GDPR & Data Protection
IBIOS is a UK GDPR data processor. Your business is the data controller. This page explains how that relationship works, what data we hold, and your rights and obligations.
Key facts at a glance
Your role
Data Controller
You determine the purpose and means of processing personal data entered into IBIOS.
IBIOS’s role
Data Processor
IBIOS processes data on your instructions, under a Data Processing Agreement.
Data location
United Kingdom
Customer data is stored on UK servers. Some AI processing happens outside the UK under UK transfer safeguards; see /legal/subprocessors.
Subject rights response
One month
The statutory deadline for access, rectification, erasure, and portability requests. IBIOS supports you in meeting it.
Controller and processor: what this means for you
Under UK GDPR, any business that collects and uses personal data is a data controller. As an IBIOS customer, when you enter customer names, phone numbers, job details, and other personal information into the system, you are the controller of that data. You decide what data is collected, why it is collected, and how long it is retained.
IBIOS is your data processor. We store and process that data on your behalf, under your instructions, according to the terms of our Data Processing Agreement (DPA). We do not use your customers’ data for our own purposes, and we do not sell it to third parties — ever.
The DPA is available on request by emailing privacy@allforone.ai. It is also included in the standard IBIOS terms of service for business customers.
Data subject rights
Your customers have rights under UK GDPR: the right to access their data, have it corrected, request its deletion, and receive a portable copy. As data controller, you are responsible for responding to these requests. IBIOS supports you in fulfilling them:
Right of access
Export a customer record from IBIOS as a summary report.
Right to rectification
Edit customer records directly in the IBIOS interface.
Right to erasure
Delete records via the interface or submit a request to us for backup/log deletion.
Right to portability
Ask us for a copy of the customer data and we will provide it in a portable format.
Under UK GDPR, subject rights requests must normally be answered within one month. IBIOS will action requests relating to data in backups and logs so that you can meet that deadline.
Data retention
HMRC requires UK businesses to retain financial records for a minimum of 6 years from the end of the relevant tax year (effectively 7 years from the transaction date in most cases). IBIOS retains customer and job records linked to invoiced transactions for this period to support your compliance with this requirement.
Records not associated with financial transactions (such as enquiries that did not convert to jobs) can be deleted at any time by authorised staff. Ask us for a copy of your customer data and we will provide it in a portable format.
Sub-processors
IBIOS uses third-party services, including those below, that may process personal data on your behalf. Each is subject to appropriate data processing agreements. The full, current list is on our sub-processor page.
UK cloud hosting provider
Primary server infrastructure. Data stored in UK data centres.
Stripe
Payment processing. Stripe holds payment card data; IBIOS does not store card details.
Groq, Inc. (United States)
Main AI provider: text and document understanding, drafting assistance and speech-to-text. Transfers covered by UK transfer safeguards. Coming soon: UK-only AI processing on our own GPUs.
OpenAI, L.L.C. (United States, fallback)
Backup AI provider, used only when the main provider is unavailable or for small, low-sensitivity tasks. Transfers covered by UK transfer safeguards.
No personal data is sold to any third party. Sub-processor use is limited to what is necessary to provide the IBIOS service.
Which IBIOS features help with UK GDPR?
IBIOS (Integrated Business Intelligence & Operations System) is made by IBIOS Limited (NI743167), Northern Ireland. These pages cover the IBIOS features most relevant to the personal data you hold about customers and staff.
- Customers (CRM): one record per customer, so what you hold about each person is in one place.
- User roles and access rights: limit who can see personal and payment details, per role and per person.
- Backup and restore: how IBIOS backs up and restores your business data.
What do people ask about IBIOS and UK GDPR?
Am I the data controller?
Yes. When you use IBIOS to store customer records, job details, and other personal data relating to your customers, you are the data controller under UK GDPR. IBIOS acts as your data processor — processing that data on your instructions and on your behalf. This relationship is formalised in the Data Processing Agreement (DPA) available on request.
What personal data does IBIOS hold?
IBIOS holds the data you enter into the system: customer names, contact details, job and quote records, call records you choose to sync from a connected service such as GoHighLevel, and system user accounts for your staff. IBIOS does not collect or hold personal data about your customers independently — only what you enter or connect on your behalf. Coming soon: call recordings and transcripts from the AI Receptionist.
How do I request deletion of a customer’s data?
You can delete a customer record directly from the IBIOS interface if you hold the appropriate user role. For data held in backups or logs, submit a written erasure request to privacy@allforone.ai. We will confirm deletion so you can meet the one-month statutory deadline. Note that some records may need to be retained for the statutory 7-year period for tax and accounting purposes.
Is call recording subject to GDPR?
Yes. Call recordings are personal data. Today, IBIOS works from call records held in your own connected service (such as GoHighLevel), under that provider’s agreement with you. Coming soon: IBIOS call recording, where callers will be notified at the start of the call and recordings will be accessible only to authorised users and subject to your retention and erasure policies.
What about employee data?
Staff user accounts in IBIOS contain personal data (names, email addresses, login activity). As the data controller, you are responsible for ensuring your staff are aware their activity is logged and their account details are held in the system. IBIOS’s DPA covers employee data as well as customer data.
Questions about GDPR and data protection?
Contact us at privacy@allforone.ai. For urgent erasure requests or data breach reports, please mark your email as urgent and we will prioritise accordingly.
If you have a complaint that we have not resolved to your satisfaction, you have the right to lodge a complaint with the ICO at ico.org.uk.