Privacy & Data Retention

1Who we are

JG Smart Systems Ltd is the data controller for the information described in this policy. We are a company registered in England and Wales, number 17148775, with a registered office at The Grove, Hollyhurst, Leebotwood, Church Stretton, Shropshire SY6 7JP.

We install and support agricultural monitoring systems, CCTV and industrial control systems. We are registered with the Information Commissioner’s Office (ICO), the UK data protection regulator, under registration number ZC134841, and we handle personal data in accordance with the UK GDPR and the Data Protection Act 2018.

The business is run by one engineer, Jamie Groom, who is also the point of contact for anything in this policy.

2The short version

3Information we collect

If you contact us

When you fill in the enquiry form on this website or get in touch by phone, email or text, we collect your name, contact details, the location of your site and whatever you tell us about what you need.

If we survey your site or quote for work

• Your name, business name, address, phone number and email address
• Site details — location, buildings, access arrangements, gate codes, livestock and safety notes
• Photographs of buildings, equipment and proposed installation points
• Details of any existing systems on site
• Names and contact details of other people at the site who need to be contacted or to receive alerts

If you become a customer

• Quotations, job records, installation notes and handover documents
• Invoices, payments and bank reference details (we do not store card numbers)
• Correspondence with you about the work
• Serial numbers and identifiers of the equipment installed at your site

If you take the monitoring service

• Sensor readings from your site — temperatures, levels, power states, door positions and similar
• A history of the alerts generated and when they were sent
• The names and messaging identifiers of everyone you ask us to send alerts to

Sensor readings are information about your equipment and buildings rather than about people. We treat them as your confidential business information regardless.

4Why we use it, and our lawful basis

We do not use your information for automated decision-making or profiling, and we do not send marketing emails unless you have asked us to.

5Cookies and website tracking

Two things on the site do involve another company:

• Typefaces are loaded from Google Fonts, which means Google receives your IP address as part of that request. We do this to keep the site fast; no cookie is set by it.
• The enquiry form is handled by Formspree, which receives what you type into the form and passes it to us by email.

Our server keeps standard web logs — IP address, time, page requested — which are used only for security and diagnosing faults.

6Who else handles your information

We keep the list of companies with access to your information as short as we can. Each one is used for a specific purpose and is bound to handle the information properly.

We do not sell your information, and we do not share it with anyone for their own marketing. We will disclose information where the law requires it — for example to HMRC, or in response to a valid court order or police request.

Where any of these providers stores information outside the UK, they do so under the safeguards required by UK data protection law.

7Where your information is kept

Your records live in three places:

• Our own server, which we operate ourselves on hardware provided by Hetzner Online GmbH in Nuremberg, Germany. This holds the monitoring platform and our internal job, quotation and invoicing system.
• Our business email, for correspondence.
• Encrypted backups, taken nightly and copied to cloud storage so that a failure of the server does not lose your records.

Germany is covered by the UK’s data protection adequacy arrangements, which means your information has the same legal protection there as it does here. Where any other provider stores information outside the UK, they do so under the safeguards UK data protection law requires.

8How long we keep it

If your monitoring service ends, we will either export your monitoring data to you or delete it, whichever you prefer, within 30 days.

9CCTV: who is responsible for what

That means you are the data controller for your CCTV footage. In practice that makes you responsible for:

• Putting up signs telling people the area is covered by CCTV and who operates it
• Only pointing cameras where you have a good reason to
• Deciding how long footage is kept and not keeping it longer than you need
• Responding if somebody asks for a copy of footage of themselves
• Paying the ICO data protection fee if your use of CCTV requires it — which it usually does once cameras cover anywhere beyond your own household

We will advise on any of this on request and we would always rather you asked. But we cannot take legal responsibility for your compliance.

If we need to view footage to diagnose a fault, we will ask you first and you will be present or will give us access deliberately for that purpose.

10System passwords and access details

To support the systems we install, we keep a record of technical access details for your equipment — recorder addresses on your own network, administrator usernames and passwords, app account details and similar.

• Passwords are stored encrypted in our internal system, not in plain text
• They are used only to support your system, and only by us
• They are never shared with anybody else
• You can ask us to delete them at any time, though it may mean a factory reset is needed if you later lose access and we cannot help you back in

The printed handover pack we give you at the end of an installation contains these details. Keep it somewhere safe, and tell us if it is lost so we can help you change them.

11Keeping your information secure

• Our systems are reachable only over encrypted connections (HTTPS)
• Our internal job and invoicing system requires a login, and is not open to the public
• Passwords we hold on your behalf are encrypted at rest
• Backups are encrypted and held separately from the live server
• Access to all of it is limited to the one engineer who runs the business

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will tell you and the ICO, within the timescales the law sets.

12Your rights

Under UK data protection law you have the right to:

• Be told what we hold about you and why — this policy, plus anything else you ask
• Get a copy of your information (a subject access request)
• Have it corrected if it is wrong
• Have it deleted, where we are not required to keep it — we cannot delete invoices and accounting records before the statutory period is up
• Restrict or object to how we use it
• Have it transferred to you or another provider in a usable format
• Withdraw consent at any time, where we relied on consent

Email jamie@jgsmartsystems.co.uk or ring 07850 142958. There is no charge, and we will respond within one month. We may ask you to confirm who you are first.

13Complaints

If you are unhappy with how we have handled your information, please tell us first — it is usually quickest to sort it out directly.

You also have the right to complain to the Information Commissioner’s Office at any time:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk

14Changes to this policy

We will update this policy when how we work changes. The version and date at the top of the page always tell you which version you are reading. If a change materially affects existing customers, we will tell them directly rather than relying on them noticing.

15Contact