Privacy Notice

1. Who we are

SmartDry is a trading name of SMARTDRY TECHNOLOGIES LIMITED, a company registered in England and Wales under company number 17302780, whose registered office is at 3 Colndale Road Floor 1, Colnbrook, Slough, England, SL3 0HQ.

We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER].

This notice explains how we handle personal data across our website at smartdry.ai, the SmartDry platform, and our partner and approval programmes. Contact details are in section 17.

2. Our role: controller and processor

Our responsibilities depend on the data in question. We distinguish two categories.

Customer Content — the business is controller, we are processor

Records a garment-care business puts into the platform about its own customers and their garments: contact details, order history, account terms, garment records, condition reports, photographic evidence, notifications and delivery information. The business decides how that data is used. We process it on its documented instructions under our Data Processing Agreement.

Account and Service Data — we are controller

Data we determine the purposes and means of processing for, even where it concerns a customer's staff. This includes:

• User accounts, authentication records, roles and permissions.
• Audit logs recording which user performed which action.
• Security monitoring, fraud prevention and abuse-detection records.
• Billing, subscription and payment metadata.
• Support communications and service-quality records.
• Product telemetry and diagnostic data.
• Our own legal, regulatory and accounting records.

We determine independently how security monitoring, fraud prevention, account administration and legal compliance are carried out. That processing is not performed solely on a customer's instructions.

3. Personal data we collect

Data you give us directly

• Enquiry data — name, business name, work email, phone number, number of locations, business type.
• Partner programme data — supplier spend information and invoices you choose to share so we can prepare a saving estimate.
• Approval data — information supplied when applying for SmartDry Approved, including specialisms and evidence of service standards. This includes unsuccessful applications.
• Support data — the contents of messages, tickets and calls raised with our team, including call recordings where calls are recorded and you have been notified.

Platform-user data

Where you use SmartDry on behalf of a garment-care business, we process your name, work contact details, account identifiers, role and permissions, authentication and login records, audit records of actions performed in the platform, and device information.

Data we collect automatically

• Usage data — pages and features used, time and date of access, referring page.
• Device and technical data — IP address, browser type and version, operating system, device type, and approximate location inferred from IP address.
• Cookies and similar technologies — see section 13.

Data we receive from other sources

• Publicly available business-contact information and trade directories.
• Referral sources, including introductions from existing customers and partners.
• Information passed to us through integrations a customer has connected.
• Payment and subscription metadata from our payment providers.

Where we obtain personal data from a source other than you, we provide this notice within the period required by law, and no later than one month after obtaining it or at the point of first contact.

Operational data within Customer Content

Depending on the modules a business uses, the platform may hold delivery addresses and instructions, signatures and waiver acceptances, and — where route management is used — driver location information collected during a delivery run.

4. How and why we use personal data

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interest does not override your rights and freedoms. You may object at any time — see section 10.

Product improvement

We analyse aggregated and pseudonymised usage statistics to understand how features perform. Where we need identifiable user-level analysis to diagnose a fault, we limit it to what is necessary and to the personnel investigating. We do not use Customer Content for product improvement except on the controlling business's instructions or where the data has been effectively aggregated so that individuals are no longer identifiable.

5. Marketing

We market SmartDry to businesses, not to consumers.

• Corporate subscribers — we may contact named business contacts at companies and other corporate subscribers where necessary for our legitimate interest in promoting SmartDry, subject to your absolute right to object.
• Sole traders, certain partnerships and individual subscribers — we obtain consent, or rely on the electronic-mail soft opt-in where all of its statutory conditions are met.

Every marketing communication identifies SmartDry and provides a simple, free method of opting out. If you opt out we retain a minimal suppression record so that your objection is honoured — see section 9.

6. Garment records, evidence and AI-assisted analysis

The Garment Passport can hold photographs and condition notes about individual items. These records exist to document the condition of a garment before and after care, and to protect both the customer and the care provider in the event of a dispute.

• Garment records are visible to the garment-care business that created them, and to SmartDry personnel only where necessary to provide support or investigate a fault.
• They are not used for advertising, and are not shared with other garment-care businesses.
• Retention is configured by the controlling business, subject to the defaults in section 9.

AI-assisted analysis

Where SmartDry provides AI-assisted analysis, personal data may be processed by contracted technology providers acting under appropriate data-protection terms. We do not permit those providers to use Customer Content to train general-purpose models, unless the controlling business has expressly agreed otherwise. [Confirm against actual AI architecture and provider contracts before publication — including training, retention, human review and subprocessor terms.]

7. Who we share personal data with

We do not sell personal data. We share it in the following circumstances:

• Service providers — cloud hosting, database, payment processing, email and SMS delivery, analytics, AI processing and customer-support tooling.
• Payment partners — card details are handled by regulated payment providers. SmartDry does not store full card numbers.
• Within the SmartDry Care Network — where a customer asks to be matched to an approved cleaner, we share only the details needed to make that introduction.
• Professional advisers and authorities — where required by law or regulation, or to establish or defend legal claims.
• Corporate transactions — if SmartDry is involved in a merger, acquisition or asset sale, data may transfer subject to this notice.

