1. Who we are

This policy applies to SMEAutomate, a service operated by Automate Holdings Ltd (“we”, “us”, “our”). We are the data controller for personal data collected through this website and our services.

Contact: hello@smeautomate.com — smeautomate.com

2. What data we collect

We collect the following categories of personal data:

• Contact details — name, email address, phone number, and company name submitted via our contact, booking, or assessment forms.
• Assessment responses — answers you provide in our workflow assessment and fit-test tools, used to generate your automation score and recommendations.
• Usage data — anonymised analytics collected via Plausible Analytics, including pages visited and general geographic region. No cookies are used for this purpose and no personal identifiers are stored.

We do not collect payment card data directly. Any future payment processing will be handled by a PCI-DSS compliant third party.

3. How we use your data

We use personal data for the following purposes:

• Responding to enquiries and booking requests
• Generating and delivering your automation assessment report
• Sending transactional emails related to your submission or booking
• Improving our website and services through aggregated, anonymised analytics
• Complying with legal obligations

4. Legal basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Legitimate interests — responding to business enquiries and providing the services you have requested.
• Contractual necessity — processing required to fulfil a service you have engaged us for.
• Consent — where you have explicitly opted in to receive marketing communications.
• Legal obligation — where processing is required by applicable law.

5. Third-party processors

We share data only with processors necessary to operate our services:

• Resend — transactional email delivery. Data is processed in accordance with their DPA.
• Neon — managed Postgres database hosting. Form submissions are stored securely.
• Vercel — website hosting and edge infrastructure.
• Plausible Analytics — privacy-first, cookieless analytics. No personal data is transferred to Plausible.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

6. Data retention

We retain contact and assessment data for up to 24 months from the date of submission, or until you request deletion. Anonymised analytics data is retained indefinitely as it contains no personal information.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data (“right to be forgotten”)
• Object to or restrict processing
• Data portability (receive your data in a structured, machine-readable format)
• Withdraw consent at any time, where consent is the basis for processing

To exercise any of these rights, email us at hello@smeautomate.com. We will respond within one calendar month.

8. Cookies

This website does not use tracking or advertising cookies. Our analytics provider (Plausible) operates without cookies and does not fingerprint individual users. No cookie consent banner is required.

9. International transfers

Some of our processors operate infrastructure outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, including UK adequacy decisions or Standard Contractual Clauses where required.

10. Complaints

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns first — please contact us at hello@smeautomate.com.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to users who have provided contact details. The “last updated” date at the top of this page reflects the most recent revision.