Legal
Privacy notice
Last updated:
In short
Smartbox.ai is a British software company. Organisations — councils, NHS trusts, police forces, schools, universities, law firms and businesses — use our software to find, redact and disclose information. This notice explains what we do with personal information, and it covers two quite different things.
Information we hold to run our own business. If you fill in the form on this website, deal with us as a client, partner or supplier, write to us as a journalist, apply for a job, or come to one of our events, we decide what happens to your information. In law we are the controller for it. This notice tells you what we hold, why we hold it, who else sees it and what you can ask us to do about it.
Information our clients put into our software. Everything a client loads into Smartbox — the documents, the people named in them, the disclosures made from them — belongs to that client. We hold and handle it only on their documented instructions, and never for our own purposes. In law we are their processor. Section 4 sets that position out in full, and it is the section written for anyone assessing us as a supplier.
The website itself is deliberately plain. There is one form on it, and what you type into it is emailed to our sales inbox. There is no account, no login, no file upload, no database behind the site, and no third-party lead-handling service in between. Nothing that measures or tracks you loads unless you press Accept on the cookie banner.
If you want to know what we hold about you, or want it corrected or deleted, email legal@smartbox.ai. It costs nothing, and we answer within one month. If we get it wrong, you can complain to the Information Commissioner's Office — section 18 tells you how.
Has an organisation sent you a secure link to download documents?
Then the organisation named in that email — the council, trust, force, school, employer or firm — is the one in charge of your information. They decide what is in the disclosure, what has been blacked out, whether you were asked to prove who you are, and what is kept afterwards. They are the people to ask, and they have to answer you. We provide the software they used. We cannot open, extend, change or delete anything in their system on our own initiative. We have written a short page for you, which answers the questions people in that position usually have. Section 4.8 explains what it means for us, and the things we can help with.
1. Who we are, and how to contact us
Smartbox.ai is a service of Gravicus Technologies Limited, a privately held company registered in England and Wales, company number 17012811. In this notice, "Smartbox.ai", "we", "us" and "our" mean Gravicus Technologies Limited.
Gravicus Technologies Limited is the controller for the information described in sections 5 to 12, and the processor for the client material described in section 4.
- Anything about your personal information — a question, a request, or a complaint:
legal@smartbox.ai - By post: Dawson House, 5 Jewry Street, London EC3N 2EX (our office — please write here rather than to the registered office, so post reaches the right people)
- Registered office: 166 College Road, Harrow, Middlesex HA1 1RA
- By telephone: +44 (0)20 3858 0636
- General enquiries and sales:
info@smartbox.ai
Mail to legal@smartbox.ai reaches the people accountable for data protection here. Please use that address rather than a general one if your message is about your own information, so that it is recognised for what it is and dealt with on time.
2. What this notice covers, and what it does not
It covers this website at smartbox.ai, the enquiries, calls and emails that follow from it, and our dealings with the people at our client organisations, our partners, our suppliers, journalists, job applicants and people who come to our events. It also sets out, in section 4, our role and our limits in relation to the material our clients process in the Smartbox platform.
It does not cover:
- What is inside a client's own Smartbox system. The client organisation is the controller for that material and its own privacy information applies to it. Our role there — and it is a real one, with real duties — is set out in section 4.
- Other websites we link to. If you follow a link to LinkedIn, X, YouTube, Instagram, a partner's site or a client's site, that organisation's own privacy information applies. Please read it before giving them anything.
- People who work for us. If you work for us, what we do with your information is explained to you separately. It does not belong on a public page.
Our use of cookies and other browser storage is summarised in section 5.5 and set out in full in our cookie policy, which is separate because it has to be re-issued whenever we switch a tag on or off.
3. Our two roles
Which hat we are wearing decides who is accountable for what, so we state it plainly rather than leaving it to be inferred.
| Information | Controller | Processor |
|---|---|---|
| Enquiries sent through this website, and the exchange that follows | Us | — |
| Contact records for the people we deal with at client, partner and supplier organisations | Us | — |
| Contracts, purchase orders, invoices and payment records | Us | — |
| Records of the platform accounts we set up for a client's users, and support correspondence | Us | — |
| Job applications, press correspondence, event registrations | Us | — |
| Documents and files a client loads into the Smartbox platform | The client | Us |
| Personal information found, extracted or indexed from those files | The client | Us |
| Redaction decisions, approvals and disclosures the client's team makes | The client | Us |
| The platform's record of actions taken on the client's matters | The client | Us |
Holding a client's material — storing it, indexing it, making it available to their team — is processing under Article 4(2) of the UK GDPR. We are a processor doing it. What is true, and stronger, is that we only ever do it on the client's documented instructions and never for our own purposes.
One boundary is genuinely blurred, and we would rather state where we have drawn it than be asked. A line in the platform's audit record reading "this named user redacted this document at 14:02" is both personal information about a client's employee and a record generated by the service we run for that client. We treat records the platform generates about work done on a client's matters as the client's material, processed on their instructions. We treat the records we keep to run our own business — who our contacts are, what was invoiced, what a support ticket said — as ours, and we are the controller for those. If a client takes a different view, it can record that in its instructions to us.
4. Client material in the platform: our position as a processor
This section is written for the person doing due diligence on us, and it is deliberately specific. It is a statement of our position. The binding detail for any particular client is in that client's agreement with us.
4.1 Who decides what
The client organisation decides what goes into Smartbox, why, what is disclosed, what is redacted, who at that organisation can see it, and how long it is kept. It is the controller. We are its processor, and we carry the duties Article 28 of the UK GDPR places on a processor.
4.2 We act only on documented instructions
We process a client's material only on that client's documented instructions — the agreement between us, the data protection terms that go with it, and the configuration choices the client's own administrators make in the platform. We do not use it to build features, to benchmark, to market, or for any purpose of our own. If we were ever required by law to do something with it that the client had not instructed, we would tell the client first unless the law forbade us from doing so. If we think an instruction breaks data protection law, we say so.
4.3 Who at Smartbox can reach client material
Nobody at Smartbox has standing access to a client's material. Our Chief Technology Officer holds access. Anyone else — including support and engineering staff — can be given access only when the client actively approves it for that occasion. Every access is recorded. All of our support access is from the United Kingdom.
That is a position a client can hold us to, and check against the access records.
4.4 We do not train models on client material
We do not use client material to train machine-learning models — not ours, and not anybody else's. What a client puts into Smartbox is used to do that client's work, and nothing else. Nothing another client has loaded has trained the software that reads your files.
4.5 Who else is involved
Client material stays inside the environment we operate. That environment runs on infrastructure from two providers:
- Amazon Web Services — compute, storage and network.
- Microsoft Azure — compute, storage and network.
That is the whole list. No analytics provider, no third-party machine-learning service, no data broker, no marketing tool and no outsourced processing operation receives client material. That is the complete list, not a summary of a longer one.
If we ever needed to add another provider, that is a change to how we process a client's material and it belongs in the notification route their agreement sets out, not in a quiet edit to this page.
4.6 Where client material is held
We host client material in the United Kingdom. We do not transfer it out of the United Kingdom, and the support access described in 4.3 is from the United Kingdom.
Some clients run Smartbox inside their own cloud organisation instead. Where that is the arrangement, the environment belongs to that client and we do not operate it.
4.7 How long client material is kept
The client decides, not us. We do nothing to that material beyond holding it and making it available for the client's own team to review, to accept or reject, and to delete. We do not apply a retention period of our own to it, and we do not delete, alter or move it on our own initiative.
4.8 If your information is in a client's Smartbox system
If an organisation has used Smartbox to send you documents, or your information appears in a disclosure it has made, this is what you need to know.
Ask the organisation that contacted you. Every question about why a disclosure was made, what is in it, why something has been blacked out, why you were asked to prove who you are, and how long anything is kept, is a question for them. Their name is on the email you received. They have to answer, normally within one month, and it is free.
We cannot act on our own initiative. We cannot release, correct or delete anything in an organisation's system unless that organisation instructs us to. That is not us avoiding you — it is what being a processor means, and it protects you, because it also means nobody can contact us and have someone else's disclosure handed over or destroyed. If you write to us anyway, we will tell you who to go to.
About the link. When a disclosure is ready, the system sends a link that is unique, single-use and cannot be guessed. You do not need an account, a password or a payment of any kind to use it, and you never will. If a message asks you for a password, a payment or bank details in connection with a download, do not use it — go back to the organisation that wrote to you and check.
How long the link lasts. The organisation that sent it sets how long it works for; if they have not changed it, that is 30 days. After that the link stops working. If yours has expired, ask them to issue a new one — a fresh disclosure of the same material comes with a new link.
Why something remains after the link stops working. When the link expires, access through it is removed, but the disclosure itself is kept under that organisation's retention settings, as evidence that the disclosure was made and of what was in it. That is deliberate, it is their record rather than ours, and their settings decide how long it lasts.
If you are asked to upload identification. Being asked to photograph a passport or another document can feel intrusive, and it is a fair thing to question. What is asked for, and whether it is asked for at all, is the organisation's decision, not ours. They should be able to explain why, and they may accept another way of confirming who you are.
Your rights and your complaint route. Exercise your rights with the organisation that holds the information. If you are unhappy with how they have handled it, you can complain to the Information Commissioner's Office — the details are in section 18. You can complain to the ICO about us as well, if your concern is about the way we run the service rather than about the disclosure itself.
4.9 Security of client material
Our clients work with some of the most sensitive material there is, and the platform is built accordingly. The controls that apply to client material include:
- Single sign-on and enforced multi-factor authentication.
- Role-based access, so a user sees only what their role and their matter allow, with information barriers between matters.
- Encryption in transit and at rest.
- An antivirus scan of every file when it arrives, so a reviewer never opens an infected attachment.
- A fingerprint taken of every file when it arrives, and a record of every action taken on it afterwards.
No system is completely secure and we will not pretend otherwise, but we keep these measures under review and we would rather describe what we do than reach for a slogan.
4.10 If something goes wrong
If there is a personal data breach affecting a client's material, we tell that client without undue delay after we become aware of it, and we give them what they need to make their own report to the Information Commissioner's Office and, where the law requires it, to the people affected. Under data protection law those reports are the controller's to make, not ours. We help.
4.11 What is in the agreement rather than here
A privacy notice is not a contract, and we are not going to describe your contract to you on a public page. What we have agreed with each client — the documented instructions, how we assist with requests from individuals and with impact assessments, how audits and inspections work, notice periods, and what happens to the material at the end of the service — is in that client's agreement with us and in the data protection terms attached to it. That agreement governs. Your account contact will supply a copy of anything you need for your own records, and we will help with a data protection impact assessment or a question from your regulator so far as the information is ours to give.
5. If you use this website
5.1 The one form on the site
The demo and contact form appears on two pages — Book a demo and Contact. It is the only place on this website where you can send us anything.
| What we ask for | Required |
|---|---|
| Your name | Yes |
| Your work email address | Yes |
| Your company or organisation | Yes |
| The sector you work in — legal, healthcare, local government, education, police and central government, commercial, or other | Yes |
| Your country | Yes |
| A message — how we can help | No |
Nobody has to fill it in. There is no legal or contractual requirement to give us anything. Email info@smartbox.ai or telephone us instead if you prefer. The only consequence of not giving us a way to reply is that we cannot reply.
Please do not put anything sensitive in the message box. It is free text and it ends up in an ordinary email inbox. Do not send us health information, details of criminal matters, or anyone else's personal details. If you do tell us about another person, please be sure you are entitled to.
There is no file upload anywhere on this website. If you are trying to send documents to an organisation that uses our software, this is the wrong place — go back to the link they sent you.
5.2 What happens after you press send
- What you typed goes to a small program we wrote and run ourselves, on Amazon Web Services.
- That program emails it to our sales inbox. The email is the record. It is not put into a database, a customer relationship system or any third-party marketing tool — there is no database behind this website at all.
- When someone here presses reply, the reply goes to the address you gave us.
- Alongside what you typed, the email carries the page you were on when you submitted, and any campaign codes from the link you arrived by (see 5.5).
If the form cannot reach that program, your browser opens a pre-addressed email to info@smartbox.ai instead. Nothing is sent until you press send in your own email program.
5.3 The checks that keep the form usable
Two automated checks run on every submission. Both are aimed at software, not at you, but both involve information about how the page was used, so we tell you about them.
- A hidden field. There is a field on the form that people cannot see and cannot reach with the Tab key. Automated scripts fill it in. If it is filled in, the submission is discarded.
- A timing check. We measure how long passed between you first clicking into the form and pressing send. Anything completed in under two and a half seconds is discarded.
If a submission is discarded, nothing you typed is emailed to us and nothing you typed is recorded. We record that a submission was rejected and, for the timing check, how many milliseconds it took. Nothing else.
The page still says thank you, because telling automated software which check it tripped only helps it get past that check next time. That does mean a genuine submission could be discarded without you knowing. If you are expecting a reply and have not had one, email info@smartbox.ai or telephone us — we will pick it up that way.
5.4 What our systems record
- For a submission that reaches us, we write one short line to our own operational log: the company, sector and country you gave, and the campaign source if you arrived from a tagged link. It does not contain your name, your email address or your message. We use it to see that the form is working and how many enquiries are arriving. Company, sector and country together can point to a person in a small market, so we treat that line as personal information.
- If the email fails to send, we record the error and the company name, so that we can chase the enquiry we would otherwise have lost.
- The program that receives the form does not record your IP address. Like any website, the hosting service must see the network address your browser connects from in order to send you a page.
5.5 Cookies and browser storage
The detail is in our cookie policy. In summary:
Nothing that measures or tracks you loads before you choose. When you first arrive you see a banner offering Decline and Accept. No analytics or advertising script loads until you press Accept. If you decline, or ignore the banner, none of them ever loads. Whichever providers are switched on are named there.
The record of your choice is stored in your browser as sbx_consent_v1. It is not a cookie in the strict sense — it is a value in your browser's local storage — but it does the same job and we treat it the same way. Without it the banner would ask you the same question on every page.
To withdraw consent, clear that value in your browser's stored site data for this site and reload the page; the banner will ask you again. If you would rather we dealt with it, email legal@smartbox.ai and we will tell you exactly what to clear. Withdrawing consent does not make anything we lawfully did beforehand unlawful — it stops us going forward.
Campaign codes. If you arrive from an advert, a campaign email or a shared link that carries tracking codes (utm_source, utm_medium, utm_campaign, utm_content, utm_term), we keep those codes and the page you landed on in your browser's session storage as sbx_utm_v1, so that if you go on to fill in the form we can see which campaign brought you to us. Nothing is stored if the link has no codes in it, and what is stored is deleted when you close the tab. These are our own campaign labels rather than anything that identifies you, which is why they are treated as necessary to the working of the site rather than put behind the banner.
Two short-lived values when you submit. sbx_demo_props holds your sector, your country, which of the two forms you used and a random one-time reference; the thank-you page reads it once, uses it to count the enquiry and deletes it. sbx_demo_conv_fired stops the same enquiry being counted twice if you reload. Both disappear when you close the tab, and the random reference is not linked to your name.
5.6 If we contacted you first
If we emailed or telephoned you and you had not been in touch with us, your details did not come from this website. Where we obtain someone's details from a source other than themselves, the law requires us to say where they came from and what we hold. We will tell you that in our first message to you, or within a month of getting them if that comes first, and you can tell us to stop at any time — see section 17. Any marketing email we send you will include a way to unsubscribe, and we act on it.
6. If you work for a client organisation
This section is about you personally, as a named person at a client. What your organisation puts into the platform is dealt with in section 4.
What we hold: your name, job title, work email address and telephone number, and the organisation you work for; the platform account set up for you, the role it carries and when it was created or removed; support tickets and correspondence with you; and contract, purchase-order and invoice records that name you as a contact, signatory or approver. Records the platform generates about work done on your organisation's matters are your organisation's, not ours — see section 3.
Where it comes from: usually from your employer rather than from you, for example when your organisation nominates a billing contact or an administrator creates your account. Where we receive your details from someone other than you, we will tell you where they came from — in our first message to you, or within a month of receiving them if that comes first. This notice is part of how we meet that obligation.
Service messages. While your account is live we will send you messages about the service itself — outages, planned maintenance, security notices, changes to terms. Those are not marketing and you cannot opt out of them, because you need them in order to use the service safely. Marketing is a separate thing and you can stop it at any time.
7. If you are a partner or reseller
This section covers the people we deal with at partner and reseller organisations, and partners who are individuals in their own right.
What we hold: your name, job title, work contact details and the organisation you work for; records of our dealings with you, including registered opportunities, training and enablement records, meeting notes and correspondence. If you contract with us as an individual — as a sole trader, or as a member of an LLP — we also hold your payment details and your invoice and payment history, because in that case the business records are also personal information about you.
Introductions in both directions. A reseller or referral relationship can mean contact details move between our two organisations. Where that happens, each of us decides for itself what to do with what it receives, and each of us is separately responsible for it. If you send us information about somebody else — a colleague, or a contact at one of your customers — please be sure you are entitled to, and that they know it is coming to us.
We do not sell your details and we do not pass them to anyone for their own marketing.
8. If you apply for a job with us
Live roles are advertised on our LinkedIn page, and speculative applications come to careers@smartbox.ai.
What we hold is whatever is in your CV, your covering note and our correspondence with you — normally your name, contact details, employment history, education and qualifications. If we make you an offer, the law requires us to check your right to work in the UK before you start.
CVs often carry more than that: people include date of birth, nationality, a photograph, health information, caring responsibilities, or membership of a professional, religious or political body. We do not ask for any of it, and we do not take it into account. If you would rather we did not hold it, say so and we will remove it from what we keep.
You do not have to give us anything. Applying is your choice. But if you do not give us contact details and something to assess, we cannot consider you.
If you are offered a role and accept it, your application becomes part of your employment record, and what we explain to staff about their own information applies from then on.
9. Suppliers, journalists, events and webinars
If you supply us with goods or services, we hold the names, job titles and work contact details of the people we deal with at your organisation, our correspondence with you, and records of what was ordered, delivered, invoiced and paid. If you trade as a sole trader or through a partnership, we may also hold your payment and bank details, because those business records are also personal information about you.
If you contact us as a journalist, at press@smartbox.ai or otherwise, we hold your name, your publication, your contact details and our correspondence with you, so that we can answer you and keep in touch about the things you cover. Tell us to stop at any time and we will.
If you register for an event or a webinar, we process your name, contact details and job title, so that we can let you in, send you the joining details and any follow-up materials you asked for, and answer your questions. If we record a webinar or an online meeting, we will tell you before the recording starts. If an event has a sponsor or a co-host who would like your details, we will ask you at the point of registration and will not pass them on unless you say yes; from that point the sponsor decides for itself what it does with them, and is responsible for it.
Where we use third-party software to run a webinar or an online meeting, that provider handles your registration and attendance details in order to run the event for us. If you also hold your own account with that provider, what the provider does with that account is covered by its own privacy information, not by this notice.
There is no newsletter signup on this website — the demo and contact form is the only form on it. If you do receive email from us, every message will tell you how to stop it, and you can also just reply and ask.
10. Why we use information, and the legal grounds we rely on
Every organisation needs a legal ground to use personal information. These are ours. Where the ground is legitimate interests, the interest is set out rather than left as a label, and you can object — see section 17.
| What we do | Legal ground, and the interest where that is the ground |
|---|---|
| Serve you this website when your browser asks for a page | Legitimate interests — running a public website, which cannot be done without the hosting service seeing the network address to send the page back to |
| Read and answer an enquiry, and arrange or run a demo | Legitimate interests — you asked us a question and we want to answer it, and a business cannot answer enquiries without holding the contact details of the person who sent them. Also steps taken at your request before a contract, where you are asking about buying |
| Keep the enquiry and the exchange that follows in our sales inbox | Legitimate interests — so that when you come back to us, or query what was said, we can find the thread instead of asking you to repeat yourself |
| Run the checks in 5.3 and keep the short log line in 5.4 | Legitimate interests — keeping a public form free of automated abuse so that real enquiries reach a person, and knowing the form is working |
| Contact an organisation we believe may want what we sell | Legitimate interests — business development in a market where buying decisions are made by named people in named roles |
| Load analytics or advertising scripts | Consent, given through the cookie banner and withdrawable at any time |
| Negotiate and run the contract with a client, partner or supplier organisation, including managing platform accounts and support | Legitimate interests — running the agreement we have with your employer, and knowing who is using a service we are responsible for. Performance of a contract, where you contract with us as an individual |
| Send service messages about outages, maintenance, security and changes to terms | Legitimate interests — you need this to use the service safely |
| Tell you about our products, events and webinars | Legitimate interests — telling people who already deal with us about things closely related to what they already have. Consent where the law requires it |
| Take payment, chase invoices and keep accounting records | Performance of a contract, and legal obligation for the records tax and company law require us to keep |
| Consider your job application, shortlist, interview and decide | Steps taken at your request before a contract. Legitimate interests in keeping a record of how the decision was made, in case it is questioned |
| Check right to work in the UK before someone starts | Legal obligation |
| Run an event or webinar you registered for | Legitimate interests — putting on the event you asked to come to, and steps taken at your request where you registered for a specific one |
| Answer a press enquiry | Legitimate interests — responding to the media about our own business |
| Keep records we are required to keep, and respond to lawful requests from a regulator, a court or the police | Legal obligation |
| Establish, exercise or defend a legal claim | Legitimate interests — being able to show what was agreed and what happened |
Our role in relation to client material in the platform is not a controller role at all, so it does not appear in this table. The lawful basis for that processing is the client's to determine, as section 4 explains.
11. Who we share information with
We do not sell personal information, and we do not share it with anyone for their own marketing. We do not give any organisation below personal information for its own purposes.
| Who | What reaches them, and why |
|---|---|
| Amazon Web Services | This website is hosted there. The program that receives the form runs there, and its logs sit there. The enquiry email is delivered through their email service. They also provide infrastructure for the Smartbox platform |
| Microsoft Azure | Infrastructure for the Smartbox platform |
| The provider that hosts our email and business software | Your enquiry, and our correspondence with you, because that is where our mailboxes and documents live |
| Analytics and advertising providers | Measurement information, and only if you press Accept on the cookie banner. Whichever providers are switched on are named in our cookie policy |
| Our professional advisers — lawyers, accountants, auditors, insurers | Only what is relevant to a particular matter, and only when it is needed |
| Our bank and payment providers | Payment and invoice records, so that we can pay and be paid |
| Regulators, courts and law enforcement | Only what we are legally required or lawfully permitted to disclose |
There is no lead-handling company in the middle. We deliberately did not put a third-party form service, a marketing automation platform or an outsourced enquiry handler in front of this website's form. It posts to a program we wrote and run ourselves, and that program stores nothing.
If our business, or part of it, is ever sold or reorganised, information may transfer with it. It would go on being handled in line with this notice unless we told you otherwise.
12. How long we keep information
Where the law fixes a period, we keep to it. Where it does not, we do not invent one — we keep information for as long as the purpose we collected it for lasts, and these are the criteria we apply.
| What | The criteria we use |
|---|---|
| Client material in the platform | Set by the client, not by us. See 4.7 |
| Your enquiry, and the exchange that follows it, in our sales inbox | For as long as there is a live conversation, and afterwards for as long as we might reasonably need it — because you come back to us, or because a question arises about what was said. Ask us to delete it sooner and we will, unless we have to keep it |
| The short operational log line described in 5.4 | For as long as we need it to see that the form is working and to look into problems with it |
| Contact records for people at client, partner and supplier organisations | While the relationship is live, and afterwards for as long as we might need them to deal with a query, a claim or an audit arising from it |
| Contract, invoice, payment and accounting records | For the period tax and company law require accounting records to be kept |
| Applications from people we do not take on | For as long as we might need them to explain or defend the decision. Ask us to delete yours sooner and we will |
| Speculative applications | Only while there is a realistic prospect of a role. Ask us to delete yours at any time and we will |
| Event, webinar and registration records | For the event itself and any follow-up you asked for, and no longer than we need for that |
| A record that you asked us not to contact you | Kept, because we need it in order to honour the request. It is the minimum needed to recognise you and stop |
Your cookie choice (sbx_consent_v1) |
Until you clear it, or until we change what we are asking and have to ask again |
| Campaign codes and the two values written when you submit the form | Until you close the browser tab |
At the end of a retention period we delete the information we hold electronically and securely destroy any paper record of it.
We may keep something for longer where we have to — a live dispute, an audit, or a legal obligation — and where that happens we keep only what is needed for that purpose. If you ask us to delete something and we are required to keep part of it, we will tell you which part and why.
13. Where information is held, and sending it outside the UK
Client material in the platform is held in the United Kingdom and is not transferred out of it by us. See 4.6.
This website, and the program that receives the form, run in Amazon Web Services' London region.
Our own business systems. Where any information covered by this notice is stored or accessed outside the United Kingdom, we rely on the UK's transfer rules: either the country is covered by UK adequacy regulations, or we put an approved safeguard in place — normally the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — together with checks on the protection actually available.
You can ask us which of these applies to your information and for a copy of the safeguard. Email legal@smartbox.ai.
