Privacy Policy

Effective date: 26/10/2026

1. About this policy

This policy explains how GERAYO collects, uses and protects personal data, and the rights you have over it. It covers our website, gerayo.com, the GERAYO platform and customer portal, and our sales, support and billing communications.

2. Who we are

“GERAYO ”, “we” and “us” mean the two companies that provide GERAYO :

GERAYO Limited, a private limited company registered in England and Wales under company number 14423373, with its registered office at Suite 1, 7th Floor, 50 Broadway, London SW1H 0DB, United Kingdom.
Logistics Systems for Internet Services, a private limited company registered in Jordan with its office at 30 Sa’ad Bin Abi Waqqas Street, Kigali, Rwanda.

The company responsible for your personal data, known as the controller, depends on your relationship with us:

If your organisation has an agreement with us, the GERAYO company named in that agreement is the controller of the account, billing and support information we hold about your organisation and its users.
If you visit our website or contact us about our services, the controller is Logistics Systems for Internet Services.

For any question about privacy, email [email protected].

3. The laws we follow

GERAYO Limited processes personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Logistics Systems for Internet Services processes personal data under Jordan’s Personal Data Protection Law No. 24 of 2023. Where the data protection laws of other countries apply to us, such as the EU General Data Protection Regulation, we follow them too.

4. Data in the GERAYO platform

Our customers enter data about their own business into the platform, such as shipments, invoices and accounts, and the details of their clients, agents, suppliers and employees. We call this Customer Data.

For Customer Data, our customer is the controller: it decides what goes into the platform and why. We act as its processor and use Customer Data only to provide the service, under our agreement with that customer.
We do not sell Customer Data or use it for marketing. We share it only as described in section 8 or when the law requires it.
Customer Data is hosted with Amazon Web Services in Frankfurt, Germany or, for customers on our Hong Kong platform, with Alibaba Cloud in Hong Kong.
If a GERAYO customer has entered your details into the platform, for example because you are one of its clients or suppliers, please contact that organisation about your data. If you contact us instead, we will pass your request on to it.

5. Information we collect and why

Information	What we use it for	Legal basis under UK GDPR
Account details of platform users: name, work email, phone number, job title, username, password (stored only as a hash) and two-factor authentication settings	To create and secure accounts, provide the service and give support	Performing our contract with your organisation; our legitimate interest in running a secure service
Usage and security records: IP address, browser, sign-in times and the actions taken in the platform	To keep the platform secure, detect misuse, fix errors and keep audit trails	Our legitimate interest in security and service quality
Billing details: billing contacts, company details, invoices and payment records	To bill our customers and keep accounting records	Performing our contract; complying with tax and accounting law
Support requests: messages, call notes and attachments	To answer requests and improve the service	Performing our contract; our legitimate interest in improving the service
Sales and marketing contacts: name, company, work email, phone number, demo requests and our correspondence	To answer enquiries, arrange demos and send news about GERAYO	Our legitimate interest in promoting our services to businesses, or your consent where the law requires it
Website visits: IP address, device and browser details, pages visited and cookie identifiers	To run the website, count visits and measure our advertising	Our legitimate interest for necessary cookies; your consent for statistics and marketing cookies

You can stop marketing emails at any time with the unsubscribe link in each email or by writing to [email protected].

6. Cookies

Cookies are small files that a website stores in your browser. When you first visit our website, a banner asks which cookies you accept. You can change your choice at any time with “Manage consent” at the bottom of every page.

Necessary cookies make the website work and are always on.
Preferences cookies remember your choices, such as language.
Statistics cookies, from Google Analytics, count visits and show how the website is used.
Marketing cookies, from Google Ads, the Meta Pixel, the LinkedIn Insight Tag and HubSpot, measure our advertising and help us follow up on demo requests.

Statistics and marketing cookies are set only if you accept them. The GERAYO platform itself uses only the cookies needed to sign you in and keep your session secure.

7. How we protect personal data

Connections to our website and platform are encrypted with TLS.
Passwords are stored only as one-way hashes, so nobody at GERAYO can see them. We can reset a password, but we cannot send it to you. Two-factor authentication is available for platform accounts.
Only authorised staff can access production systems, and their accounts are protected with multi-factor authentication.
Backups are encrypted, and we test that they can be restored.
We run an information security management system based on ISO/IEC 27001.

