Privacy Notice

Privacy Notice

This Privacy Notice describes how GMPKit, LLC ("GMPKit," "we," "us," or "our") collects, uses, discloses, protects, and retains personal information in connection with our websites, applications, products, and services (collectively, the "Services").

The Services include gmpkit.com, ai.gmpkit.com, GMPWit™, and other GMPKit offerings made available to customers and website visitors.

GMPWit is an AI-enabled workspace designed to support Good Manufacturing Practice (GMP) professionals through learning, guided analysis, structured workflows, and documentation development.

This Notice applies to personal information collected through our websites, account registration, subscriptions, customer communications, and use of applicable Services, subject to the distinctions described below concerning information processed on behalf of organizational customers.

Our Role in Data Processing

GMPKit may process personal information in different capacities depending on the nature of the Services and the relationship with the individual or organization.

When GMPKit determines the purposes and means of processing personal information for its own business activities, including website operations, customer communications, account administration, billing, security, and related business functions, GMPKit acts as the controller or business, as those terms are defined under applicable privacy laws.

When GMPKit processes personal information on behalf of an organizational customer and under that customer's instructions, GMPKit may act as a processor or service provider, as applicable.

For organization-managed services, the customer organization may determine the purposes for which its authorized users provide information and may exercise applicable control over that information under its agreements with GMPKit.

Where GMPKit acts as a processor or service provider, applicable customer agreements and data processing terms may govern the processing. Individuals seeking to exercise rights concerning information controlled by their organization may need to direct those requests to the organization.

GMPKit will cooperate with applicable customer organizations in addressing privacy requests as required by law and relevant agreements.

Personal information we collect and how we use it

GMPKit, LLC ("we," "us," or "our") collects personal information when you engage with our websites. Personal information includes any data that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you. As used in this Privacy Notice, "personal information" also includes "Personal Data" as defined under the General Data Protection Regulation ("GDPR") and the UK Data Protection Act 2018 ("DPA"). We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Privacy Notice, unless you request its deletion and no exception to your right to deletion applies.

Personal information may also be collected when individuals use GMPKit applications or interact with Services made available through GMPKit. Where we process personal information on behalf of a customer, requests to exercise rights under the GDPR and/or the DPA should be submitted directly to the applicable customer. We will support our customer in fulfilling such requests as required by law.

When we collect or process personal information on behalf of a customer, GMPKit, LLC acts as a Service Provider under the California Privacy Rights Act ("CPRA") and as a Processor under EU/UK data protection laws and other applicable U.S. state privacy laws. We process and retain your personal information strictly in accordance with the data processing agreement in place with our customer and applicable legal requirements.

In certain cases, GMPKit, LLC acts as a Data Processor (or Service Provider) on behalf of our business customers (the Data Controllers). This means we process personal information only according to their instructions and for the purposes they specify.

If your personal information has been submitted to us by one of our customers, and we process that data on their behalf, any privacy rights requests you submit to us (such as requests to access, correct, or delete your information) will be forwarded to the relevant customer for review and handling. You may also choose to contact the customer directly, as they are responsible for managing your data under applicable privacy laws.

GMPKit will cooperate with our customers to support the timely and lawful handling of such requests.

Sign Up for Our Solutions

When you sign up for any of our solutions, GMPKit, LLC collects your personal identifiers (name and email address) and your professional or employment-related information (company name). This information is used to create and manage your account. If EU or UK data protection laws apply, the legal basis for this collection is the performance of a contract.

We share this information with our customer relationship management platform provider, lead enrichment provider, and event outreach provider to help manage the client relationship. The legal basis for sharing with the event outreach provider is your consent, while the legal basis for other processing is our legitimate interest in efficiently providing our services and maintaining client relationships.

If you are required to sign documents related to your engagement with our services, we will share your information with our e-signature provider. The legal basis for this processing is our legitimate interest in efficiently obtaining a legally binding execution of our agreement. Additionally, this information may be used for internal business analytics to assess GMPKit, LLC's performance and improve our services.

Make a Payment

When making a payment, we collect, from you or our third-party payment processor, your personal identifiers (name and email address) and professional or employment-related information (organization name). This information is used to complete the transaction. We share this data with our third-party payment processor. If EU or UK data protection laws apply, the legal basis for this collection is the performance of a contract.

