About this policy
Compliance Tools is a brand of Smo & Co Technology Ltd, a private limited company registered in England and Wales under company number 17454793.
This policy explains how we handle personal information connected with our website, business relationships and Services, including DLP Shield, Injection Shield and the customer portal. It also explains how information handled for your employer or another business differs from information we use for our own purposes.
Our website is www.compliance-tools.co.uk. Contact us about privacy or a complaint at admin@smoandco.uk. Technical support is available at support@smoandco.uk.
When we are a controller or processor
We act as a controller when we decide why and how to use information for our own business activities, such as managing enquiries, our customer relationship, billing and applicable legal records. This policy describes those uses and your rights in relation to them.
We act as a processor when we handle personal information on a business customer's instructions, for example to administer its licensed users and centrally managed policies. Before that processing begins, it will be covered by a Data Processing Agreement with the business customer. If an MSP manages the services, it may be the controller or a processor for another organisation, depending on its role.
If you use the Services through your employer or another organisation, that organisation decides the purposes of its deployment, relevant monitoring policies and how it uses your information. Please also read its privacy notice. It is normally the first contact for requests about information we process on its behalf. We will help it respond as required.
Our processing role depends on the activity. For example, a business email address may be used both to administer a customer-directed user account and separately to communicate with the organisation's purchasing contact.
Information we handle
Business and contact information. Names, business email addresses, company details, account contact details and information you provide when making an enquiry or managing a subscription. We receive this from you, your organisation or an authorised MSP.
User and service information. Licensed User email addresses, account or tenant associations, device identifiers, licence status and policy configuration. These may be supplied by the customer or MSP or generated through use of the Services. We process these on customer instructions where they support customer-controlled administration.
Technical and security information. IP addresses, login and authentication records and relevant audit or service logs generated when accounts and devices interact with our systems.
Payment and billing information. Billing contact details, invoices, subscription and transaction records, payment status and identifiers supplied through our payment provider. Our payment provider processes the information needed to handle payments.
Communications. We process information provided when someone contacts us, including enquiries, support requests, correspondence and any attachments. Information submitted for support is limited to what is necessary to address the request. If resolving an issue requires confidential prompts, sensitive information or personal data about another person, we will agree a suitable secure method before that information is shared with us.
Preferences. Privacy requests, communication preferences and consent records where applicable.
We do not require special-category information, such as health information, or criminal-offence information as ordinary account details. Local content may contain sensitive information, as explained below, but this does not mean it is collected by our hosted service. If this type of information is sent to our support team unexpectedly, we will restrict access to it and delete it when it is no longer needed. We will only retain or otherwise process it where the law allows us to do so.
Local scanning by DLP Shield
In the current DLP Shield architecture, policies are managed in the portal and sent to Users' devices. Prompts and supported attachments are inspected locally on the device before submission through supported routes.
The content inspected and sensitive values detected are not sent to our systems for scanning, and are not uploaded to or stored in the Compliance Tools customer database through that scanning process. Current blocking and detection events are not reported back to the portal.
This is different from the account, licence, policy and technical information needed to operate the Services. Information you deliberately place in centrally stored configuration or send to support is also separate from local scanning.
If a submission is permitted and sent to an AI platform, that platform receives it under its own arrangements. Local scanning does not mean a subsequently submitted prompt stays on your device.
Chrome Web Store Limited Use
The use of information received from Chrome APIs by DLP Shield adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
DLP Shield uses access to ChatGPT and Claude pages only to provide its user-facing protection: checking supported prompts and attachments locally before submission and applying the organisation's configured warn, block or redact action. Prompt contents, attachment contents and detected sensitive values are not transmitted to Compliance Tools for advertising, profiling, creditworthiness or unrelated purposes, and are not made available for human review except where a user deliberately provides specific information for support, or where access is required for security or legal reasons.
Account identity, installation identifiers, extension version, licence status and policy configuration are transmitted securely only as needed to authenticate the User, administer the licensed installation and synchronise the organisation's protection policy.
Why we use personal information
Enquiries and the business relationship. We use contact details and correspondence to answer questions, administer the relationship and send necessary service communications. When dealing with an employee of a business customer, we rely on legitimate interests in communicating with that business and operating the service. Where you personally contract with us as a sole trader, necessary processing to enter into or perform your contract relies on contract.
Billing and payment administration. We use billing and transaction records to collect agreed fees and manage invoices. We rely on contract where you are personally a party, and legitimate interests in administering the business relationship for corporate contact information. Retaining records to meet applicable tax and accounting requirements relies on legal obligation.
Security and misuse prevention. Where we determine this processing for our own systems, we use relevant access, account and technical information to investigate misuse, protect accounts and secure the service. We rely on legitimate interests in protecting our business, customers and Users, and legal obligation where a specific applicable duty requires the activity. This does not justify collecting unnecessary prompt content.
Support and service quality. We use enquiries and necessary diagnostic information to resolve issues and maintain our service. When we use this information for our own support operations, we rely on our legitimate interests in providing effective support. If the person requesting support is personally a party to the contract, we may instead rely on the contract. Information processed on a business customer's instructions is covered by the applicable Data Processing Agreement.
