GDPR Compliance

Counts AI Ltd is committed to complying with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR) and the Data Protection Act 2018. This page explains the legal basis on which we process your personal data and how you can exercise your rights as a data subject. It should be read alongside our Privacy Policy.

Counts AI Ltd, registered in London, United Kingdom, is the data controller responsible for your personal data on the Platform. You can reach our data-protection team at dpo@counts.ai.

• Contract — to create your account, match you with roles, process plan requests and deliver the services attached to your plan.
• Legitimate interests — to keep the Platform secure, improve our matching technology, and carry out essential analytics, balanced against your rights and freedoms.
• Consent — for optional marketing communications and certain non-essential cookies, which you can withdraw at any time.
• Legal obligation — to meet tax, accounting, employment-verification and regulatory requirements.

Under GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — ask us to correct inaccurate or incomplete data;
• Erasure — ask us to delete your data (“right to be forgotten”), subject to legal retention requirements;
• Restriction — ask us to limit how we use your data in certain circumstances;
• Portability — receive your data in a structured, machine-readable format and have it transferred to another provider;
• Objection — object to processing based on legitimate interests or to direct marketing at any time;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing;
• Complain — lodge a complaint with a supervisory authority, such as the UK Information Commissioner’s Office (ICO) at ico.org.uk.

You can manage and export much of your profile data directly from your dashboard. To make a formal request — including for access, correction, deletion or portability — email dpo@counts.ai with your registered email address and the nature of your request. We will verify your identity and respond within one calendar month, as required by law.

We only collect personal data that is necessary to operate the Platform and deliver our services, and we retain it only for as long as your account is active or as required to meet legal and accounting obligations. When data is no longer needed, we securely delete or anonymise it.

Where personal data is transferred outside the UK or European Economic Area — for example to global employers or infrastructure providers — we put appropriate safeguards in place, such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or adequacy decisions recognised by the ICO and European Commission.

We apply data-protection-by-design principles across the Platform, including row-level security on our database, encryption in transit, role-based access controls for our team, and regular reviews of the data we collect and how long we keep it.

In the unlikely event of a personal-data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will inform affected users without undue delay where the law requires us to do so.

For any GDPR-related question or request, email dpo@counts.ai or use our Contact page. You can also see our live GDPR badge on every account page, confirming our compliance posture.