Company
Privacy Policy
Effective as of 20 February 2026. At Smart Associates, we are committed to protecting and respecting your privacy.
Effective as of 20 February 2026. At Smart Associates, we are committed to protecting and respecting your privacy.
This Privacy Policy explains when and why we collect personal information about people who visit our website, how we use it, the conditions under which we may disclose it to others, and how we keep it secure. It also explains your rights in relation to your personal data and how to exercise them.
We may change this Policy from time to time, so please check this page occasionally to ensure you are happy with any changes. By using our website, you are agreeing to be bound by this Policy.
Smart Associates Ltd and Smart Associates Aotearoa Ltd are the data controllers responsible for your personal data. We are incorporated in England and Wales and in New Zealand respectively.
Privacy contact / Data Protection Officer: Smart Associates’ Legal Counsel — contact us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact our Legal Counsel in the first instance. You also have the right to lodge a complaint with the relevant supervisory authority at any time:
We process personal data in accordance with the following legislation, as applicable:
Where these frameworks overlap, we apply the higher standard of protection.
We may collect and process the following categories of personal data:
Data you provide directly, for example when you contact us, request a product or service, register for a service, subscribe to our newsletter, submit a job application, or do business with us as a supplier or partner:
Data collected automatically when you visit our website:
Data from third-party sources, such as list vendors or business partners. Where we obtain data from third parties, we require them to confirm it was legally acquired and that we are entitled to use it.
UK GDPR requires us to identify a lawful basis for each processing activity. The table below sets out how and why we use your data and the basis we rely on.
| Purpose | Lawful Basis |
|---|---|
| Responding to enquiries and fulfilling service or product requests | Contract — processing is necessary to take steps at your request prior to entering a contract, or to perform a contract with you |
| Providing technical support | Contract — necessary to perform our agreement with you |
| Sending marketing emails and newsletters (where you have opted in) | Consent — you have given clear consent by subscribing |
| Improving and personalising our website | Legitimate interests — to ensure our site works effectively and to improve user experience |
| Website analytics via Google Analytics | Legitimate interests — to understand how our site is used and improve it; we have assessed that this does not override your rights (see Cookies section) |
| Complying with legal obligations | Legal obligation — where required by law |
| Protecting our rights and property | Legitimate interests — to protect Smart Associates, our clients, and our business partners from fraud or unlawful activity |
| Recruitment | Legitimate interests — to assess your application and consider you for current or future roles |
We will never use your personal data for purposes that are incompatible with those listed above without first notifying you and, where required, obtaining your consent.
Where you have opted in to receive marketing communications from us, we may use your contact details to send you updates, news, and information about our products and services.
You may withdraw your consent and unsubscribe at any time by:
We will action unsubscribe requests promptly and within no more than 5 working days. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.
We do not sell, rent, or lease your personal data to third parties for their own marketing purposes.
A cookie is a small text file placed on your device when you visit a website. Cookies help websites function correctly, remember your preferences, and collect analytics information.
We use the following categories of cookies on this site:
Google Analytics is configured on our site to anonymise IP addresses before transmission. You can opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on.
Most browsers allow you to control cookies through their settings. You can set your browser to notify you before accepting cookies or to refuse them entirely. Please note that disabling cookies may affect the functionality of some parts of our site.
For more information about managing cookies, visit aboutcookies.org or allaboutcookies.org.
Some pages on our site and some of our emails may use web beacons (also known as pixel tags) to track whether pages have been viewed or emails opened. These typically work in conjunction with cookies. If you disable cookies, web beacons will still detect page visits but will not associate them with cookie-stored information.
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law.
| Data Type | Retention Period |
|---|---|
| Enquiry and contact data | 3 years from last contact |
| Customer and contract data | 7 years from end of contract (to comply with legal and tax obligations) |
| Marketing consent records | Until consent is withdrawn, plus 1 year |
| Job application data | 6 months from conclusion of recruitment process, unless you ask us to retain it for future consideration |
| Website analytics data | 26 months (Google Analytics default) |
| Technical support interaction records | 3 years from date of interaction |
When data is no longer required, we will delete or anonymise it securely.
We may share your personal data with:
We do not sell or lease personal data to third parties.
Smart Associates operates internationally and your personal data may be transferred to, and processed in, countries outside the UK. In particular:
Where transfers occur to countries without a UK adequacy decision, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO.
Under UK GDPR, you have the following rights in relation to your personal data:
To exercise any of these rights, please contact Smart Associates’ Legal Counsel via our contact page. We will respond within one calendar month. There is no charge for exercising your rights, though we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.
If you are located in New Zealand, you also have rights under the Privacy Act 2020, including the right to request access to and correction of information we hold about you. Requests can be directed to the same contact above.
We implement reasonable physical, administrative, and technical safeguards to protect your personal data from unauthorised access, use, disclosure, alteration, or destruction. We also require our suppliers and processors to maintain equivalent standards.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the risk is high.
Our website is not directed at children under the age of 13, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us and we will delete it promptly.
Our website may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit. Smart Associates is not responsible for the privacy practices or content of those sites.
Where we provide forums, blogs, or other social computing tools, any content you post publicly is not subject to this Privacy Policy — it is subject to the terms of use of the relevant platform. Please be aware that content posted in public areas may be broadly visible.
If you submit a job application or CV to us, we will use that information to assess your suitability for the role or future positions. Unless you ask us not to, we may retain your information for future consideration. Application data is handled in accordance with the retention periods above.
Our website is accessible globally and we welcome enquiries and clients from all countries. This section explains how data protection applies to users located outside the UK and New Zealand.
Because Smart Associates Ltd is incorporated in the UK, UK GDPR applies to all personal data we process, regardless of where you are located. This means that individuals based in the United States, or any other country, benefit from the same rights and protections described in this Policy as UK-based individuals — including the right to access, correct, and request deletion of your data.
We do not sell or lease personal data to third parties. This is relevant to US-based users in particular, as the right to opt out of the sale of personal data is a central feature of US state privacy laws such as the California Consumer Privacy Act (CCPA).
If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know what personal data we collect, the right to delete it, and the right to opt out of its sale. As noted above, we do not sell personal data. To exercise any rights under CCPA, please use the same contact details as for UK GDPR requests — we will honour requests from California residents in the same manner.
Users in other jurisdictions may have rights under their own local data protection or privacy laws in addition to the protections provided under UK GDPR. We will endeavour to respect applicable local requirements where we are aware of them. If you have a question about how your local laws interact with this Policy, please contact us and we will do our best to assist.
Regardless of your location, you can exercise any of the rights listed in the Your Rights section of this Policy by contacting Smart Associates’ Legal Counsel via our contact page. We do not require you to demonstrate residency in any particular country in order to respond to a data request.
We may update this Policy from time to time. The effective date at the top of the page will reflect the most recent revision. We recommend checking this page periodically. Continued use of our website following any changes constitutes acceptance of the updated Policy.
For any privacy-related questions, please contact us.
If you have any questions about how we handle your personal information, please do not hesitate to get in touch.