Privacy Policy

1. Data Controller

The Data Controller for your personal data is SmartOps IT (Kamil Pausz), operating as a Sole Trader in the United Kingdom.

Correspondence Address:
SmartOps IT
Lytchett House
13 Freeland Park
Wareham Road
Poole, Dorset
BH16 6FA
United Kingdom

• Website: https://smartopsit.co.uk
• E-mail: info@smartopsit.co.uk

Personal data is processed in accordance with the UK GDPR and the Data Protection Act 2018.

2. Scope and Purposes of Processing

We process personal data only to the extent necessary to carry out IT business activities, Managed Service Provider (MSP) services, and cybersecurity services.

Personal data is obtained directly from you or from systems and accounts to which you grant us authorised access.

Important note on roles (Controller vs Processor): When you contact us, visit our website, or we manage our own business administration, we act as a Data Controller. When providing MSP / IT / cybersecurity services, we may access and process personal data contained in a Client’s systems. In that context, we typically act as a Data Processor on the Client’s documented instructions, and the Client remains the Data Controller for those data. Where applicable, these arrangements are governed by a data processing agreement (DPA).

A. Contact Form / E-mail

Data scope: Name, e-mail address, message content, technical data (e.g. IP address).

Purpose: Responding to enquiries, preparing quotations, and providing IT and cybersecurity services.

Legal basis:

• Article 6(1)(b) UK GDPR – performance of a contract or steps prior to entering into a contract.
• Article 6(1)(f) UK GDPR – legitimate interests of the controller (business communication and service improvement).

B. MSP / IT & Cybersecurity Service Delivery (Client Systems)

Data scope (may include): business contact details, user identifiers, device identifiers, IP addresses, authentication events, system and security logs, tickets and service requests, configuration and inventory data, and (depending on the Client’s environment) limited content within emails/files/endpoints where necessary to resolve incidents.

Purposes:

• delivering contracted IT/MSP services (support, monitoring, maintenance, incident response);
• cybersecurity monitoring, detection, investigation and remediation;
• ensuring availability, integrity and confidentiality of Client systems;
• auditing and service accountability (e.g. change records, ticket history).

Legal basis: Where we act as a Processor, processing is carried out on the Client’s documented instructions and the Client determines the lawful basis as Controller. For our own administration related to service delivery (e.g. account management, billing, communications), we generally rely on:

• Article 6(1)(b) UK GDPR – performance of a contract (with the Client);
• Article 6(1)(f) UK GDPR – legitimate interests (delivering and securing services, preventing fraud/abuse, maintaining service quality).

C. Business Administration & Compliance

Purposes: invoicing, accounting, tax compliance, record-keeping, handling claims and disputes.

Legal basis:

• Article 6(1)(c) UK GDPR – compliance with a legal obligation (e.g. tax/accounting requirements);
• Article 6(1)(f) UK GDPR – legitimate interests (establishing, exercising or defending legal claims).

D. AI Chat Assistant

Our website features an AI-powered chat assistant ("Szymek" / "Sam") to answer questions about our services and, where you choose to provide them, to pass on enquiry details.

Data scope: the content of the messages you type into the chat; a randomly generated session identifier (not linked to your identity unless you provide identifying details yourself); and, only if you volunteer them in the conversation, contact details such as your name, e-mail address and phone number when requesting a quote or call-back.

Purpose: answering questions about our services in real time, and — only where you supply your own contact details for that purpose — forwarding your enquiry to our team so we can follow up.

How it works: your messages are sent to our own automation system, which uses a third-party AI language model provider (OpenAI) to generate a reply. If you ask for a quote or call-back and provide your contact details, those details, together with the conversation so far, are sent to us by e-mail so we can respond to you; they are not used for any other purpose.

Legal basis:

• Article 6(1)(f) UK GDPR – legitimate interests (providing a responsive way to answer enquiries);
• Article 6(1)(b) UK GDPR – steps prior to entering into a contract, where you ask us for a quote.

The chat assistant is an automated tool. It does not make any decision that produces a legal or similarly significant effect about you — it answers questions and, at most, passes your enquiry to a person on our team. We will always tell you that you are talking to an AI assistant, and you can ask to speak to a person at any time.

To keep your conversation on screen if you send another message or briefly leave the page, the chat assistant stores your session identifier — and, on some pages, the visible conversation itself — in your browser's local storage. This is not a tracking cookie, is not used for analytics or marketing, and is not shared with anyone; it stays on your device and you can clear it at any time via your browser's site data settings.

3. Technical Data and Security

Due to the nature of our services (IT / Cybersecurity), we may process technical data such as system logs or IP addresses. This data is used exclusively for:

• ensuring system security;
• detecting incidents and threats;
• providing IT services.

Legal basis: Article 6(1)(f) UK GDPR – legitimate interest (IT security).

Security measures (examples): access controls and least privilege, MFA where available, encryption in transit where supported, logging and monitoring, incident response procedures, and confidentiality obligations.

4. Social Media

Our website contains links only to external services (Facebook, Instagram, LinkedIn).

We do not use tracking plugins or marketing pixels.

Once you click a link, the privacy policy of the relevant third-party service applies.

5. Cookies and Similar Technologies

We use cookies and similar technologies only for essential website functionality and, where you consent, for privacy-friendly analytics. We do not use cookies for marketing, profiling, or behavioural advertising.

• ❌ We do not use Google Analytics or other third-party analytics platforms.
• ❌ We do not use marketing or advertising cookies.
• ❌ We do not use cookies for profiling or behavioural advertising.
• ❌ We do not share analytics data with any third party.

For analytics, we use a self-hosted analytics solution (Matomo), which we control directly on our own infrastructure. Analytics data is never shared with, or processed by, any third-party advertising or analytics network.

