Privacy
Policy.

Who we are

Smart Hands is a trading name of Logical Llama Limited, a company registered in England and Wales (company number 16803899). Our registered address is 86-90 Paul Street, London, EC2A 4NE.

For the purposes of data protection law, Logical Llama Limited is the data controller. If you have any questions about this policy or how we handle your personal data, please contact us at privacy@smarthands.uk.

What data we collect

We may collect and process the following personal data:

• Get Started enquiries — when you submit the form at /get-started, we collect: first and last name, email, job title (optional), company name, company registration number, company address, trading address (optional), company website (optional), a short business description, billing contact name and email, whether you require purchase orders, support hours preference, any compliance or site-access requirements, additional notes, and an optional referral code. We also receive your IP address (hashed) for rate-limiting.
• Meeting scheduling — when you book an introductory call via our Google Calendar appointment page, Google collects your first name, surname, email address, and company. Smart Hands receives those details together with the meeting time and any optional notes you add. The booking sits in our Google Workspace calendar.
• Blog email subscription — when you subscribe to the Smart Hands blog from /blog, we collect your email address. We also receive your IP address (hashed) for rate-limiting the subscription endpoint. Subscriber lists are stored with our email provider (see § 05).
• Blog comments — when you post a comment on the blog we collect your name, email address (not displayed publicly), comment text, the post you commented on, your IP address (hashed) for spam protection, and your user-agent string. If you are signed into a Smart Hands Blog account, the comment is linked to your user record.
• Coverage postcode lookups — the postcode you type into the coverage checker on /coverage is sent from your browser to postcodes.io to resolve a location. We do not store the postcode you enter.
• Account information — name, email address, phone number, job title, and company details when you register for a Smart Hands Portal account.
• Authentication data — hashed passwords, two-factor authentication secrets, and single sign-on (SSO/SAML) identifiers.
• Usage data — information about how you use our website, portal, and mobile app, including pages visited, features used, and timestamps.
• Location data — GPS coordinates collected when engineers check in to or check out of site visits via the mobile app. This is collected only at the point of check-in/check-out and only with your device’s permission.
• Device information — device name, operating system, and push notification tokens when you use our mobile app.
• Communications — messages, attachments, and notes exchanged through the portal or mobile app in relation to work orders, materials orders, and support requests.
• Billing information — billing contact details, invoicing addresses, and payment-related information. We do not store credit or debit card numbers directly.

How we use your data

We use your personal data for the following purposes:

• Service delivery — to provide, manage, and improve our smart hands and infrastructure services, including work order management, site visit coordination, and materials procurement.
• Account management — to create and maintain your portal account, authenticate your identity, and manage team membership.
• Communication — to send you service-related messages, updates on work orders, and responses to support requests.
• Notifications — to deliver push notifications and email notifications about activity relevant to you.
• Invoicing — to generate and send invoices, credit notes, and related financial documents.
• Legal compliance — to comply with applicable laws, regulations, and legal processes.
• Security — to protect our services, detect fraud, and enforce our terms.

Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

• Contract — processing necessary for the performance of our contract with you or your organisation (e.g. delivering services, managing your account).
• Legitimate interests — processing necessary for our legitimate business interests, such as improving our services, ensuring security, and communicating with you about your projects.
• Legal obligation — processing necessary to comply with legal requirements (e.g. tax and accounting obligations).
• Consent — where you have given specific consent, such as opting in to marketing communications. You may withdraw consent at any time.

How we share your data

We may share your personal data with:

• Subprocessors — named third parties who process data on our behalf to deliver specific parts of the service. The full list is in § 06 below. They process data only on our instructions, under contractual data-protection terms, and only for the purposes set out.
• Your organisation — if you access Smart Hands through a team or company account, your team administrator may be able to view your activity within the portal.
• Legal authorities — where required by law, regulation, or legal process.

We do not sell your personal data to third parties.

Subprocessors

We rely on the following subprocessors to deliver our services. Each one is bound by a written agreement that includes the UK and EU data-protection terms required by UK GDPR (typically the ICO’s International Data Transfer Addendum or Standard Contractual Clauses, where the processor operates outside the UK).

• Cloudflare, Inc. — content delivery, edge security, and traffic routing for the website, Portal, and mobile app. Headquartered: USA. Cloudflare privacy policy.
• Resend, Inc. — transactional email delivery (Get Started form notifications, invoices, account emails) and blog newsletter audience storage and delivery. Holds: recipient name, email address, and email body content. Headquartered: USA. Resend privacy policy.
• Google LLC (Google Workspace — Calendar Appointment Scheduling) — introductory meeting bookings. Holds: first name, surname, email, company, meeting time, optional notes. Headquartered: USA, with EU/UK regional processing options. Google privacy policy.
• Xero Limited — accounting, invoicing, and financial record-keeping. Holds: billing contact details, invoices, payment records. Headquartered: New Zealand, with UK/EU regional storage. Xero privacy policy.
• Ideal Postcodes Ltd (postcodes.io) — UK postcode lookup used by the coverage checker on /coverage. Receives the postcode you type. We do not send any other identifier. Location: UK. postcodes.io.
• OpenStreetMap Foundation (Nominatim) — address → coordinate lookup used by the Portal to geocode site addresses. Receives the site address. Location: UK / EU. OSM Foundation privacy policy.

We will update this list when we add or change a subprocessor. If you depend on a current list for due-diligence purposes, email privacy@smarthands.uk and we’ll let you know directly when material changes happen.

Data retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. When an account is deactivated, we retain data for a reasonable period to comply with legal obligations (e.g. tax records for 7 years), resolve disputes, and enforce our agreements. We periodically review and delete data that is no longer required.

Data security

We take appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), encryption at rest, access controls, two-factor authentication, and regular security reviews. While no system is completely secure, we are committed to protecting your data to the highest practical standard.

Your rights

Under UK data protection law, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data, subject to legal retention requirements.
• Restriction — request that we limit how we use your data.
• Portability — request a copy of your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, please contact us at privacy@smarthands.uk. We will respond within one month.

Cookies and analytics

The Smart Hands website (this site) does not run any third-party analytics or advertising trackers and does not set marketing cookies. We use only the strictly-necessary cookies our hosting provider (Cloudflare) places for security and bot-mitigation purposes, and a session cookie when you sign in to the Portal at portal.smarthands.uk.

Our Portal and mobile app do not use third-party tracking cookies. If we ever add analytics, we will update this section and, where required by law, ask for your consent before any tracking is set.

International transfers

Some of our service providers may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner’s Office (ICO).

Children

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

Changes to this policy

We may update this privacy policy from time to time. We will notify you of any significant changes by posting the updated policy on this page with a revised “last updated” date.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

Contact

If you have any questions about this privacy policy, please contact us: