Privacy Policy.

GAAS LAW is an operational infrastructure platform for insurance defence litigation, operated by Peak Asset Investments Ltd (the “Controller”). This policy applies to all users of the GAAS LAW platform, including fee-earners, supervisors, paralegals, insurer users, and their delegated administrators.

We collect three categories of data:

• Matter data. Claimant information, defendant information, insurer and policy references, evidence documents, medical reports, quantum working, and all operational events generated during the matter lifecycle.
• User data. Names, business email addresses, role, firm/department, access permissions, authentication state, and audit trail of user actions performed inside the platform.
• Telemetry data. Anonymised, aggregate-level performance and error metrics used to maintain service reliability. No user-identifying content is included.

Data is processed strictly for the purposes necessary to provide the service:

• To operate the Matter Readiness Framework™ and compute per-matter and portfolio-level intelligence.
• To generate matter-centric billing events, drafts, and approvals — as authorised by the customer firm.
• To produce insurer-facing reporting, only within the scope defined by the contracting firm and insurer.
• To maintain audit trails for defensibility, regulatory review, and client instruction.
• To improve platform reliability and accuracy, using only anonymised telemetry.

All production data is hosted in UK / EU cloud regions operated by enterprise-grade providers with SOC 2 Type II and ISO 27001 certifications. No production customer data leaves the UK / EU perimeter without a documented, customer-approved data-transfer agreement.

Retention periods are configured per-tenant and aligned to the customer firm’s Solicitors Regulation Authority and insurer-panel requirements.

• Active matter data — retained for the duration of the matter plus the contractual retention window (typically 6 to 15 years depending on matter type).
• Audit logs — retained for the duration of the tenancy plus 7 years minimum.
• Anonymised telemetry — retained for 13 months.
• User account data — retained while the account is active; deleted or anonymised within 90 days of account closure unless a legal hold applies.

Data subjects have the right to:

• Request access to the personal data we hold about them.
• Request correction of inaccurate or incomplete personal data.
• Request erasure, subject to applicable retention requirements and legal holds.
• Restrict or object to processing, where lawful bases permit.
• Data portability — receive a structured copy of personal data.
• Withdraw consent at any time, where consent is the lawful basis.
• Lodge a complaint with the UK Information Commissioner’s Office.

On contract termination, all customer matter data is exported in a structured format and returned to the customer. Following the contractually agreed return window, all primary-copy data is irreversibly destroyed within 30 days and all backup-copy data within the standard backup cycle (maximum 90 days).

A current list of approved sub-processors (cloud hosting, email delivery, error telemetry, model inference) is available on request to procurement teams. Any change to the sub-processor list is notified in advance and the customer retains a right of reasonable objection.

Questions or data subject requests should be directed to the Data Protection Officer at dpo@gaaslaw.com. Requests are acknowledged within 72 hours and resolved within 30 days.