GDPR-ready. UK-hosted.
IBIOS is built for UK trade businesses handling personal data. Production hosted in the UK, tools for erasure requests, consent logged automatically, and a full Data Processing Agreement in place from day one. IBIOS is made by IBIOS Limited (NI743167) in Northern Ireland and supports your obligations under UK GDPR, which applies across the UK including Northern Ireland.
GDPR compliance features
UK-hosted
Production hosted in the UK. Some AI processing uses US providers under UK transfer safeguards; UK-only AI processing coming soon.
Subject access request support
Full personal data export per customer, to help you meet the one-month statutory deadline.
Right to erasure
Personal identifiers anonymised on request. Financial records retained for statutory obligations.
Data Processing Agreement
Standard DPA included with all accounts. Controller/processor relationship clearly defined.
Consent logging
Consent recorded with timestamp, mechanism, and scope. Withdrawal logged to the same standard.
Breach notification
IBIOS will notify affected customers and relevant supervisory authorities within 72 hours of a confirmed personal data breach.
Who is the data controller when you use IBIOS?
IBIOS acts as a data processor on your behalf. Your business is the data controller for your customers’ personal data. This means your privacy policy, your GDPR obligations, and your response to data subject requests are your responsibility — IBIOS provides the tools to meet those obligations efficiently and completely.
The Data Processing Agreement sets out exactly what IBIOS does with your data, which sub-processors are used (if any), what security measures are in place, and what happens to your data when your account is closed. A copy is available at any time by raising a support request.
If a customer of yours makes a data subject access request or a right-to-erasure request, IBIOS provides the tools to respond within the one-month statutory deadline. The export and anonymisation functions are built into the standard interface, not a support ticket process.
Related: personal data starts in the IBIOS customer and job CRM; user roles and access rights control which staff can see it; backup and restore protects it; and the AI audit trail (coming soon) will log AI actions separately from staff actions.
What do UK businesses ask about GDPR and IBIOS?
Does IBIOS transfer customer data outside the UK?
Some AI processing, yes. IBIOS production (application, database and file storage) is hosted in the UK, but some AI processing currently uses US-based providers (Groq and OpenAI) under UK transfer safeguards, as listed at /legal/subprocessors. IBIOS does not transfer personal data to third countries without adequate safeguards. Coming soon: UK-only AI processing on our own GPUs.
How does IBIOS handle a subject access request?
IBIOS provides a data export function that produces a complete record of all personal data held for a specific customer or contact: CRM records, job history, quote history, call records, and any contact details held. This export can be provided to the data subject within the one-month statutory deadline. Your business acts as data controller for your customers' data; IBIOS acts as processor under a Data Processing Agreement.
Can personal data be erased on request?
Yes. IBIOS supports right-to-erasure requests. When you mark a customer record for erasure, personal identifiers are anonymised while job-level financial records are retained for your statutory accounting obligations. The anonymisation is permanent and cannot be reversed. A log of the erasure request is kept in the audit trail.
Is there a Data Processing Agreement (DPA) in place?
Yes. All IBIOS accounts include a standard DPA by default, covering the relationship between your business (controller) and IBIOS (processor). The DPA covers sub-processors, security measures, breach notification obligations, and data return or deletion at contract end. A copy is available on request.
Does IBIOS log consent for marketing communications?
Yes. IBIOS records a consent log for each customer contact: when consent was given, the mechanism (e.g. web form, verbal during a call), and the scope (e.g. quote follow-up, marketing emails). Consent can be withdrawn at any time and the withdrawal is logged with the same detail as the original consent.
GDPR compliance built in, not bolted on.
UK-hosted, DPA included, erasure tools built in. Early access by waiting list for UK trade businesses.