Privacy Policy

Privacy Notice

This Privacy Notice applies to the processing of personal data by Smart Spaces Global Ltd., (‘the company’, ‘we’, ‘us’, ‘our’), a company registered in England and Wales under Company Number 07116878, with its registered office at Ground Floor, Portsoken House, 155–157 Minories, London, EC3N 1LJ.

We are committed to compliance with relevant data protection laws, including the UK’s Data Protection 2018, the UK GDPR, and the Privacy and Electronic Communications Regulations 2003, and where applicable the EU GDPR.

This Privacy Notice describes how we collect, use, and share personal data about individuals (‘you’, ‘your’) in connection with our business, including how we handle your personal data when you interact with us, such as by requesting information, when you visit our website at www.smartspaces.app, or when you use our mobile App.

Our Candidate and Applicant Privacy Notice explains how we handle personal data where you apply to work with us.

Scope of this Privacy Notice

This Privacy Notice describes:

• The types of information we process
• How we use the information
• How long we retain information
• How we share the information
• Protection and storage of the information
• Your rights
• How to contact us
• Changes to this Privacy Notice
• How we collect and use information about candidates and job applicants

The types of personal data we process

We will process personal data we receive directly from you, such as when you enquire about our services through our website, or indirectly, such as when our customer, who may be your employer or the building operator for the location in which you work, has contracted with us to provide services via our mobile App.

• Identification data: name, surname, username, and profile photo/image (including where provided by App users).
• Contact data: email address, telephone number, and postal address.
• Account credentials: password and login identifiers.
• Device and technical data: device type, unique device identifiers (IMEI and MAC address of wireless network interface), operating system, browser, IP address, mobile network, time zone setting, usage analytics. This data is processed solely to ensure the App functions correctly and to provide technical support where needed.
• Access and facility data: records generated through building access systems.
• Location data: limited to Bluetooth or NFC functionality required for mobile access passes to function correctly (this can be disabled from within the privacy options on your device, though doing so will limit functionality). Any locational data captured for reporting purposes is anonymised and replaced with discipline and grade information.

Transactional data relating to in-app purchases, including purchase history, transaction references and payment status, but excluding payment card details.

Purposes and Lawful Basis of Processing

We have set out below ways in which we may collect and use personal data (i) in conducting our business with our customers, prospective customers, service providers, and visitors to our website, and (ii) in relation to our mobile App.

Where we collect and process personal data for our own business purposes, we typically do so on the basis of our contract with our customer, for our legitimate interests, or your consent:

• To enter into and perform contracts with our customers (Legitimate Interests – performing our contract with our customer).
• To provide support and respond to queries including from visitors to our website (Legitimate Interests – performing our contract with our customer).
• To maintain the prevention of fraud and security of our business including our website (Compliance with our legal obligations and Legitimate Interests – safeguarding our business).
• To analyse and improve the performance and user experience for our website (Legitimate Interests – monitoring performance and improving our services).
• To comply with legal or regulatory obligations (Legal Obligation).
• To communicate with you about our products and services (unless you have opted out) (Consent or Legitimate Interests – maintaining and growing our business).

Smart Spaces App

Smart Spaces processes personal data necessary to provide and improve our App, its security, and its technical performance. We do so in fulfilment of our contract with our customer, who determines the purposes of processing relating to building access, amenities, tenant communications, and facility management. We act as a data processor for our customer, who may be your employer or the building operator for your place of work; their privacy notice will explain the legal bases for their collection and use of your personal data. We process personal data for the following purposes and on the following lawful bases:

• To register, authenticate, and administer App user accounts (Legitimate Interests – performing our contract with our customer)
• To facilitate access to the building and associated amenities for occupiers and visitors (Legitimate Interests – performing our contract with our customer)
• To prevent fraud and maintain the security of the App and building systems (Compliance with our legal obligations and Legitimate Interests – safeguarding our business)
• To provide customer support and respond to user queries (Legitimate Interests – performing our contract with our customer)
• To analyse and improve the App’s performance, services, and user experience (Legitimate Interests – monitoring performance and improving our products and services)
• To comply with legal or regulatory obligations (Legal Obligation)
• To provide optional communications, promotions, or event participation features (Legitimate Interests – performing our contract with our customer)
• To provide additional services from one or more of our business partners (Legitimate Interests – performing our contract with our customer)

Data Retention

Personal data will be retained only for as long as is necessary for the purposes for which it was collected, or as required to comply with legal, regulatory, or contractual obligations, in line with our data retention policy. We periodically review the personal data we hold in order to determine whether we have a business need and a legal basis to retain it, and where we do not, it will be deleted or put beyond use.

Unless otherwise required by law, personal data we process for App users will typically be deleted or returned to our customer within [60] business days following termination of our customer’s subscription.

Data Security and International Transfers

Personal data is stored within secure data centres located in the United Kingdom and the European Economic Area (EEA). Data is protected using appropriate technical and organisational measures including encryption in transit and at rest, access controls, and continuous monitoring.

We may also transfer your personal data to countries which have been recognised formally as providing an adequate level of protection for personal data, such as where adequacy regulations have been adopted by the UK Secretary of State. Where personal data is transferred outside the UK or EEA, we ensure that such transfers are subject to adequate safeguards, including the UK International Data Transfer Agreement and the UK Addendum to the EU Standard Contractual Clauses or equivalent protection mechanisms.

Data Sharing and Recipients

Personal data may be shared where necessary to achieve the purposes set out in this Privacy Notice:

• With service providers for hosting, maintenance, access control, payment processing, banking, legal or accounting services, all of whom operate under strict contractual confidentiality obligations;
• With competent authorities, regulators, or law enforcement agencies where required by law or to protect rights, property, or safety;
• With other third parties, where we obtain your consent for doing so;
• If, in future, we re-organise or transfer all or part of our business, we may need to transfer personal data to new entities from which our business will be carried out.

No personal data is sold or shared with advertisers. Any statistical or analytical data disclosed externally will be anonymised or aggregated.

Our website and App may, from time to time, include links to or integrations with the websites or digital services of our partner networks, affiliates, or third-party providers (for example, where additional services or offers are made available through the App).

If you choose to follow a link or interact with such third-party content, please note that these parties operate their own websites and privacy practices. We do not control, endorse, or accept responsibility for how those third parties process personal data. We encourage you to review the privacy notices of any external website or service before submitting any personal data or using their features.

Cookies and similar technologies

We use cookies and similar technologies to support the functioning and security of our website, and our App, and to understand how they are used. You can find details of our use of those tools in our Cookie Policy.

Protection and storage of the information

We take steps to hold information securely and to prevent unauthorised access, modification or disclosure. We are certified to ISO/IEC 27001, SOC 2 Type 2, and Cyber Essentials Plus standards.

Your rights

Individuals in the UK have the following rights under data protection law. In order to exercise any of these rights, please contact us using the details set out below under ‘How to contact us’.

• Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data in certain circumstances.
• Object to processing of your personal data, or ask that we restrict processing of it.
• You have the right to opt-out of receiving any direct marketing communications from us at any time. You may do so by using the opt-out or unsubscribe options contained within any email marketing message that we may send to you.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format (your right to ‘portability’).
• Withdraw consent at any time where we are relying on consent to process your personal data. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdraw your consent.
• You have the right to make a complaint to us, or to the Information Commissioner’s Office (ico.org.uk), or for EEA residents, to your local data protection authority. If you are unsatisfied with our handling of your personal data, you can submit a complaint to our Data Protection Officer using the details set out below. We will acknowledge receipt of your complaint within 30 days, and will investigate and notify you of the outcome of our investigation without undue delay.