Conduct a Video or Voice Call to Discuss Our Services

When participating in a video call, GMPKit, LLC collects your personal identifiers (name and business email address), visual and auditory information (video and voice data), and any messages or notes shared during the call. This information is used for communication purposes, and the legal basis for processing is the performance of a potential future contract.

We share this information with our video conferencing provider. Additionally, with your consent, we may use meeting assistance and note-taking software to help document discussions. When conducting a voice call, we collect your personal identifiers (name and business telephone number) and any discussed information. This data is shared with our telephone provider for communication services.

Request Technical Support

If you submit a technical support request, we collect your personal identifiers (name, business email address, and business telephone number) and employment-related information (company name, position). This information is used to process and troubleshoot your support request.

We share this data with our support ticket management, chat provider, and project/task management provider to track, resolve, and document support requests. The legal basis for this processing under EU or UK data protection laws is the performance of a contract and our legitimate interest in providing efficient support.

Communicate Regarding Our Services

When you communicate with us via email, we collect your personal identifiers (name and email address) and employment-related information (company name), as well as any additional information you share. This data is used to facilitate communication regarding our services.

If EU or UK data protection laws apply, the legal basis for this processing is the performance of a contract and our legitimate interest in maintaining efficient client communication.

Information Processed Through GMPWit

For purposes of this Privacy Notice, "Customer Content" means information and materials submitted, uploaded, or otherwise provided by users or customer organizations through the Services, including prompts, conversations, documents, procedures, supporting evidence, technical information, and other operational content.

Depending on how GMPWit is used, information submitted to or processed through the service may include:

• Account information, such as name, email address, organization, and applicable user profile information.
• Professional information, including user roles, experience, and preferences supplied by users.
• Prompts, questions, instructions, and chat conversations.
• Documents, files, procedures, supporting evidence, and other materials submitted or uploaded by users.
• Information relating to manufacturing, quality systems, investigations, technical processes, and other operational activities.
• AI-assisted responses, analyses, draft documents, structured information, and other generated outputs.
• Workflow information, document metadata, and related user interactions.
• Service activity, technical diagnostics, authentication information, and applicable security or audit records.
• Records of acknowledgements and acceptance of applicable legal terms, privacy notices, or responsible-use requirements.

Information entered into GMPWit may contain personal information, confidential business information, proprietary technical information, or other customer-controlled information.

Users and their organizations are responsible for ensuring they have the necessary authority to provide information to GMPWit, including information relating to employees, customers, business partners, or other third parties.

How GMPWit Information Is Used

GMPKit processes information through GMPWit to provide the functionality requested by authorized users and to operate and support the Services.

Depending on the functionality used, processing may include:

• Receiving and responding to user questions and instructions.
• Supporting learning and guided workflows.
• Processing submitted documents and supporting materials.
• Preparing AI-assisted analyses, draft language, structured information, and other outputs.
• Maintaining user accounts, authentication, and applicable work sessions.
• Storing and retrieving information associated with user work.
• Maintaining service functionality, security, and operational integrity.
• Responding to authorized support requests and troubleshooting service issues.
• Administering subscriptions and applicable business relationships.
• Maintaining applicable acknowledgement and legal acceptance records.
• Complying with legal obligations and enforcing applicable agreements.

Additional uses of Customer Content for research, internal evaluation, analytics, benchmarking, or product improvement are subject to applicable agreements, privacy requirements, and the specific practices established by GMPKit.

Customer Content is not used to train or fine-tune general-purpose AI models without the customer's explicit authorization, as described further in this Notice.

AI-Assisted Processing

GMPWit uses AI-assisted technologies to process information supplied by users and generate responses, analyses, and other outputs.

Depending on the functionality used, information submitted through GMPWit may be processed through infrastructure and technology services that support the delivery of AI-enabled functionality.

GMPWit currently uses commercial AI model services provided by Anthropic as its AI model provider. GMPKit may engage additional or different AI service providers in the future, subject to applicable contractual, privacy, and security requirements.

The information involved may include user prompts, instructions, conversation context, submitted documents, relevant supporting information, and other content required to perform the requested function.

