Privacy Policy

Smart HSE is an NVQ guidance and consultancy service operating primarily from the United Arab Emirates and supporting candidates in the UAE, the United Kingdom, Pakistan, and internationally. We help candidates achieve UK NVQ Levels 6 and 7 (and other levels) through expert guidance and our proprietary AI-assisted evidence-building platform.

For the purposes of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”), the UK General Data Protection Regulation (“UK GDPR”), and other applicable data-protection laws, Smart HSE is the data controller of personal data described in this policy.

2.1 Identity & contact data

• Full name, email address, phone number, country of residence.
• Job role, current qualifications, and the NVQ level you’re interested in.
• Information you submit via Meta (Facebook / Instagram) Lead Forms, our website contact form, sign-up form, or in messages to us.

2.2 Conversation & communication data

• The content of messages exchanged on Facebook Messenger, WhatsApp, email, and our contact forms, including any attachments.
• Call notes from voice or video consultations.

2.3 Account & portfolio data

• Account credentials (email and a hashed password) when you register on our portal.
• Evidence, documents, photos, reflective accounts, witness testimonies, certificates and any other portfolio material you upload, generate, or share with us in connection with an NVQ.
• Progress, assessment notes, and feedback created during your NVQ journey.

2.4 Payment data

• If you purchase a package, payment details are processed by our third-party payment processors. We do not store full card numbers on our servers.

2.5 Technical & usage data

• IP address, approximate location (country / city), device type, browser type and version, operating system, and language settings.
• Pages visited, time spent on pages, links clicked, and referring URL.
• Information stored in essential cookies and similar technologies (see Section 10).

We use personal data to:

• Respond to enquiries submitted via lead forms, Messenger, WhatsApp, email, or the website.
• Provide free NVQ eligibility assessments and consultations.
• Deliver the services you have purchased — guidance, mentoring, AI-assisted evidence building, portfolio review, and assessment support.
• Create and administer your portal account and authenticate you when you log in.
• Process payments and issue receipts.
• Send service-related messages (e.g. booking confirmations, portfolio reminders, account notices).
• Send marketing communications about NVQ courses, new services, and offers — only where you have consented or where permitted by law. You can opt out at any time.
• Improve our website, AI tools, and services through analytics and feedback.
• Detect, prevent, and respond to fraud, abuse, security incidents, and unlawful activity.
• Comply with legal, regulatory, accounting, and reporting obligations.

Our platform uses artificial-intelligence models to help you structure NVQ evidence, draft reflective accounts, map your work to qualification standards, and identify gaps in your portfolio.

• Content you upload may be transmitted to trusted third-party AI providers (such as large-language-model APIs) strictly to perform the requested task and return results to you.
• We instruct our AI sub-processors not to use your content to train their models. We use API plans that contractually exclude training where available.
• Outputs generated by AI are drafts and suggestions only — final responsibility for the accuracy, authenticity, and authorship of NVQ evidence rests with you, the candidate. We do not fabricate evidence, and you must not submit AI-generated content as work you did not actually perform.
• You can request deletion of any AI-processed content at any time (see Section 9).

For users in the United Kingdom or European Economic Area, we rely on the following legal bases:

• Contract — to deliver the services you’ve purchased or requested (e.g. NVQ guidance, AI evidence tools, account administration).
• Legitimate interests — to respond to enquiries, secure our platform, prevent fraud, and improve our services, where these interests are not overridden by your rights.
• Consent — for marketing emails, non-essential cookies (if any are introduced), and any optional data sharing. You can withdraw consent at any time.
• Legal obligation — where we are required to retain or disclose data by applicable law (e.g. tax, anti-fraud).

For users in the UAE, we process personal data in accordance with the UAE PDPL on the lawful bases of contract performance, your consent, and our legitimate interests.

We do not sell your personal data. We share it only with:

• Hosting & infrastructure providers — including DigitalOcean, which hosts our website and application servers.
• Communication tools — Meta Platforms, Inc. (for Facebook / Instagram lead forms, Messenger, WhatsApp Business), and our email provider.
• AI sub-processors — providers of large-language-model APIs used to power our AI evidence tools, under contracts that restrict their use of your data.
• Payment processors — to process payments for our packages.
• NVQ awarding bodies and assessors — only where you have engaged us to support a specific qualification and you have authorised us to do so on your behalf.
• Professional advisers — accountants, auditors, and lawyers, where required.
• Authorities — where disclosure is required by law, court order, or to protect our rights.
• Successors — in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

Because we operate in the UAE and serve candidates internationally, your personal data may be transferred to, stored, or processed in countries outside your country of residence — including the UAE, the United Kingdom, the European Union, the United States, and other jurisdictions where our service providers operate.

Whenever we transfer personal data internationally, we use appropriate safeguards such as:

• Transfers to jurisdictions deemed to provide an adequate level of protection.
• Standard contractual clauses (SCCs) approved by the UK Information Commissioner’s Office or the European Commission, where applicable.
• Provider commitments equivalent to those required under the UAE PDPL.

We keep personal data only for as long as necessary for the purposes set out in this policy:

• Lead enquiries that don’t become customers — typically up to 24 months from last contact, then deleted or anonymised.
• Customer accounts and portfolio content — for as long as your account is active, plus up to 6 years after closure to meet legal, tax, and audit obligations, unless you request earlier deletion.
• Payment records — retained for the period required by tax and accounting laws (typically 5–7 years).
• Marketing data — until you unsubscribe or 24 months of inactivity, whichever is sooner.

Depending on where you live, you may have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your data (subject to legal retention obligations).
• Restriction — ask us to limit how we use your data.
• Objection — object to processing based on legitimate interests, or to direct marketing at any time.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting prior processing.
• Lodge a complaint — with the UAE Data Office, the UK Information Commissioner’s Office (ICO), or your local data-protection authority.

To exercise any right, email privacy@smarthse.ai. We will respond within 30 days. We may need to verify your identity before processing the request.

We use a small number of essential cookies to make the website work — for example, to keep you signed in, remember your theme preference, and protect against fraud. These cookies do not require consent under applicable laws because they are strictly necessary.

We currently do not deploy a Meta Pixel, Google Analytics, or other third-party advertising or analytics trackers on smarthse.ai. If we introduce any in future, we will update this policy and request your consent where required.

You can control or delete cookies through your browser settings. Disabling essential cookies may prevent parts of the website from functioning properly.

We use industry-standard technical and organisational measures to protect your personal data, including encryption in transit (HTTPS / TLS), hashed passwords, access controls, principle-of-least-privilege server access, and routine security review of our infrastructure.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities where required by law.

Our services are intended for adults aged 18 and over working in regulated professions. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The “Last updated” date at the top of this page tells you when the policy was last revised. For material changes, we will give you reasonable notice — for example, by email or a notice on the website — before the change takes effect.

If you have any questions about this Privacy Policy or how we handle your personal data, get in touch:

We aim to respond to all privacy enquiries within 30 days.