The contact form uses Google reCAPTCHA as a strictly necessary security measure to distinguish legitimate submissions from automated spam and abuse. When the contact form is loaded or the check is completed, reCAPTCHA may process technical and interaction data and set the necessary _GRECAPTCHA cookie for risk analysis. We do not use reCAPTCHA for advertising. Our legal basis is Article 6(1)(f) UK GDPR – our legitimate interest in protecting the website and contact channel from abuse.

Cookie consent banner: When you first visit our website, a cookie banner asks whether you consent to analytics cookies. The Matomo tracking script, and any cookies it uses, is only loaded after you click "Accept". If you click "Decline", no analytics script is loaded and no analytics cookies are set. Your choice is stored in your browser (via local storage) so that you are not asked again on every visit.

Cookies we may set (only after you accept):

• _pk_id.* (Matomo) – used to recognise a returning visitor for analytics purposes. Expires after approximately 13 months.
• _pk_ses.* (Matomo) – used to identify a single browsing session for analytics purposes. Expires after 30 minutes of inactivity.

Legal basis: Article 6(1)(a) UK GDPR – your consent, given via the cookie banner. This satisfies the consent requirement under the Privacy and Electronic Communications Regulations (PECR) for non-essential cookies.

Withdrawing or changing your consent: You can withdraw or change your consent at any time by clearing your browser's local storage / site data for this website, which will show the cookie banner again on your next visit, or by adjusting your browser's cookie settings directly.

6. Data Recipients

Personal data may be shared with trusted third parties only where necessary for the operation of our business and service delivery, including:

• hosting and e-mail service providers;
• postal operators handling business correspondence;
• public authorities (e.g. HMRC), where required by UK law;
• customer support and helpdesk service providers (e.g. ticketing and support systems);
• our AI chat assistant's language model provider (OpenAI), to generate responses to messages you send it;
• our internal enquiry-logging system, to record enquiries you submit through the chat assistant or contact form;
• Google reCAPTCHA, used on the contact form to detect and prevent automated spam and abuse;
• Google Fonts, used to load webfonts on our website — loading a font from Google's servers means your browser sends your IP address to Google.

Where third parties act as our Processors, we use appropriate contractual safeguards (including confidentiality and security obligations) and share only the data necessary for the relevant purpose.

7. Data Storage and International Transfers

We are based in the United Kingdom. However, to ensure high availability, data redundancy, and secure service delivery, we utilise reputable cloud infrastructure and managed service providers.

Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA). Specifically, secure hosting infrastructure used to deliver our services may be located in data centres within the EEA (e.g. France).

The UK Government recognises the EEA countries as providing an adequate level of data protection (UK Adequacy Regulations). This means that personal data can flow freely between the UK and the EEA without the need for additional complex legal safeguards.

In the limited circumstances where we may use a service provider based outside the UK/EEA, we ensure the transfer is carried out in compliance with the UK GDPR, using appropriate safeguards for restricted transfers, such as the UK IDTA or the International Data Transfer Addendum to the EU SCCs (as applicable).

One such case is our AI chat assistant: messages you send it are transferred to our language model provider's (OpenAI's) infrastructure, which may process data outside the UK/EEA (including in the United States). This transfer is covered by that provider's Data Processing Addendum, which incorporates the UK Addendum to the EU Standard Contractual Clauses as the applicable safeguard. Based on the provider's published policies at the time of writing, data submitted through their business/API service is not used to train their models — we recommend reviewing the provider's current Data Processing Addendum periodically, as terms can change. The language model provider may retain messages you send for up to 30 days for abuse-monitoring purposes, unless a longer period is required by law.

Further such cases are our use of Google reCAPTCHA on the contact form and Google Fonts to load webfonts. Your browser connects to Google's servers, which may be located outside the UK/EEA (including in the United States), and sends technical data needed to provide those services, including your IP address.

Outside of the AI chat assistant, Google reCAPTCHA and Google Fonts described above, we do not routinely transfer personal data outside the United Kingdom or the European Economic Area.

8. Data Retention Period

• contact data – for the duration of cooperation or handling of the enquiry, and thereafter as needed for record-keeping and dispute handling;
• AI chat assistant conversations – the visible conversation is kept in your own browser's local storage, not on our servers; our automation system retains messages only for as long as needed to maintain the ongoing conversation and generate replies, and does not archive full conversation transcripts. If you submit an enquiry through the chat, the details you provide are retained on the same basis as other contact data, above (see also the provider retention described in section 7);
• technical data and logs – for the period necessary to ensure IT security, auditability and incident investigation (retention varies by system and risk);
• financial and tax records – for the period required by law and guidance applicable to our business (typically at least 5 years after the 31 January submission deadline of the relevant tax year, and longer where required, e.g. in case of audits or disputes).

9. Your Rights

Under the UK GDPR, you have the right to:

• be informed about how we use your personal data;
• access your personal data;
• rectify your personal data;
• erase your personal data (“right to be forgotten”);
• restrict processing;
• object to processing based on legitimate interests;
• data portability (in certain circumstances);
• withdraw consent at any time (where we rely on consent);
• not be subject to a decision based solely on automated processing, including profiling (where applicable).

To exercise your rights, please contact us at: info@smartopsit.co.uk. We may ask for information to verify your identity. We normally respond within one month, and may extend by up to two additional months for complex requests.

10. Complaints

You have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)
https://ico.org.uk

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or our processing practices. The latest version will always be available on our website.

12. Required Information

Where we need personal data to enter into or perform a contract (e.g. to respond to a service enquiry or provide MSP services), failure to provide the required information may mean we are unable to provide the requested services or quotation.