How to contact us

If you would like to contact us with questions about our handling of your personal data, please contact our Data Protection Officer at: dpo@smartspaces.app

For EEA residents, we have appointed an EU Representative who may be contacted at:

Ireland DataRep
The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland
datarequest@datarep.com

Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The effective date of the current Privacy Notice is July 2026. We encourage you periodically to review this notice. If we make any material changes in the way we collect, use, and/or share the personal data that you have provided, we will take appropriate steps to bring those changes to your attention, including by updating the Privacy Notice on our website.

Candidate and applicant Privacy Notice

We are responsible for deciding how we hold and use personal data about you when you apply for a job or other role with us (whether as an employee, worker or contractor). This Privacy Notice sets out how and why your personal data will be used for the purposes of recruitment, and how long it will usually be retained for. If you have any questions about the how your we use your personal data, please use the contact details set out below.

Personal data collected from you

In connection with your application to work with us, we will collect and process information about you including:

• Information you have provided to us in your curriculum vitae and covering letter;
• Information you have provided on our application form, including name, address, telephone number, personal email address, education history, qualifications and employment history;
• Any information you provide to us during the interview process;
• Your immigration status;
• We may need to collect, or request, the following types of more sensitive personal data, including:
  • Information about your race or ethnicity, religious or philosophical beliefs, trade union membership, sexual orientation and political opinions;
  • Information about your health, including any medical condition, health and sickness records;
  • Information about criminal convictions and offences.

Personal data collected from other sources

• Information received from recruitment agencies;
• Information from background check providers and third party database holders including credit reference agencies, professional regulatory bodies;
• Criminal records data through Disclosure and Barring Service and similar checks;
• References from your referees;
• Information from publicly accessible sources including social media platforms.

How we will use information about you

We will use the personal data we collect about you to:

• Assess your skills, qualifications, and suitability for the role(s) for which you are applying;
• Carry out background and reference checks, where applicable;
• Communicate with you about the recruitment process;
• Keep records related to our hiring processes;
• Comply with legal or regulatory requirements.

It is in our legitimate interests to decide whether to appoint you to a role within our business. We also need to process your personal data to decide whether to enter into a contract with you.

We will typically process the personal data described above to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will then decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you a role. If we decide to offer you the role, and you accept our offer, we will then take up references and carry out a criminal record check before confirming your appointment, and your personal data will be processed in accordance with our Employee Privacy Notice.

Automated decision-making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

How we share your information

We will only share your personal data with third parties where necessary for the purposes of processing your application, such as:

• Recruitment advisers involved with your application;
• Background checking and other screening service providers.

All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. They are permitted to process your personal data only for specified purposes and in accordance with our instructions.

If you fail to provide personal data

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

How long we keep your information

If you are offered and take up a role with us, your information will form part of your employee records and will be processed in accordance with our Employee Privacy Notice. We will otherwise retain your personal data for a period of up to 12 months after we have communicated to you our decision about whether to appoint you to a role within our business. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely delete or put beyond use your personal data in accordance with applicable laws and regulations.

Your rights in connection with personal data

You have the following rights in relation to your personal data:

• Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data in certain circumstances.
• Object to processing of your personal data, or ask that we restrict processing of it.
• You have the right to opt-out of receiving any direct marketing communications from us at any time. You may do so by using the opt-out or unsubscribe options contained within any email marketing message that we may send to you.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format (your right to ‘portability’).
• Withdraw consent at any time where we are relying on consent to process your personal data. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdraw your consent.
• You have the right to make a complaint to us, or to the Information Commissioner’s Office (ico.org.uk). If you are unsatisfied with our handling of your personal data, you can submit a complaint to Data Protection Officer using the details set out below. We will acknowledge receipt of your complaint within 30 days, and will investigate and notify you of the outcome of our investigation without undue delay.

If you wish to exercise any of your rights, or have a question or wish to make a complaint about the processing of your personal data, please contact our Data Protection Officer at: dpo@smartspaces.app