Privacy Notice
1. Who we are
SmartShift Consulting operates SmartShift Central ("SSC"). Privacy and data-protection enquiries may be sent to support@smartshift.consulting.
Publication item: before commercial publication, insert the exact registered legal entity name, company number and registered office in the deployment checklist supplied with this package.
2. Laws and regulatory framework
Where applicable, we process personal information under the UK GDPR, the Data Protection Act 2018 as amended, the Data (Use and Access) Act 2025 ("DUAA"), the Privacy and Electronic Communications Regulations ("PECR"), the EU GDPR for processing within its territorial scope, and applicable US state privacy laws including the California Consumer Privacy Act ("CCPA").
3. Information we may process
- Account and identity information, such as name, work email, organisation, role and authentication records.
- Service content submitted to SSC, including prompts, uploaded documents, project knowledge, conversation content and related metadata, where a customer enables or uses those features.
- Technical and security information such as IP address, device/browser information, authentication events, audit events, error logs and service diagnostics.
- Support, contractual, billing and administrative correspondence.
- Privacy and rights-request information needed to identify, verify and respond to a request.
4. Why we process information
| Purpose | Typical UK/EU lawful basis |
|---|---|
| Provide contracted services and administer accounts | Contract; legitimate interests; and, for customer workspace content, processing on the customer's documented instructions. |
| Security, fraud prevention, service integrity and audit | Legitimate interests, recognised legitimate interests where applicable, legal obligations. |
| Support and service communications | Contract and legitimate interests. |
| Billing, accounting and legal compliance | Contract and legal obligations. |
| Improve reliability and product operations | Legitimate interests, subject to data minimisation and customer contractual controls. |
5. AI processing
SSC can submit governed prompts and permitted contextual information to configured AI providers. SSC is designed to apply privacy and governance controls before provider submission, including anonymisation controls where configured. Customer administrators control relevant organisational settings. See our AI Transparency Notice.
6. Controller and processor roles
For customer workspace content, customers normally determine why and how their users use SSC and therefore ordinarily act as controller. SmartShift Consulting ordinarily processes that content on the customer's documented instructions as processor. SmartShift Consulting acts as controller for its own corporate administration, security, billing, support and legal-compliance records.
7. Recipients and subprocessors
We use carefully selected infrastructure and service providers where necessary to operate SSC. Current categories and named providers are listed on our Subprocessor List. We do not sell personal information.
8. International transfers
Where personal information is transferred internationally, we use an applicable lawful transfer mechanism where required, such as adequacy arrangements, the UK International Data Transfer Agreement or UK Addendum, or EU Standard Contractual Clauses, together with appropriate transfer assessment and supplementary measures where required.
9. Retention
We retain information only for as long as necessary for the applicable purpose, contract, security need or legal requirement. Customer-configured retention and deletion settings apply to supported SSC content. See our Data Retention Notice.
10. Security
We apply technical and organisational measures appropriate to the risks of the processing. These include access controls, protected storage, audit logging, encryption where appropriate, environment separation, least-privilege configuration and controlled operational procedures. See Security & Data Protection.
11. Your rights
Depending on the law that applies, you may have rights to access, correct, erase, restrict or object to processing, obtain portability, withdraw consent where consent is relied upon, and complain about our processing. UK law also requires organisations to provide a data-protection complaints process. Requests and complaints can be sent to support@smartshift.consulting.
If your request concerns information held in a customer's SSC workspace, we may refer the request to that customer where the customer is the controller.
12. California privacy rights
To the extent the CCPA applies, California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses/disclosures of sensitive personal information, and not be discriminated against for exercising applicable rights. SmartShift Consulting does not sell personal information and does not use customer workspace information for cross-context behavioural advertising. See Privacy Choices.
13. Children
SmartShift Consulting and SmartShift Central are intended for business and organisational use and are not directed at children. We do not knowingly offer accounts or services directly to children through this public website. If a future SmartShift Central deployment is intended or likely to be accessed by children, that deployment must be assessed separately and appropriate age-appropriate privacy and safeguarding measures implemented before launch.
14. Changes
We may update this notice to reflect legal, technical or service changes. The current version and effective date will remain available on this page.