We design and operate SBS services with privacy, confidentiality, security and accountability in mind. This policy supports our public Privacy Notice; it does not replace any written contract or data processing agreement.
1. Scope and roles
This policy applies to Smart Business Solutions, its website and SBS services. SBS is responsible for its own controller activities. For customer-organisation data in an SBS system, SBS will normally act as processor and the organisation will remain controller. Roles can differ where an agreement or a particular service says otherwise.
2. Data protection principles
We work to ensure personal data is processed lawfully, fairly and transparently; collected for specified purposes; limited to what is necessary; kept accurate; retained only as long as necessary; and protected with appropriate security. We document key decisions and review our practices as systems change.
3. Accountability and privacy by design
We consider data protection when we plan or change a service, access model, integration or data flow. Where processing is likely to create a high risk to people, we will assess whether a data protection impact assessment is required and involve the customer organisation where it is controller.
4. Sensitive recruitment and safeguarding information
SBS ATS may support workflows involving health or fitness declarations, safeguarding and DBS status information. Customer organisations must ensure that their collection and use of this data has a lawful basis and, where required, an additional condition. SBS restricts this data to the functions and access roles needed for the relevant workflow and does not use it for unrelated purposes.
5. Security and confidentiality
We use access controls, account permissions, supplier controls and operational safeguards proportionate to the service and the sensitivity of the data. People with access to personal data must keep it confidential and use it only for authorised purposes. See our Security Policy.
6. Suppliers and transfers
We perform reasonable due diligence when selecting providers that process personal data and use written terms where appropriate. If personal data is transferred outside the UK, we will use an adequacy regulation or another recognised transfer safeguard where required.
7. Data subject rights and requests
We support requests for access, rectification, erasure, restriction, objection, portability and withdrawal of consent. If a customer organisation is controller, we will direct requests to it or support it in responding as appropriate. Contact us at info@smart.businesssolutions.com.
8. Incidents
Any actual or suspected personal-data incident should be reported promptly. We will investigate, contain and document it, and where SBS is processor, notify the relevant customer organisation without undue delay so it can meet its obligations. We will consider whether regulatory or individual notification is required.
9. Retention, review and training
Our Data Retention Policy sets standard retention periods. This policy is reviewed at least annually and when material legal, technical or service changes occur.