you live or work, or to the UK Information Commissioner's Office. We would appreciate the chance to resolve your concern first.
How to make a request
- Write to us through our contact page with the subject "GDPR request". Say which right you want to use, and give the email address and company your data is linked to.
- We confirm your identity, usually by email to the address on the account, so we never hand your data to someone else.
- We reply within one month. If a request is complex we may extend this by up to two more months, and we will tell you why within the first month.
- It's free. We charge only for requests that are clearly unfounded or excessive, as the GDPR allows.
If your data is in GX360 because a company we work for connected it (for example you are a contact in their CRM), please send your request to that company. If you send it to us, we pass it on and help them respond.
To disconnect an ad or Google account and have everything GX360 read from it deleted, follow the steps on our data deletion page.
Sub-processors
We use these sub-processors to provide GX360. Each is bound by a contract that requires it to protect personal data and use it only to provide its service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic | AI models (Claude) | United States |
| OpenAI | AI models and embeddings | United States |
| DeepSeek | AI models (not used for companies on the OpenAI-only setting) | China |
| Razorpay | Payments in INR | India |
| Stripe | Payments in USD | United States |
| Mailercloud | Service emails | India |
| Backblaze | Backups and file storage | United States / EU |
| Website analytics and spam protection | United States | |
| Cloudflare | Bot protection on sign-up | United States |
Customers who need it can ask for the OpenAI-only setting, which keeps every AI task on OpenAI. We tell customers about new sub-processors before they start processing customer data, as our data processing agreement describes.
International transfers
iOSS operates GX360 from India, and our sub-processors are in the countries listed above. When personal data from the EEA, the UK or Switzerland is transferred to a country that does not have an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK data), or another safeguard the GDPR recognises, and we assess the protection the data receives there. You can ask us for a copy of the safeguards that apply.
Security
- Encryption of access tokens, API keys and other secrets at rest; passwords stored only as salted hashes.
- Sign-in confirmed with a one-time code sent to your email, and limits on failed sign-ins.
- Role-based access inside every company, and an audit log of who changed what and when.
- No change to a live website or connected account without a person's approval.
- Nightly backups, with copies kept off-site.
- Data minimisation: AI providers receive only the text a task needs; leads sent to Meta are hashed first.
If a personal data breach is likely to put your rights at risk, we notify the relevant supervisory authority within 72 hours of becoming aware of it, and tell the people affected without undue delay. For customer data, we tell the customer so that they can meet their own obligations.
Retention
We keep personal data only as long as we need it for the purposes in our privacy policy, which lists the period for each kind of data. In short: account data while the account is active, security logs for up to 12 months, the audit log for up to 24 months, and invoices for as long as tax law requires. Connected-account data is deleted within 30 days of a deletion request.
Data processing agreement
Business customers who bring personal data into GX360 are covered by our data processing agreement, which sets out the processing instructions, confidentiality, security measures, sub-processors, assistance with data subject requests, breach notification, and deletion or return of data when the service ends. To sign a copy for your records, write to us through our contact page.