The applicable handling of information by service providers is subject to the relevant service arrangements, contractual terms, and privacy and security requirements.

GMPKit recognizes that information submitted through GMPWit may contain confidential or proprietary customer information. The treatment of such information is also governed by applicable Terms & Conditions and customer-specific agreements.

For Website Visitors

Contact Us

When you contact GMPKit, LLC via our websites, we collect your personal identifiers (name), employment-related information (work email address), and any additional information you include in your message. The legal basis for this processing is the necessity to provide the requested service.

Interact with Our Virtual Assistant ("Chatbot")

With your consent, we collect your personal identifiers (name) and any other information shared with the chatbot. We share this data with our chatbot provider to facilitate the service. If EU or UK data protection laws apply, the legal basis for this processing is consent.

Interact with Us on Social Media

When engaging with our social media pages (e.g., LinkedIn, X, etc), we collect engagement metrics to tailor content and marketing. We do not control how social networking platforms store or process information. Please refer to their respective privacy policies.

Social Media Pages

When interacting with our pages, we may collect your personal identifiers (name, profile picture) and any information you provide (e.g., comments, shares, ratings). This data is used for advertising, events, and communication. The legal basis under EU or UK data protection laws is our legitimate interest in promoting our services and engaging with clients.

Community Management

With third-party tools, we collect engagement data (likes, shares, comments) to analyze content performance and improve public relations. The legal basis is our legitimate interest in optimizing communication with users and the public.

Website Interactions and Data Tracking

We automatically collect information when you interact with our websites using cookies, pixels, and tracking technologies. This includes:

Website Tracking & Cookies: We use essential, performance, marketing, and analytics cookies to track usage, enhance experience, improve services, and prevent fraudulent activity. If EU or UK data protection laws apply, the legal basis for strictly necessary cookies is the performance of a contract.

Third-Party Analytics and Tracking

Analytics: We use analytics to analyze website usage.

Analytics, Aggregation, and Service Improvement

GMPKit may use website and service-related usage information for legitimate operational purposes, such as understanding service performance, maintaining security, and evaluating the effectiveness of its Services, subject to applicable law and contractual restrictions.

GMPKit does not use Customer Content submitted through GMPWit, including prompts, conversations, uploaded documents, supporting evidence, or generated outputs, to train or fine-tune general-purpose AI models without the customer's explicit authorization. GMPKit does not authorize its AI service providers to use Customer Content for such training without the customer's explicit authorization.

GMPWit processes Customer Content through its AI model provider (currently Anthropic) to provide requested functionality. Processing information to generate responses, retaining information for authorized workflows, and training AI models are distinct activities.

AI service providers may process or retain information as permitted under their applicable contractual arrangements, including for service delivery, security, abuse prevention, or legal compliance. Such processing does not, by itself, constitute model training.

Customer Content remains subject to GMPKit's applicable confidentiality obligations, privacy protections, and customer agreements.

Confidential customer information and personal information remain subject to applicable confidentiality, privacy, and contractual obligations.

GMPKit, LLC will also use the personal information collected as described to comply with legal obligations, maintain business efficiency, and other necessary purposes outlined in our data-sharing policies.

Data Retention

Unless otherwise stated in this Privacy Notice, we retain your personal information only as long as necessary to fulfill the purposes for which it was collected or until we receive a valid request for its deletion, subject to certain exceptions. However, we may need to retain and use your personal information beyond these periods for the following purposes:

• Compliance with Legal Obligations: Retaining records as required by applicable laws and regulations, including for accounting, dispute resolution, and compliance with labor, tax, and financial regulations.
• Safety and Security Commitments: Ensuring the security of our properties, preventing fraud, and protecting individuals and assets.
• Legal Claims and Obligations: Retaining information as necessary to respond to legal processes or enforceable governmental requests, exercise or defend legal claims, or enforce our contracts, including investigating potential violations.

GMPWit Customer Working Content Retention

Customer working content associated with GMPWit — including uploads, extracted text, conversations, generated outputs, and related materials associated with a user's Documents and Coach Sessions — is subject to the retention practices described in this section and in the Customer Working Content Retention section of GMPKit's Terms and Conditions (POL-102093).

