1. Our commitment to data protection
ShopSmarty is committed to protecting the privacy, security and rights of people whose personal information we process.
We aim to handle personal information responsibly, transparently and in accordance with applicable United Kingdom data protection and privacy legislation, including:
the UK General Data Protection Regulation (“UK GDPR”);
the Data Protection Act 2018;
the Data (Use and Access) Act 2025 and amendments made by it; and
the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), where applicable.
This statement explains the principles we apply to our processing of personal information and the measures we take to support compliance.
It should be read together with our Privacy Policy, Cookie Policy, User Data Deletion Policy and any other privacy information provided when a particular ShopSmarty service or feature is used.
2. Who is responsible for your information
For the purposes of UK data protection law, the data controller responsible for personal information processed through ShopSmarty is:
Trading as: ShopSmarty
Registered office: Depot Road, Horsham
Privacy contact: [email protected]
Tel : 020 3432 1461
References in this statement to “ShopSmarty”, “we”, “us” and “our” mean the organisation identified above.
Where another organisation determines independently why and how it processes personal information, that organisation may act as a separate data controller. This may occur, for example, when you leave ShopSmarty and visit an independent retailer.
3. The data protection principles we follow
We design our handling of personal information around the principles of UK data protection law.
We seek to ensure that personal information is:
processed lawfully, fairly and transparently;
collected for specified, explicit and legitimate purposes;
adequate, relevant and limited to what is necessary;
accurate and kept up to date where necessary;
retained for no longer than is necessary;
protected using appropriate security measures; and
processed in a way for which we can demonstrate accountability.
We review our systems, policies and processing activities with these principles in mind.
4. Personal information we process
The information processed by ShopSmarty depends on how you use our website, app and services.
It may include account information such as your name, email address, authentication information and internal account identifier.
It may also include information generated through your use of ShopSmarty, such as favourites, wishlists, saved lists, recently viewed products, price alerts, notification preferences, product interactions, search activity and shopping preferences.
Where personalisation features are enabled or otherwise lawfully provided, we may also process information about categories, brands, retailers, products, price ranges and offers in which you appear to be interested.
Technical information may include browser and device information, session identifiers, IP address, pages visited, referral information, campaign information, interaction events, security information and diagnostic records.
If you communicate with us, we may process information contained in enquiries, complaints, privacy requests and other correspondence.
We do not ask users to provide special-category personal information through ordinary ShopSmarty shopping features and users should avoid submitting such information unless it is genuinely necessary.
If special-category personal information is ever processed, we will ensure that both an appropriate lawful basis and an additional condition required by data protection law apply.
5. Our lawful bases for processing
We identify an appropriate lawful basis before processing personal information.
Depending on the particular activity, ShopSmarty may rely on:
Contract
We may process information where it is necessary to provide a service you have requested or to take steps at your request before providing that service.
This may include creating and maintaining your account, authenticating you, providing saved lists, favourites, wishlists, account-based price alerts and other account functionality.
Legitimate interests
We may process information where this is necessary for a legitimate business or third-party interest and those interests are not overridden by your rights and interests.
Examples may include maintaining and improving ShopSmarty, understanding how our services are used, preventing fraud and abuse, maintaining security, measuring performance, improving product matching and recommendations, administering the service and protecting our legal rights.
Where appropriate, we carry out and document a legitimate interests assessment which considers the purpose of the processing, whether the processing is necessary and the effect on the people concerned.
Consent
We rely on consent where the law requires it or where we decide that consent is the appropriate basis.
Examples may include certain marketing communications, non-essential cookies or similar technologies, and particular optional features.
Where processing is based on consent, you can withdraw that consent. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Legal obligation
We may process personal information where necessary to comply with an obligation imposed by UK law, regulatory requirements, court orders or other binding legal requirements.
Other lawful bases recognised by UK data protection law will only be used where they genuinely apply to the circumstances.
6. Personalisation, recommendations and profiling
ShopSmarty is designed to make product discovery and comparison more relevant to individual users.
We may analyse information such as products viewed, saved or selected, categories explored, brands or retailers interacted with, searches, price ranges and engagement with ShopSmarty features.
This information may be used to:
rank or recommend products;
personalise product suggestions;
identify relevant offers or promotions;
improve search results;
recommend categories, retailers or brands;
determine which ShopSmarty content is most relevant; and
improve our product discovery and comparison systems.
This type of activity may constitute profiling under data protection law.
ShopSmarty does not intend to use this profiling to make decisions about users that produce legal effects or other similarly significant effects without appropriate safeguards.
If we introduce solely automated decision-making that has legal or similarly significant effects, we will assess the processing before launch and provide the information and protections required by applicable law.
7. Artificial intelligence and automated systems
ShopSmarty may use artificial intelligence, machine-learning systems or other automated tools to help operate or improve parts of the service.
These systems may support functions such as product classification, product matching, search, recommendations, content generation, shopping assistance, fraud detection, data quality and personalisation.
Where personal information is involved, we apply the same data protection principles to AI-supported processing as we do to other processing.
We consider the purpose and necessity of the processing, the information supplied to the system, the risks to users and whether additional safeguards or a Data Protection Impact Assessment are required.
We do not treat the use of artificial intelligence as removing ShopSmarty's responsibility for complying with data protection law.
8. Cookies, tracking and similar technologies
ShopSmarty may use cookies, local storage, pixels, SDKs and similar technologies to operate the website and app, remember preferences, maintain sessions, understand usage, measure performance and support marketing or personalisation.
Technologies that are strictly necessary to provide a service may be used without consent where permitted by law.
Where consent is required for non-essential technologies, we will seek that consent before using them.
Users can manage applicable preferences through our consent-management tools.
Further details are provided in our Cookie Policy.
9. Email, push notifications and direct marketing
ShopSmarty may send transactional or service communications that are necessary to operate an account or provide a requested service.
Promotional email, push notifications and other direct marketing are treated separately.
Where consent is required by PECR, we will seek the appropriate consent before sending marketing.
Where the law permits us to rely on an applicable existing-customer or similar exemption, we will only do so where its requirements are satisfied.
Every applicable electronic marketing message will provide an appropriate way to stop receiving further marketing.
Opting out of marketing does not necessarily prevent service messages that are necessary to operate an account or provide something you have requested.
We may retain a limited suppression record after an opt-out or account deletion where this is necessary to ensure that the person's marketing preference continues to be respected.
10. Sharing personal information
We do not sell personal information simply as a database of ShopSmarty users.
We may share personal information where necessary with organisations that help us operate ShopSmarty.
Depending on the service, these organisations may include providers of:
hosting, infrastructure, databases and content delivery;
authentication and account services;
email and notification delivery;
analytics and service monitoring;
customer support;
artificial intelligence and technology services;
security and fraud prevention;
professional, legal or accounting services; and
other technology required to provide ShopSmarty functionality.
Where a supplier processes personal information on our behalf, we assess the relationship and put appropriate contractual and organisational safeguards in place where required.
We may also disclose information where required by law, regulation, court order or another valid legal process, or where disclosure is reasonably necessary to establish, exercise or defend legal rights.
Retailers linked from ShopSmarty are generally independent organisations. When you follow a link to a retailer, that retailer's own privacy information applies to the information it collects.
11. International transfers
Some suppliers used to operate ShopSmarty may process personal information outside the United Kingdom.
Where this constitutes a restricted international transfer under UK data protection law, we take steps to ensure an appropriate transfer mechanism is in place.
Depending on the destination and circumstances, this may include:
UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK International Data Transfer Addendum to approved contractual clauses;
another legally recognised safeguard; or
a permitted statutory exception where appropriate.
Where required, we also assess whether the level of protection after transfer will remain adequate under the applicable UK data-protection test and consider whether supplementary safeguards are necessary.
12. Data minimisation and privacy by design
We aim to collect and process only the personal information reasonably necessary for the purpose concerned.
Data protection considerations form part of the design and development of new ShopSmarty services and material changes to existing services.
This includes considering what information is needed, who should have access to it, how long it should be retained, whether it should be identifiable and what protections are appropriate.
Where a proposed activity is likely to result in a high risk to people's rights and freedoms, we carry out a Data Protection Impact Assessment where required.
A DPIA considers the nature, scope, context and purpose of the processing, its necessity and proportionality, risks to individuals and measures that can reduce those risks.
13. Keeping information secure
ShopSmarty takes the security of personal information seriously.
We maintain technical and organisational measures designed to provide a level of security appropriate to the nature of the information and the risks associated with its processing.
Depending on the system and risk involved, measures may include access controls, authentication controls, restricted administrative permissions, software and infrastructure security, system monitoring, logging, backup and recovery arrangements, supplier controls and processes for responding to security incidents.
Access to personal information should be limited to people and service providers who reasonably need it for an authorised purpose.
Security measures are reviewed as ShopSmarty's technology and services develop.
No internet-connected system can be guaranteed to be completely secure, but we work to identify, reduce and manage foreseeable risks.
14. Personal data breaches
ShopSmarty maintains procedures for identifying, assessing and responding to suspected personal data breaches.
A personal data breach can include accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information.
Where a breach is reportable under applicable data protection law, we will notify the Information Commissioner's Office within the legally required period.
Where the law requires us to notify affected individuals, we will do so without undue delay and provide appropriate information about the incident and protective measures they may wish to take.
We also maintain records of relevant personal data breaches in accordance with our legal obligations.
15. Data retention
We do not intend to retain identifiable personal information indefinitely.
Retention periods are determined by considering:
why the information was collected;
whether it remains necessary for that purpose;
account and service requirements;
legal and regulatory requirements;
security and fraud-prevention requirements;
limitation periods for legal claims; and
whether the information can instead be deleted or anonymised.
