Privacy policy
Last updated 13 October 2026
This privacy policy sets out how OHF Consulting Ltd, trading as SmartContact CRM (“SmartContact”, “we”, “us” or “our”), uses and protects your personal data. It is set out in sections, so you can jump to the part you need:
- Important information and who we are
- The types of personal data we collect about you
- How your personal data is collected and used
- Disclosures of your personal data
- International transfers
- Data security
- Data retention
- Your legal rights
- Contact details
- Complaints
- Changes to this policy and your duty to inform us of changes
- Third-party links
1. Important information and who we are
This privacy policy explains how SmartContact collects and uses your personal data when you use this website, contact us, sign up for an account, or use the SmartContact CRM service (the “SmartContact Platform”), including its apps, API and AI agent (MCP) connections.
OHF Consulting Ltd is a company registered in England and Wales (company number 15763560, VAT number GB 487 7549 21), with its registered office at Old Hall Farm, Main Street, North Muskham, Newark, Nottinghamshire, NG23 6HD.
When we are the controller. We are the controller of personal data about visitors to this website, people who contact us, our customers’ account holders and billing contacts, and developers who join our developer programme.
When we are the processor. Our customers store information about their own customers, prospects and contacts in the SmartContact Platform (“Customer Data”). For Customer Data, our customer is the controller and we act as their processor, under our Data Processing Agreement. If your details are held in a SmartContact customer’s CRM and you want to exercise your rights, please contact that organisation directly. We will help them respond.
2. The types of personal data we collect about you
Personal data means any information about an individual from which that person can be identified.
We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:
- Identity Data includes first name, last name, username or similar identifier, and job title.
- Contact Data includes email address, telephone numbers and business address.
- Account Data includes your workspace name, user role, sign-in method and security settings (such as whether multi-factor authentication is enabled). We do not store your password if you sign in with Google, Microsoft or a passkey.
- Billing Data includes billing contact, company name, VAT number and payment history. Card details are collected and held by our payment provider, Stripe. We never see or store your full card number.
- Technical Data includes internet protocol (IP) address, sign-in data, browser type and version, time zone setting and location, operating system and platform, and device identifiers.
- Usage Data includes information about how you use the SmartContact Platform, such as features used and actions taken, including actions taken by AI agents you connect.
- Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences.
- Developer Data, if you join our developer programme, includes your developer organisation, published plugins and payout details (held by Stripe).
We also collect, use and share aggregated data, such as statistical data, which is not personal data because it does not directly or indirectly reveal your identity. For example, we may count how many users use a specific feature, to understand trends and improve the SmartContact Platform.
3. How your personal data is collected and used
How do we collect your data?
Your interactions with us, when you:
- join our early-access list using the form on this website, or email us, for example for support;
- create an account or workspace on the SmartContact Platform;
- use the services available through the SmartContact Platform;
- subscribe to a paid plan or join the developer programme;
- ask us to send you marketing; or
- give us feedback or contact us.
Automated technologies or interactions. When you use the SmartContact Platform, we automatically collect Technical Data and Usage Data through server logs and essential cookies. This website uses no analytics or advertising trackers unless you allow them in our cookie settings (we use none today). See our cookie policy for details.
Third parties. If your employer or organisation has a SmartContact workspace, we receive your name and email address from them when they invite you. If you sign in with Google or Microsoft, we receive your name and email address from that provider.
What is our legal basis for processing your personal data?
The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following:
- Performance of a contract with you: where we need to perform the contract we are about to enter into, or have entered into, with you.
- Legitimate interests: where it is necessary to run our business and pursue our legitimate interests. We consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law.
- Legal obligation: where it is necessary to comply with a legal obligation we are subject to, such as tax law.
- Consent: where you have actively agreed to us using your personal data for a specific purpose, for example subscribing to our newsletter.