Some providers act as our processors. Others act as independent controllers for particular activities, such as regulatory compliance, payment authorisation and fraud prevention. Where a provider acts as a controller, its own privacy notice applies to that processing.

A current list of subprocessors is available at [SUBPROCESSOR LIST URL] or on request from our privacy team.

8. International transfers

Personal data is primarily stored within the United Kingdom and European Economic Area. Transfers outside those areas can also occur through remote access — for example, support access, cloud logging, or personnel and contractors working from another country — even where the main database remains in the UK or EEA.

• UK personal data — we rely on UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
• EEA personal data — we rely on EU adequacy decisions or the EU Standard Contractual Clauses.
• Where a provider is properly certified under an applicable UK–US or EU–US data-privacy framework, we may rely on that framework.

We carry out transfer risk assessments and apply additional safeguards where appropriate. To request a copy of the safeguards applying to a particular transfer, contact our privacy team using the details in section 17.

9. Retention

We keep personal data only as long as necessary for the purposes described, and to meet legal, accounting and regulatory obligations. The periods below reflect our standard practice. [Verify each against actual technical configuration, the DPA and the customer agreement before publication.]

Backups

After data is deleted from active systems, residual copies may remain in encrypted backups until those backups are overwritten in accordance with our backup-retention cycle, during which time they are isolated from ordinary use and are not used for any other purpose.

10. Your rights

Subject to the law applying to you, you have the right to access your personal data, to have inaccurate data corrected, to request erasure, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on it.

To exercise a right, contact us using the details in section 17. We respond within one month. Where a request is complex or you have made a number of requests, we may extend this by a further two months and will tell you if we do.

Where your data is held by a garment-care business using SmartDry as its processor, please contact that business directly. We will forward requests we receive and support the business in responding, but we cannot act on Customer Content without its instruction.

11. Data-protection complaints

You may complain about our use of your personal data by emailing privacy@smartdry.ai or by using our privacy complaint form at [COMPLAINT FORM URL].

We will acknowledge your complaint within 30 days, investigate it appropriately, and communicate the outcome to you without undue delay.

You may also complain to the Information Commissioner's Office (ico.org.uk) or, where EU data-protection law applies, to the competent supervisory authority. You are not required to complain to us before contacting a supervisory authority.

12. Automated decision-making

SmartDry does not currently use personal data to make solely automated decisions that produce legal or similarly significant effects on individuals.

If that changes, and we make a decision based solely on automated processing that has a legal or similarly significant effect on you, we will provide the safeguards required by applicable law. These include informing you about the decision and enabling you to make representations, request meaningful human intervention, and contest the decision. The rights available to you depend on the data-protection law that applies to you; where EU law applies, more restrictive rules on solely automated decisions may continue to apply.

13. Cookies

We use cookies and similar technologies to keep the site working, remember your preferences, and understand how the site is used.

• Strictly necessary — session management, security and load balancing. These cannot be switched off.
• Preference — remembering choices such as region or saved form details.
• Analytics — measurement of how pages and features are used. Set only with your consent.
• Marketing — measuring campaign performance and advertising. Set only with your consent.

Our separate [Cookie Notice — URL] lists each cookie and similar technology we use, its provider, purpose and duration, whether it is first- or third-party, and the legal basis on which it is set.

You can change your choices at any time through the cookie settings link in the footer, or through your browser settings.

14. Security and breach notification

We use appropriate technical and organisational measures designed to protect personal data, including: [confirm each measure below is implemented across all systems and data described]

• Encryption in transit (TLS) and at rest for stored data and photographic evidence.
• Role-based access control, so staff at a garment-care business see only what their role requires.
• Audit logging of actions taken against an order or garment record.
• Access to production systems limited to named personnel, with multi-factor authentication.
• Regular backups, tested restore procedures and a documented incident-response process.

Where SmartDry acts as controller, we will notify the relevant supervisory authority of a reportable personal-data breach without undue delay and, where required, within 72 hours of becoming aware of it. Where SmartDry acts as processor, we will notify the affected customer without undue delay after becoming aware of a breach affecting its data. Where required by law, affected individuals will also be notified.

15. Age of users

Our website and business platform are not intended for use by anyone under 18, and we do not knowingly create platform accounts for anyone under that age.

Businesses using SmartDry may process information relating to their own customers, who may be of different ages. In those circumstances the relevant garment-care business is responsible for ensuring it has an appropriate lawful basis and provides any privacy information required.

16. Changes to this notice

We review this notice at least annually. Where we make a material change we will update the version number and effective date shown above, and — where the change significantly affects how we use your personal data — notify you directly before it takes effect. Previous versions are available on request.

17. How to contact us

Post: SMARTDRY TECHNOLOGIES LIMITED, 3 Colndale Road Floor 1, Colnbrook, Slough, England, SL3 0HQ

We have not appointed a statutory Data Protection Officer. Privacy matters are handled by our Privacy Lead, whose details are above. [Reassess if core activities come to involve large-scale systematic monitoring or large-scale special-category processing.]