Privacy Policy

How Montvale Limited collects, uses and protects personal data when you use the Smartoo website, workforce platform and Smartoo Worker mobile app.

Last updated: 30 August 2026

This Privacy Policy explains how Montvale Limited ("we", "us", "our") collects, uses, stores and protects personal data when you visit smartoo.co.uk, use the Smartoo workforce platform at app.smartoo.co.uk, or use the Smartoo Worker mobile application (together, the "Services").

We are committed to handling personal data responsibly and in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Montvale Limited is the data controller for personal data collected through the Smartoo website and for account, billing and support information relating to organisations that subscribe to Smartoo.

Data controller: Montvale Limited
Registered address: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Privacy contact: hello@smartoo.co.uk

2. Our role and your employer's role

Smartoo is a workforce operations platform used by employers to manage rotas, site activity, attendance records and related operational information. If you use Smartoo or Smartoo Worker because your employer has given you access, your employer is generally the data controller for workforce and employee information processed in connection with your role.

Montvale Limited acts as a data processor on behalf of subscribing organisations when handling employee and workforce information on their instructions, and as a data controller for information we collect directly to operate the Services, manage customer accounts, provide support and maintain the security of our systems.

If you have questions about how your employer uses your workforce data, please contact your employer in the first instance. We can assist where appropriate and where we are permitted to do so under our agreement with your organisation.

3. Personal data we handle

Depending on how you use the Services, we may process the following categories of personal data:

  • Identity and contact information — such as your name and email address.
  • Account and user identifiers — information used to create, authenticate and manage your Smartoo account.
  • Company and role information — such as your employer, assigned permissions, job role and access level within Smartoo.
  • Workforce and operational information — including assigned shifts and sites, Sign In, Check Call and Sign Out records, patrol or logbook notes, holiday requests, and instruction acknowledgements entered or generated through the Services.
  • Support and communications — messages you send to us, demo requests, enquiries submitted through the website, and records of support interactions.
  • Technical and security information — such as device and browser type, IP address, log files, authentication events and other information necessary to secure, maintain and improve the Services.

Smartoo Worker app: Smartoo Worker currently does not use advertising tracking, does not sell personal data, and does not collect precise location data, contacts, photos, health information or payment information.

4. How we use personal data

We use personal data for the following purposes:

  • Providing, operating and maintaining the Services.
  • Enabling employers to manage workforce rotas, site activity, attendance records and related operational workflows.
  • Creating and administering user accounts and access controls.
  • Responding to enquiries, demo requests and customer support.
  • Sending service-related communications, such as account notices and security alerts.
  • Monitoring, troubleshooting, securing and improving the performance and reliability of the Services.
  • Complying with legal obligations and protecting our legal rights.

5. Lawful bases for processing

Where Montvale Limited acts as data controller, we rely on one or more of the following lawful bases under UK GDPR, depending on the circumstances:

  • Contract — where processing is necessary to provide the Services or take steps at your request before entering into a contract.
  • Legitimate interests — where processing is necessary for our legitimate interests in operating, securing and improving the Services, provided those interests are not overridden by your rights and interests.
  • Legal obligation — where we need to comply with applicable law.
  • Consent — where required, for example for certain optional communications. You may withdraw consent at any time where consent is the basis of processing.

Where we process workforce information on behalf of an employer, that organisation is responsible for determining the lawful basis for processing under UK GDPR.

6. How we share personal data

We do not sell personal data. We may share personal data with:

  • Service providers who help us host, operate, secure, communicate and support the Services, such as cloud hosting, email delivery, authentication and infrastructure providers. These providers process data only on our instructions and subject to appropriate contractual safeguards.
  • Your employer or organisation, where you use Smartoo or Smartoo Worker through a customer account.
  • Professional advisers, where reasonably necessary, such as lawyers, accountants or insurers.
  • Regulators, courts or law enforcement, where required by law or to protect rights, safety and security.

7. International transfers

Some of our service providers may process personal data outside the United Kingdom. Where personal data is transferred internationally, we take appropriate steps to ensure it receives a similar level of protection, such as using UK-approved transfer mechanisms or contractual safeguards required under UK data protection law.

8. Data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services, meet contractual and legal requirements, resolve disputes and enforce our agreements.

Retention periods may vary depending on the type of data, the nature of our relationship with you or your organisation, and applicable legal or operational requirements. When data is no longer required, we delete it or anonymise it where appropriate.

Workforce information controlled by an employer is retained in accordance with that organisation's instructions and applicable law.

9. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These measures include access controls, authentication, company-level data separation within the platform, and monitoring of our systems.

No method of transmission over the internet or electronic storage is completely secure. While we work to protect personal data, we cannot guarantee absolute security.

10. Your rights

Under UK data protection law, you may have the following rights in relation to your personal data, subject to applicable conditions and exemptions:

  • The right to access your personal data.
  • The right to rectification of inaccurate personal data.
  • The right to erasure in certain circumstances.
  • The right to restrict processing in certain circumstances.
  • The right to data portability in certain circumstances.
  • The right to object to processing in certain circumstances.
  • Rights relating to automated decision-making and profiling, where applicable.

If your employer is the data controller for workforce information, you should contact them to exercise those rights in the first instance. We will support our customers in responding to valid requests where we act as processor.

To make a privacy request relating to information for which Montvale Limited is controller, contact us at hello@smartoo.co.uk. We may need to verify your identity before responding.

11. Complaints

If you have concerns about how we handle personal data, please contact us first at hello@smartoo.co.uk and we will try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues: ico.org.uk.

12. Children

The Services are intended for business and workforce use and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, please contact us and we will take appropriate steps.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, legal requirements or business practices. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

14. Contact us

If you have any questions about this Privacy Policy or our use of personal data, contact:

Montvale Limited
71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Email: hello@smartoo.co.uk