How we handle your data.

Are you a footballer, a coach or a club? Our record of Scottish football squads is covered in section 6, including how to have yourself taken out of it.

1. Who we are and what this notice covers

bSMART AI Ltd ("we", "us") is a UK software company. We find the part of a business that costs too much or takes too long, redesign the process, then build and run the software that makes it work better. We also make TellMyCRM, a product for sales teams.

This notice covers everything we run that handles personal data:

• This website, and people who contact us.
• TellMyCRM, which has its own full notice on its own site.
• Software we build and run for customers, where the customer is the controller of the data and we process it on their instructions.
• Our record of Scottish football squads, which we hold as a controller.

For any question or request about your data, email [email protected]. We respond within one month.

2. This website, and contacting us

This website sets no cookies and runs no analytics or tracking scripts. There is nothing to consent to, which is why there is no cookie banner. The pages are stored in Amazon Web Services and served through Cloudflare, which sees your connection in transit in order to deliver the page and protect the site, as any content network does.

If you email us, we keep your name, your email address and what you tell us, so that we can reply and follow up. We rely on our legitimate interest in answering people who contact us. We keep the correspondence for as long as it is useful to the conversation and delete it on request.

3. TellMyCRM

TellMyCRM lets a sales team update and query their own CRM by message. It has its own privacy policy at tellmycrm.com, which is the full and governing notice for that product. In short:

• We process the messages and voice notes you send it, the CRM data you connect (read and written only on your instruction), your account details from Microsoft or Google sign-in, and your mobile number if you use WhatsApp. Voice notes are transcribed; the audio is not stored.
• Your CRM remains the system of record. We do not copy your customer database wholesale.
• The providers that run it for us are Supabase, Render, Twilio, Meta WhatsApp, OpenAI, Anthropic and Stripe. Each processes data only to provide its service to us. We never see or store your card number.
• We do not sell your data and we do not use it to train AI models.

Questions about TellMyCRM go to [email protected].

4. Software we build and run for customers

Most of our work is software built for one customer and run for them as a service: an admissions system for a school, match-day cover for a sports-data company, paperwork into a finance system. The personal data inside those systems belongs to the customer. The customer is the data controller; we are their processor, acting on their written instructions under an agreement with them.

If you are a person whose data is in one of those systems, such as a family that enquired at a school or a freelancer who works for one of our customers, the customer's own privacy notice applies and your rights are exercised with them. Email us anyway if you are not sure who to ask, and we will point you to the right place and help.

How we handle that data, whichever customer it belongs to:

• We process it only to run the system the customer has asked for, and only in the way they have agreed.
• It is hosted on infrastructure in the UK or the European Union, with providers such as Render, Supabase, Amazon Web Services and Cloudflare. Where a system sends text messages it uses Twilio. Where a system sends email it does so from the customer's own mailbox or ours, as agreed. Where a system needs driving times it uses mapping services.
• Where a system uses AI to read or draft something, the specific text being processed is sent to a commercial AI provider (Anthropic or OpenAI) under contracts that prohibit training on it. Nothing a person has not approved reaches a customer, a supplier or a business record.
• One customer's system cannot see another customer's data.
• When we stop working together, the customer's data is returned to them in a usable form and our copies are deleted, normally within ninety days, unless the law requires us to keep specific records.

5. What we never do

• We do not sell, rent or share personal data with advertisers or data brokers.
• We do not use customer content, messages, emails, documents or records to train AI models.
• We do not paste data into consumer AI products. Where AI is used it is through commercial APIs governed by contracts that prohibit training on the inputs.
• We do not let one customer see another customer's data.

6. Football squad records

This section is for players, coaches and club officials in Scottish football, and for the clubs themselves. It is separate from everything above.

We are telling you this here under Article 14 of the UK GDPR, which applies when an organisation holds information about someone it did not collect from that person directly. We publish it rather than writing to each person because writing to everyone individually would take more effort than the law requires.

What we hold

For each person in our squad records we may hold a name, a date of birth, the club they play for, their playing position and shirt number, their nationality, the dates they joined and left a club, and which source told us each of those things and when.

We hold no contact details, no address, no medical or performance information, and no salary or contract terms. We hold no special category data about anyone.

Where it comes from

• The clubs themselves. Most clubs confirm and correct their own squad through a portal we provide, or by email.
• Club websites. The squad pages clubs publish about their own teams.
• Club social media. Public posts clubs publish about their own matches, signings and departures, including team sheet graphics.
• Published football media and reference sites, including match reports and Transfermarkt.

Every source is either the club itself or material a club or a publisher has already made public. We do not follow anyone's personal accounts.

Why we hold it, and our lawful basis

To keep an accurate record of who plays for which club in the Scottish football pyramid, and to supply that record to football data and analytics companies who use it in their own products. Squad information at this level is scattered and often out of date, and a player who is recorded wrongly is a player who does not get looked at.

We rely on legitimate interests under Article 6(1)(f). We have assessed that against your rights and concluded it does not override them, because the information concerns your public sporting activity rather than your private life, almost all of it has already been published by your own club, and we hold nothing sensitive about you. You can ask us for a copy of that assessment and we will send it to you.

Who we share it with

We supply squad records to football data and analytics companies under contract. Those companies are data controllers in their own right and their own privacy notices cover what they do with it. We do not sell information to advertisers and we do not use it to market anything to you.

How long we keep it

Squad records are kept for the current season and three seasons afterwards, so that historic squads stay accurate. Stored copies of the web pages we read are deleted automatically after twelve months, unless a page is the evidence behind a record we still hold, in which case it is kept for as long as that record is.

Your rights, and how to be taken out

You can ask us for a copy of what we hold about you, to correct anything wrong, to delete it, or to object to our use of legitimate interests altogether. Email [email protected] and we will respond within one month. You do not need to give a reason.

If you ask to be removed, we add your name to a permanent do not hold list. That is how we make sure you are not picked up again the next time we read your club's website, because without it an automated collection would simply recreate your record within a day. That list holds your name and nothing else, and it exists only so that your request keeps working.

Players under 18

Some of the people in our records are under eighteen. We hold the same limited information about them as about anyone else and nothing more. A parent or guardian can exercise any of the rights above on their behalf, and we will act on a removal request for a young player without asking for a reason.

7. Where data lives, and how it is protected

Data is held on infrastructure in the UK or the European Union. Connections use TLS. Stored data is encrypted at rest. Access to production systems is limited to a small number of named people. Each provider named in this notice sees only what it needs to do its job, and we will tell affected customers of any material change to that list. A data processing agreement is available to any customer that needs one.

8. How long we keep data

• Website and contact correspondence: as long as it is useful, deleted on request.
• TellMyCRM: while the account is active, deleted on request or after closure, as its own notice says.
• Software we build and run: for as long as we run it for the customer, then returned and deleted as described in section 4.
• Football squad records: as described in section 6.

We may keep specific records longer where the law requires it, for example for accounting.

9. Your rights

Under the UK GDPR, and similar laws elsewhere, you can ask for a copy of your personal data, ask us to correct it, delete it, restrict how we use it, or give it to you in a portable form. You can object to processing based on legitimate interests. Email [email protected] and we will respond within one month. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10. Children

Our products and services are business tools and are not intended for children. The one exception is the football squad records, where some players are under eighteen; section 6 deals with that directly.

11. Changes to this notice

If we make a material change we will tell affected customers by email at least thirty days before it takes effect. The current version is always at this address, with the date of the last update at the top.

12. Contact

bSMART AI Ltd · [email protected] · 57 Sandy Lane, Charlton Kings, Cheltenham GL53 9DG