Different types of information may therefore have different retention periods.
When personal information is no longer required, we take reasonable steps to delete it, anonymise it or otherwise remove it from ordinary processing.
Information contained in routine backups may remain until the relevant backup is replaced as part of the normal backup cycle.
16. Account deletion and the right to erasure
Registered ShopSmarty users can delete their account using the account deletion controls available through their account profile or through the ShopSmarty app.
Account deletion removes the user account and account-linked personal information that is no longer required.
This may include favourites, wishlists, saved lists, recently viewed products, price alerts, notification preferences, personalisation information and other account-linked records.
Some limited information may need to be retained where permitted or required by law, for example to comply with a legal obligation, deal with a legal claim, maintain security or preserve a marketing suppression record.
Full details are provided in our User Data Deletion Policy.
17. Your data protection rights
Depending on the circumstances and the lawful basis being used, UK data protection law provides individuals with rights concerning their personal information.
These can include:
the right to be informed about how personal information is used;
the right to request access to personal information;
the right to have inaccurate information corrected;
the right to request deletion of personal information;
the right to request restriction of processing;
the right to data portability in applicable circumstances;
the right to object to particular processing;
rights relating to automated decision-making and profiling; and
the right to withdraw consent where processing relies on consent.
These rights are not all absolute and exemptions may apply in particular circumstances.
We will respond to valid rights requests without undue delay and within the periods required by law. This will ordinarily be within one calendar month, subject to circumstances in which legislation permits additional time or affects when the response period begins.
We may request information reasonably necessary to verify identity before disclosing, changing or deleting personal information.
18. Objecting to direct marketing
You have the right to object to the use of your personal information for direct marketing.
Where you object to direct marketing, we will stop using your personal information for that purpose.
You can also use the unsubscribe mechanism included in applicable marketing communications or change available marketing and notification preferences through your ShopSmarty account.
19. Children and younger users
ShopSmarty is a general shopping and product-comparison service and is not specifically designed as a children's service.
We nevertheless consider whether our online services are likely to be accessed by children and assess the requirements of the ICO's Age Appropriate Design Code where applicable.
Where children's personal information is processed, the risks and safeguards associated with that processing require particular consideration, including data minimisation, transparency, profiling and privacy settings.
20. Data Protection Impact Assessments
We assess new projects and significant changes to existing processing to determine whether a Data Protection Impact Assessment is required.
A DPIA will be undertaken before processing begins where the proposed activity is likely to result in a high risk to individuals.
Particular attention may be given to activities involving extensive profiling, new technologies, significant monitoring, sensitive information or other processing capable of materially affecting individuals' privacy.
Where a high risk cannot be sufficiently reduced, we will consult the Information Commissioner's Office where the law requires this before commencing the processing.
21. Accountability and governance
ShopSmarty seeks to maintain appropriate organisational accountability for the personal information it processes.
Depending on the nature of the processing, this may include maintaining:
records of processing activities;
lawful-basis assessments;
legitimate interests assessments;
Data Protection Impact Assessments;
supplier and processor agreements;
security and incident records;
consent and marketing preference records;
retention arrangements;
privacy and data-protection policies; and
records relating to individual-rights requests and complaints.
We review privacy requirements when material changes are made to ShopSmarty services, technologies or business processes.
Where appointment of a Data Protection Officer is legally required, one will be appointed. Where a formal DPO is not required, responsibility for privacy compliance will be assigned internally to an appropriate person or function.
22. Making a data protection complaint to ShopSmarty
If you believe ShopSmarty has not handled your personal information appropriately, you can make a data protection complaint.
Please contact:
or use our contact page.
You do not need to quote the UK GDPR or use legal terminology in order to make a complaint.
We will maintain a process for receiving and investigating data protection complaints.
We will acknowledge receipt of a data protection complaint within the period required by law, investigate the matter appropriately and communicate the outcome without unjustifiable or excessive delay.
23. Complaining to the Information Commissioner's Office
You also have the right to raise concerns with the Information Commissioner's Office (“ICO”), the UK's independent data-protection regulator.
We would appreciate the opportunity to investigate and resolve a concern directly first, but this does not affect your right to contact the ICO.
Current information about making a complaint and contacting the ICO is available through the ICO's official website.
24. Changes to this GDPR statement
Data protection law, technology and the ShopSmarty service may change over time.
We may therefore update this statement where necessary to reflect changes to our processing, services, suppliers, technology or legal obligations.
The “Last updated” date at the top of this page identifies the current version.
Where a change materially affects the way we process personal information, we will provide additional notice where this is appropriate or legally required.
25. Contact us
Questions about this statement, the use of your personal information or your data-protection rights can be sent to:
Privacy contact: Privacy Officer
Email: [email protected]
Tel : 020 3432 1461
You can also contact us through the ShopSmarty contact page.
Last updated: 7 October 2026
