Privacy
Policy.

01

Who we are.

The Smarty Train Limited (“we”, “us” or “our”) is the data controller for the personal data collected through this website and our services. We are a learning and development consultancy registered in England and Wales.

This policy explains how we collect, use, store and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

02

The data we collect.

We may collect and process the following categories of personal data:

• Contact data — your name, email address, phone number and company name when you submit our contact form or email us directly.
• Communication data — the content of messages or enquiries you send to us.
• Usage data — information about how you use our website, including your IP address, browser type, pages visited and referring URL, collected via cookies and similar technologies.
• Marketing preferences — your preferences for receiving communications from us.

We do not collect sensitive personal data (such as health information, racial or ethnic origin, or political opinions) through our website.

03

How we use your data.

We use your personal data for the following purposes:

• To respond to enquiries you submit via our contact form or email.
• To provide, manage and improve our services to clients.
• To send you information about our services, insights and events where you have consented to receive marketing communications.
• To analyse how our website is used, in order to improve the user experience.
• To comply with our legal and regulatory obligations.

04

Legal basis for processing.

We process your personal data on the following legal bases:

• Legitimate interests — responding to your enquiries and managing our client relationships, where our interests are not overridden by your rights.
• Consent — sending you marketing communications, where you have opted in. You may withdraw your consent at any time by contacting us at getintouch@wearetst.com.
• Contract — performing services where we have entered into a contract with you or your organisation.
• Legal obligation — where we are required to process data to comply with a legal obligation.

05

How long we keep your data.

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, and in accordance with our legal obligations. In practice:

• Contact enquiries — up to 2 years from the date of your last contact with us.
• Client records — up to 7 years after the end of the relevant contract, in line with our financial record-keeping obligations.
• Marketing preferences — until you withdraw consent or ask us to stop.

When your data is no longer required, we will delete or anonymise it securely.

06

Who we share your data with.

We do not sell your personal data. We may share it with trusted third parties in the following circumstances:

• Service providers — companies that support our operations (such as our CRM provider HubSpot and website hosting via Microsoft Azure), who process data on our behalf under data processing agreements.
• Professional advisers — solicitors, accountants and insurers, where necessary.
• Legal requirements — where we are required to disclose data by law, court order or regulatory authority.

All third parties are required to respect the security of your data and to treat it in accordance with applicable data protection law.

07

International transfers.

Some of our service providers are based outside the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as the UK Government’s International Data Transfer Agreement (IDTA) or adequacy decisions, to ensure your data is protected to an equivalent standard.

08

Your rights.

Under UK GDPR, you have the following rights in relation to your personal data:

• Access — to request a copy of the personal data we hold about you.
• Rectification — to ask us to correct inaccurate or incomplete data.
• Erasure — to request that we delete your data in certain circumstances.
• Restriction — to ask us to limit how we use your data.
• Portability — to receive your data in a structured, machine-readable format.
• Objection — to object to our processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, to withdraw it at any time.

To exercise any of these rights, please contact us at getintouch@wearetst.com. We will respond within one month.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

09

Cookies.

Our website uses cookies and similar technologies to improve your browsing experience and help us understand how the site is used. Cookies are small text files stored on your device.

We use the following types of cookies:

• Strictly necessary — essential for the website to function. These cannot be disabled.
• Analytics — help us understand visitor behaviour so we can improve the site. These are only set with your consent.

You can control or delete cookies through your browser settings. Disabling certain cookies may affect the functionality of the site. For more information about cookies, visit aboutcookies.org.

10

Changes to this policy.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the “last updated” date at the top of this page. We encourage you to review this policy periodically.

11

Contact us.

If you have any questions about this privacy policy or how we handle your personal data, please get in touch: