Privacy Policy

For account administration, product access, security, support, and website inquiries, the SmartService contracting entity acts as the data controller. When a subscribed business enters information about its own customers, devices, employees, suppliers, or transactions, that business generally acts as controller and SmartService processes the data on its instructions under the service agreement and any data processing agreement.

We may process account and profile details such as name, email address, language, role, permissions, and workspace membership; authentication and security data; customer and supplier contact details; service records, device details, complaints, diagnoses, lock information, photos, notes, parts, labor, status, and tracking information; product, inventory, purchase, sale, invoice, expense, and payment records; uploaded documents and images; support communications; notification preferences and templates; and technical records such as IP address, device or browser information, timestamps, and activity logs.

Data is collected directly from people who create an account, use the service, upload content, or contact us; from subscribed businesses that enter or import information about their customers, staff, suppliers, and operations; and automatically through essential authentication, security, diagnostic, and activity records generated when the website or application is used.

We use personal data to create and administer accounts and workspaces; provide repair, customer, stock, purchasing, sales, invoice, payment, notification, reporting, and support features; authenticate users and enforce permissions; secure, troubleshoot, and improve the service; communicate about access and support; comply with legal duties; and establish or defend legal claims. Depending on the context and applicable law, processing is based on performance of a contract, steps requested before a contract, legal obligations, legitimate interests such as security and service operation, or consent where required.

A business using SmartService is responsible for the data it chooses to enter, import, display through public tracking, or send by email or SMS. It must provide required notices, have a lawful basis, respect individual rights, configure access appropriately, and avoid collecting information that is unnecessary for its work. Users should not place sensitive information in free-text fields unless it is necessary and permitted by law.

Data may be shared with authorized users of the relevant workspace; a customer using a secure public service-tracking link; hosting, database, storage, authentication, security, monitoring, email, and support providers; configured email or SMS providers; document extraction, OCR, or AI providers when those optional functions are enabled; exchange-rate and other integration providers; professional advisers; and public authorities when disclosure is legally required. Providers may only use data to deliver their contracted services and must be subject to appropriate safeguards.

Some providers may process data outside the country where it was collected. When applicable law requires it, the responsible entity will use an approved transfer mechanism and appropriate contractual, technical, and organizational safeguards. The specific hosting region, subprocessors, and transfer mechanism should be stated in the applicable agreement, data processing addendum, or subprocessor notice.

Account, workspace, business, and support data is kept only as long as needed to provide the service, follow workspace instructions, meet contractual and legal duties, maintain security, and resolve disputes. Retention varies by data type and customer configuration. Protected device lock details are designed to expire after 30 days. Deleted data may remain in restricted backups until normal backup rotation completes.

We use technical and organizational measures intended to protect personal data, including workspace separation, role-based permissions, protected handling of sensitive device-lock fields, authentication controls, logging, and restricted provider access. No internet service is completely secure, so workspace administrators must also protect credentials, assign minimum necessary access, review team membership, and report suspected misuse promptly.

The public website does not currently use non-essential advertising or analytics cookies. The application uses essential session cookies and browser storage to authenticate users, protect sessions, retain language or similar preferences, and operate requested features. If non-essential analytics or advertising technologies are introduced, this notice and any required consent controls will be updated before they are used.

Depending on applicable law, you may have rights to be informed; access personal data; request correction or deletion; restrict or object to processing; receive portable data; withdraw consent without affecting earlier lawful processing; and complain to a competent data protection authority. For data entered by a SmartService business customer, contact that business first. For account, website, or provider-related requests, email info@smartservice360.com. Identity may need to be verified before a request is completed.

SmartService is a business service and is not directed to children. A workspace must not enter a child's personal data unless doing so is necessary for a legitimate business purpose, legally permitted, and accompanied by any notice or authorization required by law.

We may update this policy when the service, providers, or legal requirements change. Material changes will be communicated through the website, application, or account contact where appropriate. Privacy questions and requests may be sent to info@smartservice360.com. The approved version must also provide the responsible legal entity's name, postal address, and any required local representative or data protection contact.