1. Who We Are
This privacy policy explains how Online Smarty Ltd ("we", "us", "our") collects, uses, stores, and protects personal data when you visit our website onlinesmarty.solutions or engage with our services.
For the purposes of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR, Regulation 2016/679), and the UK Data Protection Act 2018, the data controller is:
2. What Data We Collect
We may collect and process the following categories of personal data:
2.1 Information You Provide Directly
- Contact form submissions: name, email address, phone number, company name, and any message content you provide.
- Service enquiries: details about your project requirements, budget, and business needs.
- Email correspondence: the content of emails you send to us, including any attachments.
- WhatsApp messages: messages sent to us via WhatsApp, including name, phone number, and message content.
2.2 Information Collected Automatically
- Technical data: IP address, browser type and version, operating system, device type, screen resolution, and time zone setting.
- Usage data: pages visited, time spent on pages, navigation paths, referring website, and exit pages.
- Cookie data: information collected through cookies and similar tracking technologies (see our Cookie Policy for details).
2.3 Information from Third Parties
- Analytics providers: aggregated and pseudonymised data from Google Analytics about website usage.
- Security services: Cloudflare may collect technical data for the purpose of protecting our website from malicious traffic.
3. Legal Basis for Processing
We process your personal data only where we have a lawful basis to do so under Article 6 of the UK GDPR and EU GDPR. The legal bases we rely on are:
| Purpose |
Legal Basis |
| Responding to enquiries and providing quotes |
Legitimate interest (Article 6(1)(f)) -- to respond to prospective clients |
| Delivering contracted services |
Performance of a contract (Article 6(1)(b)) |
| Sending marketing communications |
Consent (Article 6(1)(a)) -- only with your explicit opt-in |
| Website analytics and improvement |
Legitimate interest (Article 6(1)(f)) -- to improve our website and services |
| Website security (Cloudflare) |
Legitimate interest (Article 6(1)(f)) -- to protect our website and users |
| Compliance with legal obligations |
Legal obligation (Article 6(1)(c)) |
4. How We Use Your Data
We use the personal data we collect for the following purposes:
- Service delivery: to provide the digital marketing, GEO, SEO, web design, AI automation, and e-commerce services you have engaged us for.
- Communication: to respond to your enquiries, provide project updates, and deliver customer support.
- Quotations and proposals: to prepare and deliver project proposals, cost estimates, and service agreements.
- Website improvement: to analyse how visitors use our website and to improve its content, functionality, and user experience.
- Security: to protect our website, systems, and users from fraud, abuse, and unauthorised access.
- Marketing: where you have provided explicit consent, to send you newsletters, service updates, and promotional materials. You may withdraw consent at any time.
- Legal compliance: to comply with applicable laws, regulations, and legal processes.
5. Data Sharing and Third Parties
We do not sell, rent, or trade your personal data to any third party. We may share your data with the following categories of recipients, solely for the purposes described in this policy:
- Cloudflare, Inc. -- content delivery network (CDN) and website security. Cloudflare processes technical data (IP addresses, request headers) to protect our website from threats and improve performance. Cloudflare Privacy Policy.
- Google LLC (Google Analytics) -- website analytics. We use Google Analytics to understand how visitors interact with our website. Data is pseudonymised and aggregated. Google Privacy Policy.
- Web3Forms -- contact form processing. Form submissions may be routed through Web3Forms for delivery. Web3Forms Privacy Policy.
- Zoho Corporation (Zoho Mail) -- email hosting. Emails sent to and from our addresses are processed by Zoho. Zoho Privacy Policy.
- Professional advisers: our accountants, lawyers, or auditors where necessary for the provision of professional services to us.
- Law enforcement or regulatory bodies: where we are required to do so by law or in response to a valid legal request.
6. International Data Transfers
Some of the third-party service providers listed above are based outside the United Kingdom and the European Economic Area (EEA). When your data is transferred internationally, we ensure that appropriate safeguards are in place, including:
- Adequacy decisions: transfers to countries that the UK Government or European Commission has determined provide an adequate level of data protection.
- Standard Contractual Clauses (SCCs): where no adequacy decision exists, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Agreement/Addendum) to ensure your data is protected.
- Supplementary measures: where required, additional technical and organisational measures are applied, such as encryption in transit and at rest.
Specifically, Cloudflare operates a global CDN with data centres in multiple countries. Cloudflare has certified under the EU-U.S. Data Privacy Framework and implements Standard Contractual Clauses for international transfers. Google LLC participates in the EU-U.S. Data Privacy Framework and also relies on Standard Contractual Clauses.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are as follows:
| Data Type |
Retention Period |
| Contact form submissions |
2 years from last contact, unless a contract is entered into |
| Client project data |
6 years after the end of the contract (in accordance with HMRC requirements) |
| Email correspondence |
6 years after the end of the business relationship |
| Website analytics data |
26 months (Google Analytics default retention) |
| Invoicing and financial records |
6 years (as required by UK tax law) |
| Marketing consent records |
Duration of consent plus 1 year after withdrawal |
When the retention period expires, we securely delete or anonymise your personal data.
8. Your Rights
Under the UK GDPR, EU GDPR, and the Data Protection Act 2018, you have the following rights in relation to your personal data:
- Right of access (Article 15): You have the right to request a copy of the personal data we hold about you (a "Subject Access Request"). We will respond within one month of receiving your request.
- Right to rectification (Article 16): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
- Right to erasure (Article 17): You have the right to request that we delete your personal data where there is no compelling reason for us to continue processing it. This is also known as the "right to be forgotten".
- Right to restriction of processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data.
- Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
- Right to object (Article 21): You have the right to object to the processing of your personal data where we rely on legitimate interest as our legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds.
- Rights related to automated decision-making (Article 22): We do not make any decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you.
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In exceptional circumstances, we may extend this by a further two months, but we will inform you of any such extension within the first month.
9. Right to Withdraw Consent
Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You can withdraw consent by:
- Clicking the "unsubscribe" link in any marketing email we send you.
- Contacting us at [email protected].
- Adjusting your cookie preferences in your browser settings.
10. Right to Lodge a Complaint
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority.
United Kingdom
The supervisory authority for data protection in the United Kingdom is the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk
- Phone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
European Union
If you are located in the European Economic Area, you also have the right to lodge a complaint with your local Data Protection Authority (DPA). A list of EU DPAs can be found on the European Data Protection Board website.
11. Children's Privacy
Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at [email protected] and we will take steps to delete such information promptly.
12. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the bottom of this page. We encourage you to review this policy periodically.
Where changes are significant, we will make reasonable efforts to notify you, such as by placing a prominent notice on our website or by sending you an email (if we hold your email address for this purpose).
13. Contact Us
If you have any questions about this privacy policy, wish to exercise your data protection rights, or need to make a data-related request, please contact us:
Last updated: April 2026