Purposes for which we will use your personal data
Delivering the SmartContact Platform
| Purpose | Type of data | Legal basis |
|---|---|---|
| To set up your account and workspace so you can use the features and services provided | Identity, Contact, Account | Performance of a contract |
| To manage your account, including billing, telling you about changes to our terms or this policy, providing support, and responding to queries and complaints | Identity, Contact, Account, Billing, Marketing and Communications | (a) Performance of a contract (b) Legal obligation (c) Legitimate interests (to keep our records up to date and manage our relationship with you) |
| To run the developer programme, including reviewing plugins and paying developers their revenue share | Identity, Contact, Developer | (a) Performance of a contract (b) Legal obligation |
Early-access list
| Purpose | Type of data | Legal basis |
|---|---|---|
| To email you when early access opens, after you ask us to by ticking the box on our early-access form | Identity (name), Contact (email), company name, your interest (CRM or developer programme), the country you submitted from, and a record of when and to which wording you agreed | Consent |
| To send you occasional product news, only if you tick the separate optional box | Identity, Contact, Marketing and Communications | Consent |
Early-access details are stored in a Cloudflare database in the EU. We do not store your IP address. You can withdraw consent and delete your details at any time on our early-access page, by using the unsubscribe link in any email, or by emailing us.
Operating our business
| Purpose | Type of data | Legal basis |
|---|---|---|
| To administer and protect our business, this website and the SmartContact Platform, including troubleshooting, data analysis and system testing | Identity, Contact, Technical | (a) Legitimate interests (running our business, IT services, network security, preventing fraud and abuse) (b) Legal obligation |
| To apply security measures, including detecting misuse by people, scripts or AI agents | Identity, Contact, Technical, Usage, Account | Legal obligation (appropriate technical and organisational measures) and legitimate interests |
| To send service messages about changes, updates and downtime | Identity, Contact | Performance of a contract |
| To improve the SmartContact Platform using aggregated usage analytics | Technical, Usage | Legitimate interests (to keep our service relevant and develop our business) |
| To send you relevant marketing about SmartContact | Identity, Contact, Usage, Marketing and Communications | Legitimate interests (for existing customers, with an opt-out in every message) or consent |
| To comply with our other legal obligations, including tax, and requests from courts, law enforcement and government authorities | Identity, Contact, Billing, Technical, Usage | Legal obligation |
We do not sell your personal data, and we do not use Customer Data to train AI models.
Cookies
| Purpose | Type of data | Legal basis |
|---|---|---|
| Cookies that are strictly necessary to sign in and keep the SmartContact Platform secure, as set out in our cookie policy | Cookies | Legitimate interests (delivering and securing the SmartContact Platform) |
| Any cookies that are not strictly necessary (we do not currently use any) | Cookies | Consent |
Direct marketing
You will receive marketing communications from us if you have requested information from us or bought services from us, and you have not opted out. We will get your express consent before we share your personal data with any third party for their own direct marketing purposes. We never do this today.
Opting out of marketing
You can ask us to stop sending you marketing at any time by following the opt-out link in any marketing message, or by emailing operations@smartcontact.online. If you opt out, you will still receive service messages that are essential for administration or customer service, for example about changes to our terms or this policy.
4. Disclosures of your personal data
We may share your personal data where necessary with the parties set out below:
- Service providers (sub-processors) who provide hosting, security, sign-in, payments and email delivery for us. Today these are:
- Cloudflare (website hosting, network security and file storage)
- Amazon Web Services (application hosting and databases)
- WorkOS (sign-in and identity)
- Stripe (payments, billing and developer payouts)
- Marketplace plugin developers, but only when a workspace administrator installs their plugin and approves the data it may access. The data each plugin receives is shown on the install screen.
- Our professional advisers, including lawyers, accountants, auditors and insurers.
- Third parties to whom we may sell, transfer or merge parts of our business or assets. If a change happens to our business, the new owners may use your personal data in the same way as set out in this policy.
- HM Revenue and Customs, regulators, law enforcement, public authorities or other third parties where necessary to exercise our rights or comply with a legal obligation.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes, and we only permit them to process it for specified purposes and in accordance with our instructions.
5. International transfers
When you create a workspace, you choose where its Customer Data is hosted: UK/Europe or the United States. Customer Data stays in that region, apart from limited transfers needed to run the service (for example sign-in and payments).
Some of our service providers are based in, or process data in, the United States. Whenever we transfer personal data out of the UK or EEA, we make sure it is protected by at least one of these safeguards:
- the country has been deemed to provide an adequate level of protection (including the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified); or
- we use the UK International Data Transfer Addendum and/or the European Commission’s Standard Contractual Clauses.
Contact us if you want more information about the safeguards we use.
6. Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These include encryption in transit and at rest, strict separation between customer workspaces, multi-factor authentication, and audit logging. We limit access to your personal data to those who have a business need to know, and they are subject to a duty of confidentiality.
We have procedures to deal with any suspected personal data breach, and will notify you and any applicable regulator of a breach where we are legally required to do so.
7. Data retention
We keep personal data only as long as necessary for the purposes described above, including to meet legal, accounting or reporting requirements. Typical periods are:
| Type of data | Retention period | Reason |
|---|---|---|
| Identity, Contact and Account Data | For the life of your account, then up to 6 years after you stop being a customer | Contract, tax and legal claims |
| Billing Data | 6 years after the end of the financial year it relates to | UK tax and accounting law |
| Technical and Usage Data | Up to 2 years | Security, preventing abuse, and improving the service |
| Early-access signups and enquiry emails | Until you remove them, or up to 24 months after you signed up or last contacted us, whichever is sooner | Telling you when early access opens, and responding to you |
| Customer Data (as processor) | Deleted within 30 days after a workspace is closed, and removed from backups within a further 35 days | As set out in our Data Processing Agreement |
In some circumstances you can ask us to delete your data: see your legal rights. When we no longer need your personal data, we will delete it or anonymise it so it can no longer be associated with you. We may use anonymised information for research or statistical purposes without further notice to you. We may keep personal data for longer if there is a complaint, or if we reasonably believe legal action is likely.
Erasure in SmartContact. When a person is erased from a SmartContact workspace, we anonymise their record and keep only a protected, one-way code (a keyed hash) of identifiers such as their email address. This lets the workspace stop the same person being re-added by mistake, without keeping their actual details.
8. Your legal rights
You have rights under data protection laws in relation to your personal data. You have the right to:
- Request access to your personal data (a “subject access request”). This lets you receive a copy of the personal data we hold about you and check that we are lawfully processing it.
- Request correction of the personal data we hold about you. We may need to verify the accuracy of the new data you provide.
- Request erasure of your personal data where there is no good reason for us to keep processing it, where you have successfully objected to processing, where we may have processed it unlawfully, or where we must erase it to comply with law. We may not always be able to comply, for specific legal reasons which we will tell you at the time.
- Object to processing where we rely on legitimate interests, if something about your situation makes you want to object. In some cases we may have compelling legitimate grounds that override your rights. You have an absolute right to object to direct marketing.
- Request the transfer of your personal data to you or to a third party, in a structured, commonly used, machine-readable format. This applies to data you provided where we rely on consent or contract.
- Withdraw consent at any time where we rely on consent. This does not affect processing carried out before you withdraw it.
- Request restriction of processing, so that we suspend it while we establish the data’s accuracy, where our use is unlawful but you do not want it erased, where you need us to keep the data to establish, exercise or defend legal claims, or while we verify whether we have overriding legitimate grounds after you object.
If you live in California or another US state with privacy laws, you have similar rights to know, correct and delete your personal data, and not to be discriminated against for using them. We do not sell or share personal data for cross-context behavioural advertising.
To exercise any of these rights, see contact details.
No fee usually required
You will not have to pay a fee to access your personal data or to exercise your other rights. We may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.
What we may need from you
We may ask for specific information to confirm your identity before we act on a request. This is a security measure to make sure personal data is not disclosed to anyone who has no right to receive it.
Time limit to respond
We try to respond to all legitimate requests within one month. If your request is particularly complex, or you have made several requests, it may take longer. In that case, we will tell you and keep you updated.
9. Contact details
If you have any questions about this privacy policy or how we use your personal data, or you want to exercise your rights, please email operations@smartcontact.online or write to OHF Consulting Ltd, Old Hall Farm, Main Street, North Muskham, Newark, Nottinghamshire, NG23 6HD, United Kingdom.
10. Complaints
You have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection (ico.org.uk), or to your local data protection authority. We would appreciate the chance to deal with your concerns before you approach the regulator, so please contact us first.
11. Changes to this policy and your duty to inform us of changes
We keep this privacy policy under regular review. If we make significant changes, we will tell account holders by email or in the app before they take effect.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new email address.
12. Third-party links
This website and the SmartContact Platform may include links to third-party websites, plugins and applications. Clicking those links, or installing a plugin, may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit and every plugin you install.