Legal requests and disputes. We use necessary records to comply with binding legal requirements, relying on legal obligation, and to establish, exercise or defend legal claims, relying on legitimate interests where appropriate.
Privacy choices and rights. We keep necessary request and preference records to fulfil legal duties and demonstrate that choices have been respected. We rely on legal obligation where required and otherwise legitimate interests in managing those choices responsibly.
Where we rely on legitimate interests, we assess the necessity of the processing and its effect on individuals and do not rely on that basis where their interests or fundamental rights override it. You can object as explained below. Acceptance of our Terms is not consent to every activity described in this policy.
Cookies and similar technologies
The website and portal may require cookies or similar technologies for functions such as maintaining a signed-in session and remembering security choices.
Where consent is legally required, we will obtain it before placing or accessing the relevant technology and provide a way to withdraw it. Where a statutory exception is relied on, we will meet its conditions, including information and objection requirements where applicable. Browser settings can also affect cookies, but disabling essential functionality may prevent sign-in or normal operation.
Who we share information with
We disclose information only as needed for the relevant purpose and subject to appropriate arrangements.
Service providers. We use managed providers for customer authentication, database hosting, portal hosting, server-side functions, payments and related billing services. Their roles differ by activity. A payment provider may have independent legal and fraud-prevention purposes as well as providing services to us.
Your organisation and authorised MSP. Authorised administrators can access relevant account, licence and configuration information within their permissions. This does not mean the current portal receives DLP Shield detection events or inspected content.
Professional advisers and authorities. We may disclose necessary information to advisers, auditors, regulators, courts or law-enforcement bodies where needed for their role and where there is a lawful basis.
Business transfers. Relevant information may be disclosed to a prospective or actual buyer, successor or adviser in connection with a business transaction, subject to appropriate confidentiality and data-protection safeguards. We will explain any material change of controller where required.
International transfers
Our customer database and authentication service are hosted in Frankfurt, Germany. Other providers may process information in relevant countries outside your own country. A database in Frankfurt does not establish that application execution, request logs, provider operations or support access are all confined to the EU.
Where a transfer is restricted under applicable law, it must be covered by an applicable adequacy arrangement or another lawful mechanism, such as properly completed standard transfer contracts and any necessary additional safeguards.
You can ask admin@smoandco.uk for information about the safeguards that apply to your information and a copy where applicable. We may redact information where necessary to protect confidential or security-sensitive details while explaining the relevant protection.
How long we keep information
We keep information only for as long as needed for its purpose, applicable legal obligations and any justified dispute or security needs. We distinguish our own controller records from customer-directed service data.
Necessary privacy and marketing choice records may be kept to demonstrate compliance and honour an objection or withdrawal. A minimal suppression record may be needed to avoid contacting someone again where promotional communications are used.
Information under a justified legal hold may be retained longer, with access restricted and the need reviewed. Backup information awaiting scheduled deletion is protected and unavailable for ordinary use. Locally inspected content not collected by us is not retained in our hosted database through scanning.
Security
We use reasonable and appropriate technical and organisational measures to protect the systems and personal information for which we are responsible. Access is limited to authorised tasks, and providers are subject to appropriate data-protection arrangements. Our commitments when acting as a processor will also be set out in the applicable Data Processing Agreement.
No online service or security product can guarantee complete protection. You should protect your account credentials, use available security controls and contact us promptly if you suspect unauthorised access. We do not claim a particular certification or insurance cover in this policy.
Your rights
Depending on the processing and applicable law, you may ask to access your personal information, correct inaccurate information, erase information, restrict processing or receive and transfer information under the right to data portability.
You may object to processing based on legitimate interests on grounds relating to your situation. You can object to direct marketing at any time, including associated profiling. If we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
These rights are subject to applicable conditions and exemptions. Contact admin@smoandco.uk to exercise them. We may request proportionate information to verify identity or clarify the request. Requests are normally free, and any permitted charge or refusal will be explained.
We will respond within the applicable statutory period, normally one month, and explain any lawful extension or other permitted adjustment. For information processed on an organisation's behalf, we will refer the request to that organisation and help it respond as required.
Automated detection and future capabilities
DLP Shield applies configured detection rules to supported content and may block a submission that matches them. False positives and false negatives are possible. The current local process does not report detection events to the portal. The organisation deploying the product decides its policies and should explain how to seek review of a blocking decision.
The Services may develop to use AI or machine learning, but a future capability is not a statement that we currently use it or send content to an external model. Material changes will be explained before the relevant processing begins.
Information needed to provide the Services
Certain business, account and payment information is needed to set up and administer a subscription. If the required information is not provided, we may be unable to create the account, process payment or provide the relevant function. We will distinguish optional information where applicable.
Children
Compliance Tools is designed for business and professional use and is not offered directly to children. We do not knowingly create accounts for children acting in their personal capacity.
Complaints
You can complain to us about our handling of personal information at admin@smoandco.uk. We will acknowledge and investigate complaints and respond in accordance with applicable law.
You also have the right to complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint. Where EU GDPR applies, you may also complain to the competent EEA supervisory authority.
Changes to this policy
We may update this policy as our service or processing changes. The date at the top identifies the current version. We will provide appropriate notice of material changes and information about new purposes before using information for them where required. Updating this policy does not replace any consent, contractual instruction or transfer safeguard required by law.