We use personal data only where we have a valid reason, apply proportionate safeguards, and keep it only for the periods in our Data Retention Policy.
1. Who this notice is from
Smart Business Solutions (“SBS”, “we”, “us” or “our”) provides business websites and SBS systems, including recruitment, events, pricing and future system modules. This notice explains our own processing as a controller and our role when we process personal data for an organisation using an SBS system.
For privacy questions or requests, email info@smart.businesssolutions.com.
2. When SBS is controller and when SBS is processor
SBS is normally the controller for information used to run this website, answer direct enquiries, manage our direct business relationships and administer SBS-owned accounts.
When an organisation uses an SBS system to manage its own candidates, applicants, staff, event entrants, attendees or other people, that organisation will normally decide why and how the information is used. In that situation it is the controller and SBS acts as a processor on its documented instructions. Individuals should read the organisation’s own privacy notice as well as this one.
3. Information we may process
- Website and contact data: name, email address, telephone number, organisation, enquiry and correspondence.
- Account and system data: name, work contact details, user ID, role, permissions, login and account-administration records.
- ATS data: application, employment, education, qualification, reference, interview, right-to-work and safer-recruitment information. The customer organisation controls the information requested in its recruitment process.
- Special-category and criminal-offence-related information: where a customer organisation chooses to use relevant ATS workflows, this may include health or fitness declarations and safeguarding/DBS status information. These categories require additional legal conditions and access controls.
- Events data: entrant or attendee contact details, entries, class selections, event administration and relevant communications.
- Pricing data: business contact details, quote requests, quotations and associated communications.
- Technical data: device, browser, IP-address and security information necessary to deliver, protect and troubleshoot our website or systems.
- Documents: files uploaded to an SBS system in connection with the relevant service.
4. Why we use information and our lawful bases
We use information to provide and support our services, respond to enquiries, administer accounts, protect systems, meet legal obligations, resolve issues and improve our services. Depending on the context, the lawful basis may be performance of a contract, compliance with a legal obligation, our legitimate interests in operating and securing services, or consent where that is required. Customer organisations are responsible for selecting and documenting the appropriate lawful basis and any condition for special-category or criminal-offence data in their own use of SBS systems.
5. Service providers and sharing
We only share personal data where necessary to operate a service, comply with law, protect rights and security, or follow a customer organisation’s documented instructions. Current technology providers associated with live SBS services include:
- Supabase for the ATS data platform and authentication-related services;
- Resend for ATS transactional email delivery; and
- Cloudflare Workers and D1 for the Events and Pricing applications, including hosting and database services.
Providers may process data only for the services they supply to us or to an SBS customer, subject to appropriate contractual and security requirements. We may update this list as our services change.
6. International transfers
Some providers may use infrastructure or support teams outside the UK. Where this involves a restricted transfer, SBS or the relevant customer organisation will use an adequacy regulation or another recognised UK safeguard and will take proportionate steps to protect the information.
7. Retention and deletion
We apply the retention periods published in our Data Retention Policy. As a general rule, the retention clock runs from the last meaningful login, amendment or edit, or from the completion of the relevant service activity. We may retain information longer where necessary for a legal obligation, dispute, claim, investigation or security purpose.
8. Security
We use proportionate technical and organisational measures designed to protect information from unauthorised access, alteration, loss and disclosure. Access is restricted according to role and need, and our systems are reviewed as they develop. No online service can guarantee absolute security; please protect your own credentials and tell us promptly if you suspect unauthorised access.
9. Your rights
Subject to applicable law, individuals may ask for access, correction, deletion, restriction, objection, portability or withdrawal of consent. To make a request, email us. If SBS is processing information for a customer organisation, we may need to refer your request to that organisation so that it can respond as controller. You may also complain to the UK Information Commissioner’s Office.
10. Changes to this notice
We will update this notice when our services, suppliers or legal requirements change. The current version will always be available on this page.