1. Who We Are
SmartHaccp Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are a company registered in England and Wales.
- Registered address: Innovation House, Manchester, M1 1AB
- Data protection contact: privacy@smarthaccp.co.uk
- ICO registration number: [to be registered]
We have designated a data protection contact who is responsible for overseeing questions about this policy. If you have any questions, including any requests to exercise your legal rights, please contact us at privacy@smarthaccp.co.uk.
2. The Data We Collect About You
We collect and process the following categories of personal data:
2.1 Data you provide directly
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email address, password hash | Account creation, authentication |
| Business data | Business name, address, type, local authority | Service configuration, compliance context |
| Staff data | Staff names, email addresses, roles, training records | Multi-user account management |
| Compliance records | HACCP plans, temperature logs, allergen matrices, cleaning schedules, incident reports, diary entries | Core platform functionality |
| Payment data | Billing email, subscription plan | Subscription management |
| Support data | Support ticket messages, contact form submissions | Customer support |
We do not store full credit or debit card numbers. All payment card data is handled directly by our payment processors (see Section 5).
2.2 Data collected automatically
- Usage data: Pages visited, features used, actions taken, timestamps.
- Device data: Browser type, operating system, screen resolution.
- Log data: IP address, access times, referring URLs, error logs.
2.3 Special category data
We do not intentionally collect special category data (e.g., health data, racial or ethnic origin). If you include personal health information in compliance records (e.g., allergy details of staff members), this is processed under your responsibility as the data controller for your own business records. We act as a data processor for this data (see Section 6).
3. Lawful Bases for Processing
Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:
| Processing Activity | Lawful Basis (Article 6) |
|---|---|
| Account creation and authentication | Contract (Art. 6(1)(b)) — necessary to perform our contract with you |
| Providing the food safety platform | Contract (Art. 6(1)(b)) |
| Processing payments and subscriptions | Contract (Art. 6(1)(b)) |
| Sending service notifications (e.g., overdue checks, subscription renewals) | Contract (Art. 6(1)(b)) |
| Responding to support enquiries | Contract (Art. 6(1)(b)) / Legitimate interests (Art. 6(1)(f)) |
| Improving and securing the platform | Legitimate interests (Art. 6(1)(f)) — to maintain and improve our service |
| Analytics and service usage reporting | Legitimate interests (Art. 6(1)(f)) — aggregated, anonymised data to understand usage patterns |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing communications | Consent (Art. 6(1)(a)) — only with your explicit opt-in |
3.1 Legitimate interests
Where we rely on legitimate interests, we have conducted a balancing test to ensure your rights and freedoms are not overridden. Our legitimate interests include:
- Monitoring platform performance and preventing fraud.
- Analysing aggregated usage data to improve features.
- Maintaining the security and integrity of our systems.
You may request details of our legitimate interest assessments by contacting us at privacy@smarthaccp.co.uk.
3.2 Consent
Where we rely on consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent, contact us or use the controls within your account settings.
4. How We Use Cookies
We use the following types of cookies:
- Strictly necessary cookies: Session management, authentication tokens, CSRF protection. These are essential for the platform to function and cannot be disabled.
- Functional cookies: Remembering your preferences (e.g., theme, language).
We do not use third-party advertising or tracking cookies. You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the platform from functioning correctly.
5. Who We Share Your Data With
We do not sell your personal data. We share data with the following categories of recipients, only where necessary and under data processing agreements:
| Recipient | Purpose | Location |
|---|---|---|
| Cloud hosting provider | Infrastructure and data storage | United Kingdom |
| Lemon Squeezy | Payment processing (UK and Ireland customers) | United States |
| Paystack | Payment processing (Nigeria customers) | Nigeria / United States |
| Email delivery provider | Transactional emails (notifications, password resets) | EU / UK |
| Legal and regulatory authorities | Where required by law, regulation, or legal process | As required |
5.1 International transfers
Some of our service providers are based outside the United Kingdom. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:
- UK International Data Transfer Agreements (IDTAs) or UK Addenda to EU Standard Contractual Clauses.
- Adequacy regulations (where the UK Secretary of State has determined adequate protection).
- Additional technical and organisational measures where required.
You may request a copy of the relevant transfer safeguards by contacting us at privacy@smarthaccp.co.uk.
6. Data Controller and Data Processor Roles
Your relationship with SmartHaccp involves two distinct roles:
- You are the data controller for personal data contained in the compliance records you create (e.g., staff names in training records, customer allergen information, incident details). You determine the purposes and means of processing this data.
- We are the data processor for that compliance data. We process it solely on your instructions to provide the platform. Our obligations as a data processor are set out in our Terms of Service and, where applicable, a separate Data Processing Agreement.
- We are the data controller for your account data (name, email, billing information) and platform usage data.
7. Data Retention
We retain personal data only for as long as necessary for the purposes it was collected:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account data | Duration of account + 30 days | Service provision, data export window |
| Compliance records (HACCP, diaries, temperatures) | Duration of account + 2 years minimum | Food hygiene regulations (Regulation (EC) No 852/2004 as retained in UK law) require records to be available for inspection |
| Payment and billing records | 6 years from transaction date | UK tax and accounting obligations (HMRC requirements) |
| Support tickets | 2 years from last interaction | Service quality, dispute resolution |
| Server logs | 90 days | Security monitoring, incident response |
| Analytics data | 26 months (anonymised) | Service improvement (anonymised after 12 months) |
8. Your Legal Rights
Under UK GDPR, you have the following rights regarding your personal data:
| Right | What It Means |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete data. |
| Erasure (Art. 17) | Request deletion of your data, subject to legal retention requirements. |
| Restriction (Art. 18) | Request that we limit how we process your data. |
| Data portability (Art. 20) | Receive your data in a structured, machine-readable format (CSV, JSON). |
| Object (Art. 21) | Object to processing based on legitimate interests or direct marketing. |
| Withdraw consent | Where processing is based on consent, withdraw it at any time. |
| Complain to the ICO | Lodge a complaint with the Information Commissioner's Office if you believe your rights have been infringed. |
8.1 How to exercise your rights
Contact us at privacy@smarthaccp.co.uk. We will respond within one calendar month of receiving your verified request. We may ask you to verify your identity before processing the request. There is no charge for most requests, but we may charge a reasonable fee for manifestly unfounded or excessive requests.
8.2 Right to complain to the ICO
If you are unhappy with how we handle your personal data or respond to your request, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first.
9. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. All compliance assessments and recommendations within the platform are tools to assist your decision-making and do not constitute automated decisions.
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit (TLS 1.3) and at rest (AES-256).
- Regular automated backups with encrypted storage.
- Role-based access controls for all internal systems.
- Regular penetration testing and security audits.
- Incident response procedures with 72-hour ICO notification where required.
In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify you without undue delay, as required by UK GDPR Article 34.
11. Children's Data
SmartHaccp is a business-to-business service not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or a prominent notice within the platform at least 30 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
13. Contact Us
For questions about this Privacy Policy, to exercise your rights, or to make a complaint:
Email: privacy@smarthaccp.co.uk
Post: Data Protection, SmartHaccp Ltd, Innovation House, Manchester, M1 1AB
We aim to respond to all enquiries within 5 working days and to formal data subject requests within one calendar month.