Customer Privacy Policy

Scope

This policy applies when GABCO Enterprises (“GABCO”, “we” or “us”) provides services to a client, including virtual CIO, cyber security, cloud, on premises infrastructure, managed IT, AI advisory and VASP readiness services. It sits alongside our Terms and Conditions and any agreement or statement of work with you. Where those documents say something different about data protection, the signed agreement prevails.

For visitors to our website, see the Website Privacy Policy.

Our two roles

As a data controller, we decide how to use the personal data we need to run the relationship with you: names, job titles and contact details of your staff, contract and billing records, and our communications with you.

As a data processor, we handle personal data held in your systems, such as email, files, user accounts and devices, only to deliver the services you engage us for. You remain the data controller for that data and we act only on your documented instructions.

Information we hold about you

• Contact details for your key contacts and users
• Contract, proposal, invoice and payment records
• Support requests, call notes and correspondence
• Records of remote sessions and site visits
• Asset and configuration information about your devices and systems
• Administrative credentials, stored only in an encrypted password vault

Data in your systems

When we access your systems we:

• Access only what is needed for the task
• Do not use your data for our own purposes, or sell or disclose it except as you instruct or the law requires
• Keep it confidential and require the same of our staff and contractors
• Do not copy data out of your environment unless the work requires it, such as a backup or migration you have approved
• Help you respond to requests from individuals exercising their rights

Lawful basis

We process client relationship data to perform our contract with you, to meet legal, tax and accounting obligations, and for our legitimate interest in running and improving our services. Data in your systems is processed on your instructions under our agreement.

Service providers

We use trusted providers to deliver our services, which may include remote monitoring and management tools, ticketing, password management, backup, security and cloud platforms, and Microsoft 365. Each is bound by confidentiality and security obligations, and receives only the data it needs. A current list of providers that may process your data is available on request.

Security

We protect client data with multi factor authentication, least privilege access, an encrypted credential vault, logging of administrative access, endpoint protection on our own devices and confidentiality commitments from everyone who works for us.

Personal data breaches

If we become aware of a breach affecting your data, we will tell you without undue delay, explain what happened and what data is affected, and help you contain it. Under the DPA the data controller must notify the Ombudsman, and affected individuals where required, within 5 days of becoming aware of a breach. We will give you the information you need to do that.

International transfers

Some of our providers process data outside the Cayman Islands. We transfer personal data abroad only where the DPA permits it, with adequate protection or appropriate safeguards in place. Where you require data to stay in a particular region, we will agree that with you in writing.

Retention and return

• Client relationship records: for the engagement and up to 7 years after it ends
• Data in your systems: returned or handed over at the end of the engagement, then deleted from our tools within 30 days unless you instruct otherwise or the law requires us to keep it
• Credentials: handed over and removed from our vault at the end of the engagement

Your rights

Your staff have the rights described in our Website Privacy Policy. If we receive a request about data we process on your behalf, we will pass it to you promptly and help you respond.

If you are not satisfied with our response, you can complain to the Office of the Ombudsman, which regulates data protection in the Cayman Islands, at ombudsman.ky.

Contact us

GABCO Enterprises
PO Box 1184, George Town, Grand Cayman KY1-1503, Cayman Islands

Email info@gabcoenterprises.com or call +1 345 769 4222.