Customer working content is retained for thirty (30) days following the last substantive user interaction with that content. Substantive activity includes uploading information, adding or editing content, or submitting coaching information that materially engages with the content. Merely viewing content, logging in, or opening a page does not reset the retention period.

Each eligible Document and each eligible Coach Session has an independent one-time self-service extension allowance within GMPWit. Explicit user confirmation is required for each extension, and each confirmation is recorded in an audit record. Utilizing an extension for one Document does not affect the extension allowance available to any other Document or Coach Session.

For unexpired content, the extension adds thirty (30) days to the content's existing effective expiration date. During the authorized pre-launch transition period, eligible Customer working content that has passed its standard retention date but has not yet been deleted may also be extended for thirty (30) days from the date of user confirmation.

Each Document and each Coach Session maintains its own retention period based on substantive activity within that item. Accessing one item does not automatically extend the retention period of other linked or associated items. However, the effective expiration of a linked Coach Session may be influenced by the retention protection of the associated Document where the Document's retention extends beyond the Coach Session's standard expiration date. Customers should consult the GMPWit Dashboard for the current expiration status of each Document and Coach Session.

Expiration dates for Customer working content are visible on the GMPWit Dashboard. Customers are responsible for monitoring content expiration dates and taking appropriate action before content reaches its expiration date, including utilizing the self-service extension mechanism or exporting required information to their own governed systems. Content may remain accessible within GMPWit beyond its standard expiration date; customers should not rely on continued content availability as confirmation that the content will be preserved indefinitely.

At the end of the applicable retention period, including any authorized extension, Customer working content may be deleted from GMPWit's application records. Deletion from application records does not guarantee immediate removal from all backup or disaster-recovery systems. Backup and disaster-recovery retention is governed separately by GMPKit's operational and security requirements and is not subject to the standard working-content retention period.

Customers are responsible for exporting or maintaining copies of required information within their governed systems before Customer working content reaches its expiration date. Use of GMPWit does not replace an organization's responsibility to maintain required GMP records in its authorized systems of record.

GMPWit's AI model provider (currently Anthropic) processes Customer Content subject to applicable service arrangements and data-handling practices. Specific provider-side retention parameters are subject to the contractual arrangements governing GMPKit's account with its AI service provider. Provider-side retention is distinct from, and does not determine, the retention of Customer working content maintained in GMPWit's application records. Provider-side processing to generate responses does not, by itself, constitute model training on Customer Content.

Following account cancellation or termination, certain information may remain subject to applicable retention requirements, security obligations, contractual provisions, or valid deletion requests, in accordance with the Customer Working Content Retention section of the Terms and Conditions.

GMPKit may retain records of legal acceptance and acknowledgements as reasonably necessary to establish compliance with contractual or legal obligations. Records maintained for legal compliance, security operations, financial administration, and audit purposes may be subject to separately applicable legal or regulatory requirements and may be retained beyond the standard working-content retention period.

How we share your personal information

GMPKit, LLC shares personal information as described in the "Personal information we collect and how we use it" section above and generally in the following instances:

• Within GMPKit, LLC: We share your personal information within GMPKit, LLC for the legitimate business purposes of efficiently and effectively providing our Services. Access to your personal information is limited to individuals who require it on a need-to-know basis. To the extent EU/UK data protection law applies, the legal basis for this is our legitimate interest in providing the Services more efficiently.
• With Service Providers: We share personal information with service providers that assist us in delivering our Services. These service providers are described more specifically in the "Personal information we collect and how we use it" section of this Notice. Generally, we may share your personal information with third-party contractors, partners, vendors, and providers we use to perform functions on our behalf for business purposes, including data hosting, support ticket management, customer relationship management, technical and security support, payment processing, communications, advertising, application infrastructure, and AI-assisted processing, depending on the applicable Service.
• In the Event of a Corporate Reorganization: If GMPKit, LLC undergoes a business transaction such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or any other disposition of all or part of our business, assets, or stock, we may share personal information with relevant third parties, including prospective buyers, investors, or business partners (and their advisors). In the case of bankruptcy or liquidation, personal information may also be transferred as part of the proceedings. To the extent EU/UK data protection law applies, the legal basis for this is our legitimate interest in conducting business operations or, where required by law, obtaining consent.
• For Legal Purposes: We share personal information when legally required, such as in response to court orders, subpoenas, regulatory requirements, law enforcement requests, or other legal processes, including those related to national security. We may also share information with our legal advisors or auditors to establish, protect, or exercise our legal rights, enforce our contracts, or defend against legal claims. Additionally, we may share personal information as necessary to detect, investigate, prevent, or take action against illegal activities, fraud, security threats, or violations of our agreements and policies. To the extent EU/UK data protection law applies, the legal basis for this is compliance with legal obligations or our legitimate interest in meeting other applicable legal requirements.
• With Your Consent: Apart from the instances outlined above, we may request your explicit permission to share your personal information for a specific purpose. In such cases, we will provide notice and obtain your consent before collecting or sharing the information. You may revoke your consent at any time by contacting us at support@gmpkit.com.

