If you join a mailing list belonging to IPSEF, this applies to you.
We collect personal data on behalf of IPSEF when you subscribe to mailing lists. We may also be given your personal data by IPSEF.
The traffic generated when you open a message or click a link is recorded, and by requesting subscriptions you agree to that use; you may opt out of this tracking using your browser's Do Not Track setting. Your current web browser has this setting disabled.
We collect email address and any other personal data that you choose to provide. We record IP addresses, referrer URLs, and user agent strings used for subscription confirmations as we are required to record this information in order to be able to prove opt-in status.
The right to access your data lies with IPSEF, however, we provide a way for you to access, amend, or delete personal data that we manage on their behalf as part of our contract with them. Your personal data may be stored by more than one Smartmessages.net account holder, and your rights extend to all of them. You can access all of your data via our subscriber data access portal.
Your data can be exported in a machine-readable format (usually CSV) from our subscriber data access portal so that you can provide it to another service, or to inspect it yourself.
You may object to our use of your data in several ways (in order of convenience):
The only information we need from you is an email address, and so that is the only data that we require when subscribing to a mailing list. You are free to provide more personal data, and there may be opportunities for you to do so, but it is entirely voluntary. Your data may also be provided to us by IPSEF, and you may view and edit that data via our systems - see Subject Access Requests.
When sending email for marketing purposes, the responsible data controller must be clearly identified, so contact details for IPSEF are made available whenever you interact with us, such as when subscribing to a mailing list.
We record IP addresses, referrer URLs, and user agent strings when you confirm subscriptions to mailing lists because we are required to retain this information in order to be able to prove opt-in status, so it is exempt from our Do Not Track handling.
We do not store or process any data that is categorised as "sensitive", such as employment records, political affiliation, medical records, etc.
We hold your data for as long as subscriptions remain active. We monitor your open and click activity (though see Do Not Track below), and may use a lack of recorded activity to automatically delete your data so that we do not retain it for longer than is necessary or relevant. We retain unsubscribe data so that we can suppress future attempts to add your address back onto mailing lists other than by your own request.
We do not share your data or sell it to any third parties. We do not permit the use of bought-in mailing lists.
For the most part, we use no cookies at all. When necessary, we use only secure, first-party session cookies, containing no identifiable data, that are deleted as soon as you close your browser window. Since these are strictly necessary for the operation of our site, we do not ask for consent (in accordance with PECR). We do not use any third party services that require cookies. We don't use any tracking scripts either; you'll find all our sites are unpolluted by google, facebook, and other trackers.
IPSEF may use third-party tracking on their own sites, but they are outside our control.
We honour the standard "Do Not Track" mechanism built into browsers, which is usually controlled by a browser setting labelled something like "Ask websites not to track me". When this is set, we still record activity (typically message opens and clicks), but anonymously, without recording anything that would allow us to link to or identify you, such as your email or IP address. Your current web browser has this setting disabled.
There are two exceptions to this: we are required to retain proof of opt-in confirmation, so we record IP address, referrer URL, and user agent string when you confirm a subscription to a mailing list in order to do that. We also record your IP address when you log into the subscriber portal so we can track abuse or attempted break-ins.
We don't do any of that.
We have extensive security measures in place in order to keep your data safe. This includes using strong encryption wherever feasible, enforcing strong passwords, using 2-factor authentication, using servers in secure data centres, and ensuring that only authorised staff can access data. Bear in mind that you provide personal data at your own risk; nobody (including us) can guarantee 100% security. We may sometimes send you email messages that contain important links, such as if you need to reset a password or confirm a subscription; you should treat these as confidential, much as you would a password. You can read more about our security measures.
Our servers are located in London. We host at Equinix's Sovereign House and Harbour Exchange data centres in London's docklands, one of the UK's premier hosting locations, featuring clean, reliable power supplies, overspecified air conditioning, heavy physical security (retinal scanners etc). Our hosting provider is Mythic Beasts.
We perform some processing and host various resources (for example, our web site and help pages) on servers in France, hosted by gandi.net in Paris, but this does not involve personal data.
We will never export personal data out of the EU.
GDPR and PECR (and the forthcoming ePR) require reporting of personal data breaches; Under PECR, we are classed as a "Service Provider". Breaches can include:
Should a breach occur relating to your data, we will inform IPSEF (your data controller) by email to their account addresses, and it is their responsiblity to communicate with you, if necessary.
The applicable supervisory authority is the UK Information Commissioner's Office (ICO).
As we are a UK company, we are subject to the Data Protection Act 2018 (DPA), the Privacy and Electronic Communications Regulations (PECR), the EU General Data Protection Regulation (GDPR), and the (forthcoming) EU Electronic Privacy Regulation (ePR) in our role as a data processor for IPSEF, and as a data controller for our account holders.