Privacy Policy

Last updated: 1 October 2026

This policy explains what personal information Smart Start IT collects through smartstartit.co.uk and in the course of our business, why we use it, who we share it with, and the rights you have over it. If something here is unclear, email privacy@smartstartit.co.uk and a person will answer.

1. Who we are

Smart Start IT Ltd is a company registered in England and Wales (company number 15622995). Our registered office is 46 Picton Street, Montpelier, Bristol BS6 5QA, United Kingdom.

For the information described in this policy, Smart Start IT Ltd is the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We have not appointed a Data Protection Officer because the law does not require one for a business of our size and type. Our director is responsible for data protection and can be reached at the contact details in section 12.

2. When we act for our clients

When we manage IT systems for a client (for example their Microsoft 365 tenant, devices or email), we may be able to see their staff and customer data. In that work the client is the controller and we are their processor: we only handle that data on their written instructions, under a data processing agreement in our service contract. If you are a member of a client's staff and have a question about your data, please contact your employer first. We will help them answer it.

3. What we collect

Information you give us

• Your name, job title, business name, email address and phone number when you email, call, WhatsApp or message us.
• Anything you choose to include in that message.
• A domain name you enter into our free email security check.
• Billing and contract details if you become a client.

Information collected automatically

• Technical data, such as IP address, browser, device type and the pages you request. Our hosting and security providers log this to keep the site running and protected.
• Analytics data, but only if you accept analytics cookies: pages viewed, time on page, approximate location (town or country), how you arrived and, through Microsoft Clarity, a record of clicks, scrolls and mouse movements on our pages. Clarity masks text you type and other sensitive content by default.

We do not knowingly collect special category data (such as health or religious beliefs). Our services are aimed at businesses, not children.

4. Why we use it and our lawful basis

• To answer your enquiry and quote for work. Basis: our legitimate interest in responding to people who contact us, or taking steps at your request before entering a contract.
• To deliver services to clients, invoice and support them. Basis: performance of a contract.
• To run the free email security check. Basis: our legitimate interest in providing the tool you asked to use.
• To measure and improve the website using analytics. Basis: your consent, given through our cookie banner. You can withdraw it at any time.
• To keep the website and our systems secure, including backing up our email and files. Basis: our legitimate interest in protecting our business and the people we deal with.
• To keep accounts and meet tax, legal and regulatory obligations. Basis: legal obligation.

We don't currently send marketing emails or newsletters. If we start, we'll only email business contacts where the law allows it, every email will have an unsubscribe link, and we'll update this policy first.

Where we rely on legitimate interests, we have balanced them against your rights and you can object (see section 9). We do not make decisions about you based solely on automated processing.

5. Who we share it with

We never sell personal information. We share it only with service providers who help us run the business, under contracts that require them to protect it:

• Microsoft: Microsoft 365 for our email, calendar and file storage, and Microsoft Clarity for website analytics (only with your consent).
• DropSuite: independent backup of our Microsoft 365 email and files, so we can recover them if something goes wrong.
• Intuit QuickBooks: our accounting software, for invoices and financial records.
• Adfin: invoicing and collecting payments from clients.
• Hostinger: website hosting.
• Cloudflare: website security, bot protection (Turnstile), content delivery and cookie-free performance measurement.
• Google: Google Analytics (only with your consent), Google Fonts and the embedded Google Map.
• EasyDMARC: powers our free email security check. The domain you enter is sent to EasyDMARC to run the lookup.
• WhatsApp (Meta): if you choose to message us on WhatsApp.

We may also share information with professional advisers (such as our accountant or solicitor) where necessary, and with authorities where the law requires it.

6. International transfers

Some of these providers (including Microsoft, Google, Intuit, Cloudflare and Meta) may process data outside the UK, mainly in the United States and the European Economic Area. Where they do, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies) or by the ICO's International Data Transfer Agreement or Addendum.

7. How long we keep it

• Enquiries that don't become work: up to 24 months after our last contact, then deleted.
• Client records: for the length of the contract plus 6 years, for tax and legal evidence.
• Backups: copies held by DropSuite follow the same periods and are removed when the original is deleted and the backup retention period ends.
• Analytics: Google Analytics data is kept for 14 months. Microsoft Clarity recordings are kept for up to 30 days, with summary data for up to 13 months.
• Server and security logs: typically 30 to 90 days.

8. How we keep it safe

We practise what we sell: multi-factor authentication and Conditional Access on our own systems, separate admin accounts, encryption in transit (HTTPS/TLS) and at rest where available, prompt updates, and a documented incident response plan. We hold Cyber Essentials certification. If a breach puts your information at risk, we will tell you and the ICO where the law requires it.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you (a subject access request);
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict how we use it in certain circumstances;
• object to processing based on legitimate interests, and to direct marketing at any time;
• data portability: receive data you gave us in a machine-readable format;
• withdraw consent at any time where we rely on it, for example by changing your cookie preferences.

To use any of these rights, email privacy@smartstartit.co.uk. We may ask you to confirm your identity. We will respond within one month, and tell you if we need longer for a complex request. There is normally no charge.

10. Cookies

We use strictly necessary cookies to run the site and, only if you agree, analytics cookies from Google Analytics and Microsoft Clarity. You choose through the banner on your first visit and can change your mind at any time using Cookie settings in the footer. Full details are in our Cookie Policy.

11. Complaints

If you're unhappy with how we've handled your information, please tell us first at privacy@smartstartit.co.uk. We will acknowledge your complaint within 30 days and tell you what we're doing about it.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

12. Contact us

Smart Start IT Ltd
46 Picton Street, Montpelier, Bristol BS6 5QA, United Kingdom
Data protection: privacy@smartstartit.co.uk
General enquiries: hello@smartstartit.co.uk
Phone: 0117 454 8542
Company number: 15622995

13. Changes to this policy

We review this policy at least once a year and whenever we change how we handle personal information. The date at the top shows the latest version. If a change significantly affects you, we will tell you directly where we can.