Please keep your password to yourself and sign out when you use a shared device. No way of sending or storing data is completely secure. If a security incident affects your data, we will tell the affected customers without undue delay and notify the regulator where the law requires, for example the Information Commissioner’s Office within 72 hours.

8. Who we share personal data with

We never sell personal data. We share it only with:

the other GERAYO company, to provide and support the service;
service providers that process data for us under contract: hosting (Amazon Web Services and Alibaba Cloud), network security (Cloudflare), email delivery (Mailgun), customer support (Zendesk), customer relationship management and marketing (HubSpot), error and performance monitoring (Sentry and Datadog), and business tools (Google Workspace, Slack and ClickUp);
advertising platforms (Google, Meta and LinkedIn), only if you accept marketing cookies, to measure our advertising: they receive details of your visits to our website, and Google also receives a hashed copy of the email address you enter in our contact form;
Anthropic, which provides the AI features of the platform, only for customers who turn those features on;
the systems and authorities a customer tells us to send its data to, such as customs and tax authorities and accounting systems;
the partner or reseller who introduced your organisation to us, limited to the details of your subscription;
professional advisers, such as lawyers, accountants and auditors, who must keep it confidential;
courts, regulators and law enforcement, when the law requires us to;
a buyer or successor, if GERAYO is reorganised, merged or sold, who must continue to protect it under this policy.

Our customers can ask [email protected] for the current list of the providers that process Customer Data.

9. International transfers

Our staff work in Jordan, the United Kingdom, the United Arab Emirates and Saudi Arabia, and our service providers operate in several countries. Personal data may therefore be accessed from, or stored in, a country other than the one where it was collected. Customer Data stays hosted in Germany or Hong Kong as described in section 4, and authorised staff may access it remotely to provide the service.

When personal data protected by UK law goes to a country that does not have an adequacy decision, we protect it with the UK International Data Transfer Agreement. You can ask us for a copy at [email protected].

10. How long we keep personal data

Customer Data and its audit logs: for the length of the customer’s subscription and 3 months after it ends, unless the agreement or the law requires longer. They are then permanently deleted.
Backups: 30 days, after which they are deleted. Data deleted from the platform is therefore gone from our backups within 30 days.
Billing records: as long as tax and accounting law requires, usually 10 years.
Support requests: 12 months after the agreement ends.
Sales and marketing contacts: until you unsubscribe or object, or 3 years after our last contact with you, whichever comes first. If you unsubscribe, we keep your email address on a suppression list so that we do not contact you again.
Website statistics: 14 months.

11. Your rights

Depending on the law that applies to you, you can ask us to:

give you a copy of your personal data;
correct it;
delete it;
restrict how we use it, or stop using it where we rely on our legitimate interests;
give you the data you provided in a format you can pass to someone else.

You can also object to direct marketing at any time, and withdraw any consent you have given. Withdrawing consent does not affect what we did before.

To use any of these rights, email [email protected]. We may ask you to confirm your identity. We answer within one month, free of charge, and will tell you if a complex request needs up to two months more. For Customer Data, see section 4.

12. Complaints

Please contact us first at [email protected] so that we can try to put things right. You can also complain to a data protection authority:

in the United Kingdom, the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113;
in Jordan, the Personal Data Protection Council: the Personal Data Protection Directorate of the Ministry of Digital Economy and Entrepreneurship, [email protected], +962 6 580 5700, P.O. Box 9903, Amman 11191;
elsewhere, the data protection authority in your country.

13. Children

GERAYO is a service for businesses and is not meant for children. We do not knowingly collect personal data from children.

14. Changes to this policy

When we change this policy, we will publish the new version on this page with a new effective date. If a change is significant, we will also email our customers’ account administrators before it takes effect.

15. Contact us

Email: [email protected]

GERAYO Limited, Suite 1, 7th Floor, 50 Broadway, London SW1H 0DB, United Kingdom

Logistics Systems for Internet Services, 30 Sa’ad Bin Abi Waqqas Street, Kigali, Rwanda. Phone: +250 788 000 000