Privacy Notice
This notice covers this tool only. It sits alongside the Smart Spaces Privacy Notice, which governs Smart Spaces as a whole. Where the two differ on how this assessment works, this page is the more specific and more accurate one.
1. Who is responsible for your information
Smart Spaces Global Ltd is the data controller. That means we decide what is collected here and why, and we are accountable for it.
- Registered in England and Wales, company number 07116878
- Ground Floor, Portsoken House, 155–157 Minories, London, EC3N 1LJ
- Data protection contact: dpo@smartspaces.app
Our representative in the EU is Ireland DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland — datarequest@datarep.com.
Right on the Line Limited built this tool and operates it on our behalf. They act as our processor: they handle this data only on our written instructions and cannot use it for their own purposes.
2. The HID partnership, and what it does not mean
HID does not receive what you enter here. This tool is co-branded because Smart Spaces is an official HID partner, and you will see both names in the header, the footer and the email we send you. That is a commercial partnership, not a data-sharing arrangement.
HID is not a controller or a processor of anything you submit through this assessment. Your answers and contact details go to Smart Spaces' own systems. HID sees them only if we specifically and manually decide to share something with them — for example, if you ask us to introduce you to HID about a particular product. There is no automatic feed, no shared database and no background sync.
3. What we collect
Your assessment answers
Everything you select as you work through the scorecard and the configurator: the perspective you chose at the start, your fifteen readiness answers and the five dimension scores they produce, your building type, size, occupancy and sector, what systems you already have, and the priorities and challenges you pick. This is information about your building and your organisation, not about you personally, but it is stored against your contact record so we treat it as personal data throughout.
Your contact details
At the point you ask for your report or blueprint, we collect your first name, last name, work email address, company and job title. We do not ask for a phone number or a postal address.
Your cookie choices
The choice you make in the cookie banner, when you made it, which version of the notice was showing at the time, whether your browser sent a Global Privacy Control signal, and a random identifier for that choice so we can prove what was agreed without needing to identify you. See the Cookie Notice for the detail.
What we deliberately do not collect
- We do not ask for, and have no use for, any special category data — health, ethnicity, political opinions, religious beliefs, trade union membership, biometrics or sexual orientation.
- We do not build a profile of you across other websites unless you switch on marketing cookies.
- We do not buy contact data about you from anyone else to enrich what you give us here.
4. Why we use it, and our lawful basis
| What we do | Lawful basis (UK/EU GDPR) |
|---|---|
| Score your answers and generate your report or blueprint | Legitimate interests — you asked for the result, and producing it is the whole point of the tool |
| Email you the link to your results | Legitimate interests — delivering the thing you requested. This is a transactional email, not marketing |
| Follow up with you about this specific assessment | Legitimate interests — you gave us a work email in a business context and asked for a business assessment. You can tell us to stop at any time |
| Send you unrelated marketing about our products, events and offers | Consent — only if you ticked the optional box. Never bundled with getting your results |
| Set performance or marketing cookies | Consent — only what you agreed to in the cookie banner |
| Look at anonymous, aggregated answers to benchmark you against peers and improve the questions | Legitimate interests — no individual is identifiable in this |
| Keep records of consent and comply with our legal obligations | Legal obligation, and our legitimate interest in being able to demonstrate compliance |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that a business person who has just asked for a business assessment would reasonably expect us to produce it and to follow up about it. You can object to any of it — see your rights.
5. How we use AI
To make your report read like it was written about your building rather than assembled from templates, we send a short summary to OpenAI and ask it to write the rationale for each recommendation.
What is sent: your company name, your dimension scores, the stage you reached, your building profile answers and your selected priorities. What is not sent: your name, your email address or your job title.
The output is descriptive text only. Nothing about the assessment is a decision with a legal or similarly significant effect, so the rules on solely automated decision-making in Article 22 do not apply. If the AI call fails, the tool falls back to standard written descriptions and your report is still produced.
6. Who we share it with
We do not sell your information, and we do not share it with advertisers. We use the following processors to run the tool:
| Who | What they receive | Why | Where |
|---|---|---|---|
| Right on the Line Limited | Everything, as our operator | Built and maintains the tool on our instructions | United Kingdom |
| MongoDB Atlas | Your contact details, answers, scores and consent record | The database this tool stores submissions in | Managed cloud hosting |
| Render | Technical data in transit, server logs | Runs the application itself | Managed cloud hosting |
| OpenAI | Company name, scores and priorities. No name, email or job title | Writes the tailored rationale in your report | United States |
| MailerSend | Your email address and first name | Sends you the link to your results | European Union |
| HubSpot | Your contact details, answers, scores and consent record | Smart Spaces' own customer records, so our team can follow up | European Union / United States |
| Google (Tag Manager, Analytics) | Usage data only, and only if you accept optional cookies | Understanding how the tool is used. Not currently active — see the Cookie Notice | United States |
| Adobe (Typekit) | Your IP address, when the page loads a font | Serves the typeface. Sets no cookies. See the Cookie Notice | United States |
We may also disclose information if we are required to by law, or to establish or defend legal claims. If Smart Spaces is ever sold or reorganised, records may transfer to the acquiring business, which would remain bound by this notice.
7. Where your information goes
Your information is stored in the United Kingdom and the European Economic Area wherever possible. Some of the processors above are based in, or route data through, the United States. Where information leaves the UK or the EEA we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision, together with additional safeguards where those are needed.
8. How long we keep it
We keep your submission for 24 months from the date you complete the assessment, then it is deleted.
This is enforced automatically by the database rather than by someone remembering to run a clean-up, so it happens whether or not anyone is watching. Deleting the submission also breaks your results link — see below.
Your contact record in our HubSpot system is governed separately by the Smart Spaces Privacy Notice, and by any marketing preference you have set. Your cookie choice is stored in your own browser for 180 days.
9. Your results link
Your results link is unguessable, but it is not password-protected.
We give you a link like /results/<id> so you can come back to your
report and share it with colleagues. Nobody can guess that address. But anyone
you send it to — or anyone who finds it forwarded, pasted into a chat, or
in a browser history — can open it and see your name, company, job title
and answers.
Treat it the way you would treat any document you would not want forwarded without your say-so. The link stops working when the submission is deleted at 24 months, and we will delete it sooner if you ask.
10. Your rights
Under UK and EU data protection law you have the right to:
- ask for a copy of the information we hold about you
- have inaccurate information corrected
- have your information deleted
- object to us using it, including for direct marketing — we will always stop marketing when you ask
- ask us to restrict how we use it while a question is resolved
- receive it in a portable, machine-readable format
- withdraw consent at any time, without affecting anything done before you withdrew it
To exercise any of these, email dpo@smartspaces.app. You do not have to give a reason and we will not charge you. To change your cookie choices, use Cookie Settings — available in the footer of every page.
If you are not happy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your own country. We would rather you came to us first so we can put it right.
11. Children
This is a business tool for people responsible for buildings. It is not directed at children and we do not knowingly collect information from anyone under 18. If you believe a child has submitted information here, contact us and we will delete it.
12. Security
Traffic to and from this tool is encrypted in transit. Access to the database and to our HubSpot records is restricted to people who need it for their job. Our processors are bound by written contracts requiring appropriate technical and organisational security measures.
No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, you.
13. Changes to this notice
If we change anything material — a new processor, a new purpose, a change of lawful basis — we update the version number at the top of this page. If the change affects cookies we also reset the cookie banner, so you get asked again rather than being carried over on a choice you made about something else.
14. How to contact us
Smart Spaces Global Ltd, Ground Floor, Portsoken House, 155–157 Minories, London, EC3N 1LJ — dpo@smartspaces.app.
See also our Cookie Notice and Terms of Use, and the overarching Smart Spaces Privacy Notice.