Data Protection & Your Rights

Lawful Bases for Processing

We process your personal data under the following lawful bases as required by UK GDPR and EU GDPR:

Legitimate Interests: B2B enquiry fulfilment, service delivery, and personalization
Contract: To perform our contractual obligations when you engage our services
Consent: For optional marketing communications and analytics (where applicable)
Legal Obligation: When required to comply with applicable laws and regulations

Your Rights Explained

Under UK and EU data protection law, you have the following rights:

Right to Access

You can request copies of your personal data. We'll provide this information in a commonly used electronic format.

Right to Rectification

You can request correction of any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purpose it was collected.

Right to Restrict Processing

You can request that we limit how we process your personal data in certain situations.

Right to Data Portability

You can request transfer of your data to another service provider in a structured, machine-readable format.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that significantly affect you.

How to exercise your rights: Email privacy@teamsmiths.ai. We respond to all requests within 30 days.

Data Processing Addendum (DPA) & Standard Contractual Clauses (SCCs)

For business clients requiring formal data processing agreements, we offer a DPA that:

Incorporates Standard Contractual Clauses (SCCs) or UK International Data Transfer Addendum (IDTA)
Details our subprocessors and their security measures
Outlines technical and organisational measures we implement
Specifies data retention and deletion procedures

To request a DPA, please contact privacy@teamsmiths.ai.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary by data type:

Form submissions: Duration of business relationship plus 1 year, or until erasure requested
Project data: Duration of project plus required retention period for contractual/legal purposes
Recordings of your work: Deleted 90 days after they arrive
Quote Desk enquiry attachments: Deleted 90 days after they arrive
Analytics: 26 months maximum (aggregated and anonymized)
Audit logs: As required by security and compliance policies

International Data Transfers

When we transfer personal data outside the UK/EEA, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) approved by the European Commission
UK International Data Transfer Addendum (IDTA)
Adequacy decisions where applicable
Additional technical measures such as encryption

Supervisory Authority

If you're not satisfied with how we've handled your data protection query, you have the right to lodge a complaint with your local supervisory authority:

UK: Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113

EU: Your local Data Protection Authority
Find your authority: the EDPB member list at edpb.europa.eu

Contact Our Data Protection Officer

For any data protection queries or to exercise your rights, please contact:

Email: privacy@teamsmiths.ai

We maintain detailed logs of all data subject requests including request ID, timestamp, and outcome for compliance purposes.