Privacy Policy

1. Data controller

Smart One Holding Limited (trading as "SmartOne"), Tagliaferro Business Centre, Level 6, Room 2, Sqaq Gaiety, Sliema SLM 1551, Malta. Company registration number: C 112842. Data-protection contact: info@smartoneworld.com. As we are established within the EU, we are not required to designate a representative under Article 27 GDPR, and we are not required to appoint a Data Protection Officer under Article 37.

2. Scope

This policy applies only to the public marketing website smartoneworld.com. It does not govern customer production systems, which are deployed under separate contracts and data-processing agreements. For where data is hosted and processed, see our Data Residency & Sovereignty page.

3. Personal data we collect

• Identity and contact data: full name, telephone number and email address you enter into the form.
• Commercial-interest data: the products you select and any free-text notes.
• Technical data: your IP address and interaction signals processed by Google reCAPTCHA (only after you accept non-essential cookies), and your IP address received by our image content-delivery network (Cloudinary) when images load.
• We do not operate analytics or advertising trackers on this website, and we do not load fonts from third parties (web fonts are self-hosted).

4. Purposes and legal bases (GDPR)

• Respond to demo requests and sales enquiries; take steps at your request prior to entering into a contract – Article 6(1)(b).
• Deliver, secure and maintain the website; protect the form from spam and abuse – Article 6(1)(f) legitimate interests.
• Operate Google reCAPTCHA (placement of the reCAPTCHA cookie) – Article 6(1)(a) consent.
• Comply with legal obligations where applicable – Article 6(1)(c).
• Where we rely on legitimate interests, those interests are keeping the site available, preventing fraud and abuse, and protecting our network and the people who contact us. You have the right to object at any time under Article 21 GDPR by contacting info@smartoneworld.com.

5. Recipients and processors

We share personal data only with the following recipients, each under a data-processing agreement (except Google, which acts as a separate controller for reCAPTCHA), and only as needed to run the website:

• Microsoft Corporation (Microsoft 365) – processor; corporate email and receipt/storage of form emails; United States; EU-US Data Privacy Framework (certified).
• Resend, Inc. – processor; delivery of contact-form emails; United States; EU-US Data Privacy Framework (certified).
• WHG Hosting Services Ltd / StableServer – processor; website hosting origin (Dallas); United States; Standard Contractual Clauses with a transfer impact assessment.
• Cloudflare, Inc. – processor; DNS and network/edge security; United States; EU-US Data Privacy Framework (certified).
• Google LLC – separate controller; reCAPTCHA bot protection (only if you accept); United States; EU-US Data Privacy Framework (certified).
• Cloudinary – processor; image content-delivery network (receives your IP); United States; EU-US Data Privacy Framework (certified).
• Source of reCAPTCHA data (Article 14): the IP address and interaction signals used to generate a reCAPTCHA risk score are obtained through Google’s reCAPTCHA service in your browser, not collected directly by us; Google processes this as a separate controller.

6. International transfers

Personal data is transferred to the United States. For recipients certified under the EU-US Data Privacy Framework (Microsoft, Resend, Cloudflare, Google, Cloudinary), we rely on the European Commission’s adequacy decision of 10 July 2023. For our hosting provider, which is not DPF-certified (WHG Hosting Services Ltd / StableServer), we rely on the European Commission’s Standard Contractual Clauses with a transfer impact assessment and supplementary measures. You may request information about the safeguards in place. See also our Data Residency & Sovereignty page.

7. Automated decision-making

Google reCAPTCHA produces a risk score for form submissions. We do not take any decision producing legal or similarly significant effects on you based solely on automated processing; enquiries are reviewed by a person. Article 22 GDPR does not apply.

8. Retention

Sales leads and contact-form data: up to 12 months, unless a longer period is required by law or an active commercial relationship exists. Server and security logs: up to 6 months.

9. Your rights

• Access, rectification, erasure, restriction, data portability and objection (Article 21); and to withdraw consent where processing is based on it (without affecting prior processing).
• You may lodge a complaint with the Information and Data Protection Commissioner (IDPC), Malta (idpc.org.mt) or your local supervisory authority.
• To exercise any right, contact info@smartoneworld.com.

10. Children

This website is not directed at children under 16, and we do not knowingly collect their personal data.

11. Changes

We may update this policy; the "Last updated" date above will change when we do.