Privacy notice
This notice explains how Smart VAPT Limited (“Smart VAPT”, “we”, “us”) collects and uses personal data when you visit www.smartvapt.com, ask us for a quote, or work with us. We have kept it short and specific to what we actually do.
1. Who we are
Smart VAPT Limited is the controller of the personal data described in this notice.
- Company: Smart VAPT Limited, registered in England and Wales, company number 15679521
- Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
- Contact for privacy questions: info@smartvapt.com
We are a small company and have not appointed a Data Protection Officer, as the law does not require us to. Please send any privacy question to the email address above.
2. The information we collect
When you ask for a quote or contact us
- Your name, work email address and company name
- The services you are interested in, your reasons and timing, and any other details you include about your systems or requirements
- Whether you asked for a sample report or made a partner enquiry
- The content of any emails you send us
Please do not send passwords, credentials or sensitive personal data through the form or by email. We will ask for anything we need through a secure channel once an engagement is agreed.
When you visit our website
- Aggregated, anonymous usage statistics (pages viewed, approximate country, browser and device type, referring site) collected by our analytics tool. See our Cookie policy.
- Technical information that our hosting provider and spam protection receive automatically, such as your IP address and browser details. These are used to deliver the site securely and to block abuse.
When you become a client
- Business contact details of the people we work with
- Contract, invoicing and payment records
- During testing, we may come across personal data held in your systems. That data is handled under the written engagement terms and data-handling commitments agreed with you before testing starts, not under this notice.
From other sources We only collect information about you from someone else when a partner (for example, an IT provider or agency) refers you to us with your knowledge. In that case we receive your name, business contact details and the nature of your enquiry.
3. How we use it and our lawful basis
| Purpose | Information used | Lawful basis (UK GDPR) |
|---|---|---|
| Replying to your enquiry and preparing a quote | Enquiry details | Taking steps at your request before entering into a contract; our legitimate interest in responding to business enquiries |
| Sending a sample report you asked for | Name, work email, company | Legitimate interests (responding to your request). We check requests to make sure reports only go to genuine businesses |
| Delivering services and managing the client relationship | Client contact details, engagement records | Performance of a contract |
| Invoicing, accounting and tax | Contract and payment records | Legal obligation |
| Keeping the website secure and preventing spam and abuse | IP address, technical data | Legitimate interests (protecting our website and users) |
| Understanding how the website is used so we can improve it | Aggregated analytics | Legitimate interests. See the Cookie policy for how to object |
| Defending or bringing legal claims | Relevant records | Legitimate interests |
Where we rely on legitimate interests, we have considered your rights and expectations and believe the use is proportionate. You can object at any time (see section 7).
We do not: sell your data, use it for advertising, add you to a mailing list without your separate consent, or make decisions about you using automated decision-making or profiling.
4. Who we share it with
We only share personal data with service providers who process it for us under contract, and only as far as needed:
- Website and email hosting: Hostinger
- Spam protection and website analytics: Cloudflare (Turnstile and Web Analytics)
- Professional advisers: such as our accountant or legal advisers, where necessary
- Authorities: where the law requires us to, for example HMRC, or in response to a valid legal request
When a partner refers you to us, we may confirm to that partner whether an engagement has started. We share no other details with them unless you agree.
5. International transfers
Some of our providers may process data outside the UK. Where they do, we make sure the transfer is protected by UK adequacy regulations (for example, the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or by the ICO’s International Data Transfer Agreement or Addendum.
6. How long we keep it
| Information | How long |
|---|---|
| Enquiries that don’t lead to an engagement | 12 months from our last contact, then deleted |
| Client contact and contract records | 6 years after the engagement ends (for legal and tax purposes) |
| Test data and evidence from an engagement | As set out in the engagement terms, and securely deleted afterwards |
| Website analytics | Aggregated only, held by the analytics provider under its retention settings |
7. Your rights
You have the right to:
- access the personal data we hold about you
- correct inaccurate data
- delete your data, where we no longer have a reason to keep it
- restrict how we use it in certain circumstances
- object to our use of it where we rely on legitimate interests
- data portability, where the law gives you that right
To use any of these rights, email info@smartvapt.com. We will reply within one month. There is normally no charge.
8. Security
We protect personal data with the same care we apply to our clients’ systems, including encryption in transit and at rest, access limited to the person who needs it, multi-factor authentication on all accounts, and secure deletion when data is no longer needed. No method of transmission over the internet is completely secure, but we work to keep risks low.
9. Complaints
If you have a concern, please contact us first at info@smartvapt.com and we will try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.
10. Children
Our website and services are intended for businesses. We do not knowingly collect personal data from anyone under 18.
11. Changes to this notice
We will update this notice when the way we use personal data changes. The date at the top shows when it was last revised.