Privacy Policy

Last updated: 12 September 2026. Smart Approve Evolutions Group ("Smart Approve", "we", "us") operates the Smart Approve Property Platform — a jurisdiction-neutral property, compliance, workflow and finance platform serving the United Kingdom, Europe and the United States. This Global Privacy Policy applies to all users worldwide regardless of where they access the service.

1. Who we are and the scope of this policy

Smart Approve acts as a data controller (or "business" / "processor" where applicable) for personal data processed through the platform. Because the platform is international, this policy is designed to meet the highest applicable standard and to comply with the data protection laws of each jurisdiction in which we operate, including the UK GDPR and Data Protection Act 2018 (United Kingdom), the EU GDPR (European Economic Area), and US state privacy laws including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), together with equivalent laws in other US states and other jurisdictions. Where local law provides additional rights, those rights apply to residents of that jurisdiction.

2. Personal data we collect

We collect information you provide directly — such as your name, email address, organisation, role and contact details — when you register, are invited, contact us, or use the platform. In the property context we may also process tenancy, reference, guarantor, compliance and finance-related personal data on behalf of the organisations that use the platform. We also collect limited technical and usage data (device, IP address, browser, interaction logs) necessary to operate, secure and improve the service, and information collected via cookies and similar technologies (see our Cookie Policy).

3. How and why we use your data

We use personal data to provide and operate the platform; to create and manage your account and subscription; to process workflow, compliance, contractual and finance activities you or your organisation initiate; to communicate with you; to maintain security and prevent fraud; and to meet our legal, regulatory and accounting obligations. Where we process data on behalf of an organisation (for example, tenant or guarantor data entered by a landlord or agency), we do so as a processor acting on that organisation's documented instructions.

4. Legal bases for processing (UK and EU GDPR)

For individuals in the UK and EEA, we rely on the following lawful bases: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, and our legitimate interests (or those of a third party) where these do not override your rights and freedoms. For processing based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. International data transfers

The platform is designed to operate across the UK, Europe and the United States, so your personal data may be processed in, and transferred between, these and other regions in which we or our service providers operate. We protect international transfers using appropriate safeguards, including recognised transfer mechanisms such as UK International Data Transfer Agreements (IDTAs), the EU Standard Contractual Clauses, adequacy regulations where applicable, and supplementary measures where required. We will not transfer your data to a country or international organisation lacking an adequate level of protection unless appropriate safeguards are in place.

6. Your rights — global

Regardless of where you are located, you may have the right to: access the personal data we hold about you; rectify or correct inaccurate data; erase your data (subject to legal retention obligations); restrict or object to certain processing; receive a portable copy of your data; withdraw consent; and lodge a complaint with your local data protection authority or, in the US, your state Attorney General. Residents of California and other US states may also have the right to know what personal data is collected, request deletion, opt out of the "sale" or "sharing" of personal data and of certain targeted advertising and profiling, and not receive discriminatory treatment for exercising these rights. You may exercise any of these rights from within the platform or by contacting us (see section 10). We verify identity before responding and respond within the timeframes required by applicable law.

7. Data retention

We retain personal data only for as long as necessary to provide the service, comply with legal, tax, regulatory and accounting obligations, resolve disputes, and enforce our agreements. Retention periods reflect the requirements of the relevant jurisdiction — for example, UK and EU tax/accounting records, US state requirements, and landlord-tenant statutory retention — after which data is deleted or anonymised.

8. Children's data

The platform is a business service and is not intended for use by individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us and we will take steps to delete it.

9. Security

We apply appropriate technical and organisational measures to protect your data, including secure authentication, role-based access controls, multi-tenant data isolation, encryption in transit, monitoring, and regular review. However, no method of transmission or storage is completely secure.

10. Contact, changes and your supervisory authority

For privacy enquiries, to exercise your rights, or to opt out of the sale or sharing of personal data, please contact us through the Contact page. We may update this policy from time to time; the "Last updated" date above reflects the most recent version. You also have the right to lodge a complaint with your local data protection supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EEA, your national Data Protection Authority; and in the US, your state Attorney General.