Service providers supporting the operation of GMPKit's Services may include providers of website and application hosting, data storage, authentication, payment processing, customer communications, technical support, analytics, security, and AI-assisted processing, depending on the applicable Service.

Information disclosed to service providers should be limited to information reasonably necessary for the relevant services and subject to applicable contractual and legal safeguards.

Privacy Rights and Requests

Individuals may contact GMPKit at privacy@gmpkit.com regarding applicable requests to access, correct, or delete personal information.

Where GMPKit processes information on behalf of a customer organization, GMPKit may direct the request to the responsible organization or cooperate with that organization in fulfilling applicable obligations.

Requests may be subject to identity verification, applicable legal exceptions, contractual obligations, and limitations established by applicable law.

Organization-Managed Services

Where an organization purchases or administers access to GMPKit Services for its personnel, that organization may have responsibilities relating to account administration, authorized use, and information submitted through the Services.

The availability of organization-level administrative functions and access to user information depends on the applicable Service, customer configuration, and contractual arrangements.

Users should consult their organization's applicable policies regarding use of company information and authorized access.

Do not track

We do not respond to Do Not Track (DNT) signals or similar mechanisms. DNT is a preference you can enable in your web browser to indicate that you do not wish to be tracked across websites and mobile applications. However, because there is no uniform industry standard for recognizing and responding to DNT signals, our systems do not currently respond to them.

You can enable or disable Do Not Track by adjusting the settings in your web browser's Preferences or Settings page.

Information Security

We implement appropriate technical and organizational security measures, such as access controls and encryption, to protect the personal information we collect and maintain from unauthorized access, destruction, use, modification, or disclosure. Only authorized individuals are permitted to access personal information, and they are required to treat it as confidential. However, no security measure or method of data transmission can guarantee 100% security, and we cannot guarantee the absolute security of the personal information we collect from you.

Certain GMPKit systems used in connection with consulting engagements may contain Controlled Unclassified Information (CUI), which is government-created or owned information that requires safeguarding or dissemination controls consistent with applicable laws, regulations, and government-wide policies. Such systems may also be subject to specific requirements related to certain types of CUI, such as Export Controlled Information.

GMPWit is not designated or authorized for the submission, processing, or storage of CUI or export-controlled information unless expressly established under a written agreement with GMPKit providing for applicable authorization and controls.

Children's Privacy

The Services are not intended for individuals under the age of eighteen (18) years. If we learn that we have collected or received personal information from individuals under the age of eighteen (18), we will delete the personal information. If you believe we have personal information on individuals under the age of eighteen (18), please contact us at the contact information provided below.

Changes to this Privacy Notice

GMPKit may update this Privacy Notice from time to time to reflect changes in its Services, information-processing practices, business operations, or applicable legal requirements.

Updated notices will identify an effective date and may include a document version or other reference identifying the applicable revision.

Where required by applicable law, GMPKit will provide appropriate notice of material changes and obtain any required consent or acknowledgement.

GMPKit may maintain records of applicable Privacy Notice acknowledgements, including the notice version, acknowledgement date and time, and related account or technical information.

Historical versions may be retained for legal, compliance, and evidentiary purposes.

Revision History

Contact Us

If you have any questions or concerns regarding this Privacy Notice, please contact us by email at privacy@gmpkit.com or by mail at: