If you've been sent a link to your information

If an organisation has sent you a link to information about yourself

Last updated: 19 August 2026

You are probably here because you received an email containing a secure link to download information about you, and you searched for "Smartbox" to find out who we are. This page explains what our part in it is, and — more importantly — who to talk to.

The short version

An organisation — a council, an NHS trust, a school, a police force, an employer or a company — has prepared information about you and sent you a link to collect it. That organisation holds your information and decides everything about it. Smartbox makes the software they used to prepare and deliver it. We act only on their instructions and never for our own purposes.

That means Smartbox cannot tell you what is in your file, cannot explain why something has been blacked out, cannot change or delete anything, and cannot decide what you are asked for. Those are all questions for the organisation that wrote to you. This is not us avoiding you: the law only allows us to act on that organisation's instructions, which is also what stops anyone else phoning us and having your information handed over.

Working out who to contact

The organisation's name will be in the email or covering letter that sent you here, usually with a reference number — quote it. If it isn't obvious, think about who you recently asked for your information, or who you have been dealing with or complained to.

Then look that organisation up yourself, using a search engine or their own website, rather than replying to a message you are unsure about. Most councils, NHS trusts, schools and larger companies have an information governance or data protection team, and that is the team who should answer you.

Is this genuine, or a scam?

A fair question, and worth checking. Two things are true of every disclosure sent through our software:

• You are never asked to register, create an account or set a password. The link is all you need.
• You are never asked to pay for access to your own information.

If anything asks you for a password, card details, a payment or your bank account in order to open a download, stop, and contact the organisation directly on contact details you have found for yourself.

Why am I being asked for a photograph of my passport?

Being asked to photograph an identity document can feel intrusive, and it is reasonable to question it. The organisation decides whether to ask for identification and what form it should take — that decision is not ours, and they should be able to explain it. If you would rather prove who you are another way, ask them; they may have alternatives. If you would rather not provide it at all, tell them — but be aware that if they cannot satisfy themselves who you are, they may decide they cannot release the information. That is their decision to make and explain, and Smartbox cannot set it aside.

About your link

Your link is unique to you and cannot be guessed. It works once, and it stops working after a set time — 30 days by default, though the organisation that sent it can choose a different period.

Anyone holding the link can open it, so treat the email like a key: don't forward it, and if you think someone else has seen it, tell the organisation.

If your link has expired or won't open, go back to the organisation that sent it. They can issue a fresh one. Smartbox cannot reopen a link or send you a new one.

What happens afterwards

When a link expires, access closes — but the organisation keeps the copy it prepared for you, as its record that it answered you. How long that is kept is set by the organisation, not by Smartbox. We do nothing with it beyond making it available to them to review, keep or delete.

What Smartbox does with it in the meantime

Some organisations run Smartbox on systems we operate for them. Others run the same software entirely on their own infrastructure, where the environment is theirs and we have no access to it at all. Only the organisation that contacted you can tell you which applies — but in either case, the answers below are the floor, not the ceiling.

Where we operate the system for the organisation:

• The information stays in the United Kingdom. We do not transfer it abroad, and everyone who supports the system is UK-based.
• No member of our staff has standing access to it. Our Chief Technology Officer has access. Support staff can be granted access only when the organisation actively approves it for that occasion. Every access is recorded.
• Nothing else receives it. It stays inside Smartbox's own environment, which runs on data-centre services from Amazon Web Services and Microsoft Azure. There are no advertisers, analytics companies or data brokers involved, and it is never used to train software models or sold to anyone.

Where the organisation runs Smartbox on its own infrastructure, we hold nothing at all — the software runs in their environment, and they are the only ones who can tell you how it is looked after.

Your rights

You have rights over information about you — to get a copy of it, to have mistakes corrected, to ask for it to be deleted, and to object to how it is used. These rights have limits, but an organisation must explain its reasons.

Use them with the organisation that sent you the link. Asking for a copy of your information is called a subject access request; it is free, and they normally have one month to reply. If you need the formal terms when you write, they are the "controller" of your information and Smartbox is their "processor" — quoting that can help your message reach the right team.

If you want to complain

Raise it with the organisation first, as most concerns are resolved that way. If you are unhappy with how they have handled it, you can complain to the Information Commissioner's Office, the UK's independent data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You can also raise a concern with them about Smartbox, if it is about the way the system itself works rather than about the information you were sent.

About us

Smartbox.ai is a service of Gravicus Technologies Limited. Questions about this page can be sent to legal@smartbox.ai — but please note we cannot answer questions about your information, your link or your file, and will only be able to point you back to the organisation that contacted you.

If you want our wider position as a company, including how we handle enquiries made through this website, see our privacy notice. It is not about the information an organisation has sent you.