14. Keeping information secure
We use technical and organisational measures to protect the information we hold against loss, misuse, and unauthorised access, disclosure, alteration and destruction. Security in the platform is covered in 4.9. For this website in particular:
- The site is served over an encrypted connection, and the form is sent to us over an encrypted connection.
- The program that receives the form stores nothing and can do exactly one thing: send an email to our own inbox.
- There is no database behind this website, so there is no store of enquiries to break into.
No system is completely secure. Sending information over the internet always carries some risk, and we will not tell you otherwise.
If something goes wrong. Where there is a breach of personal information we hold as controller, we report it to the Information Commissioner's Office within 72 hours of becoming aware of it where the law requires that, and we tell the people affected directly, without undue delay, where the breach is likely to put their rights and freedoms at high risk. Breaches affecting a client's material in the platform are dealt with under 4.10.
If you think you have found a security problem with this website, please tell us at legal@smartbox.ai and we will look into it.
15. Automated decisions and profiling
We do not make decisions about you by automated means alone that produce a legal effect on you, or that similarly significantly affect you.
Two things on this site are automated, and we would rather explain them than leave you to find them:
- The two checks in 5.3 discard submissions that look like they came from a script. That is not a decision about you as a person, and it has no effect beyond that one submission — you can always reach us by email or telephone instead.
- If you accept analytics, we look at aggregate patterns — which pages are read, which campaigns bring people to us. What each provider does is described in our cookie policy.
Inside the platform, our software finds and proposes redactions on a client's material. Those proposals are made for that client, and their team reviews them. What is disclosed and what is withheld is the client's decision, taken with our software; it is not a decision we make, and we do not make decisions about the people named in a client's documents.
16. Children
This website is aimed at people working in organisations that buy business software. It is not directed at children and we do not knowingly collect information about them through it. If you believe a child has given us their information here, tell us and we will delete it.
17. Your rights, and how to use them
These rights apply to information we hold about you as controller. If your question is about material an organisation holds in its own Smartbox system, see 4.8 — those rights are exercised with that organisation.
You can ask us to:
- Tell you what we hold about you and why, and give you a copy of it.
- Correct it, if it is wrong or incomplete.
- Delete it.
- Restrict what we do with it while a question about it is being sorted out.
- Give you a portable copy in a machine-readable format, or send it to someone else, where we hold it with your consent or under a contract with you and handle it by automated means.
- Withdraw your consent, where we relied on it. Withdrawing does not affect anything we lawfully did before you withdrew.
Most of these are qualified rights: in some situations the law allows us to say no — for example where giving you a copy of something would reveal another person's information. If we refuse any part of a request, we will tell you which part, why, and what you can do about it.
Your right to object
You can object at any time to our using your information where we rely on legitimate interests, including any profiling based on it. Tell us why it matters to your situation and we will stop, unless we can show compelling grounds that override your rights or we need the information for legal claims.
If you object to direct marketing, we stop. There is no balancing exercise and no argument. Ask, and it ends.
How to make a request
Email legal@smartbox.ai, or write to us at Dawson House, 5 Jewry Street, London EC3N 2EX, and tell us what you want. You do not need a special form, and you do not have to use the words "subject access request" or quote any legislation.
- It is free. We can only charge where a request is manifestly unfounded or excessive, or where you ask for further copies, and we would tell you before we did.
- We reply within one month. If your request is complex, or you have made several, we can extend that by up to two further months — and if we need to, we will tell you inside the first month and explain why.
- We may need to check who you are before handing over personal information, so we may ask for something that confirms it. We will ask for as little as possible and use it for nothing else.
- If you are asking on someone else's behalf, we will need evidence that you are entitled to.
18. Complaints
If you have any comments, concerns or complaints about our use of your information, we would ask that you contact us first, so that we can try and resolve any matter. Email legal@smartbox.ai.
If we cannot put it right, you have the right to complain to the Information Commissioner's Office, the UK's independent data protection regulator. You can complain to them whether or not you have come to us first.
Information Commissioner's Office
- Online: https://ico.org.uk/make-a-complaint/
- Email: casework@ico.org.uk
- Telephone: 0303 123 1113, or 01625 545 745
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
19. Changes to this notice
We update this page when what we do changes — in particular if we switch an analytics or advertising tag on or off, if the providers behind the service change, or if enquiries start going somewhere new. The date below tells you which version you are reading. Where a change materially affects you and we hold your contact details, we will tell you directly rather than expect you to come back and check.