01 Scope and responsibility

This Privacy Policy applies to personal information processed through the SmartApps website, consultation and project-enquiry forms, client communications, support services, software platforms and other services that link to this policy.

SmartApps Limited may act as a data controller when we determine why and how personal information is processed. When we process information on behalf of a client through a system or service we provide, we may act as a data processor, while the client may remain responsible for determining the purpose of that processing.

A client-specific agreement, data-processing agreement or service notice may provide additional terms for a particular platform or project. Where applicable, those terms should be read together with this policy.

02 Information we collect

The information we collect depends on how you interact with SmartApps.

If payment is made through a third-party payment provider, payment-card information is generally submitted directly to that provider. SmartApps may receive a transaction reference, payment status and other limited information required to manage the transaction.

Please do not provide sensitive personal information unless it is necessary for an agreed service and SmartApps has confirmed an appropriate method for submitting it.

03 How we use personal information

SmartApps may use personal information to:

• respond to enquiries and consultation requests;
• prepare proposals, quotations, contracts and project plans;
• provide, configure, maintain and support our services;
• create and administer accounts and access permissions;
• process billing, payments and financial records;
• communicate service notices, security information and project updates;
• diagnose faults, monitor performance and improve reliability;
• protect our systems, clients and users against fraud, misuse and security threats;
• understand website use and improve our services and content;
• send marketing information where permitted and provide an opt-out mechanism;
• meet accounting, regulatory, legal and contractual obligations; and
• establish, exercise or defend legal rights.

04 Legal grounds for processing

Depending on the circumstances, SmartApps may process personal information because:

• you have given consent for a specified purpose;
• processing is necessary to enter into or perform a contract;
• processing is required to comply with a legal obligation;
• processing is necessary to protect a person’s vital interests;
• processing is authorised or required in the public interest or under applicable law; or
• processing is necessary for a legitimate business interest that does not improperly override your rights and interests.

Where processing is based on consent, you may withdraw that consent. Withdrawal does not invalidate processing that was lawfully carried out before the withdrawal.

05 How we share information

SmartApps may disclose information only where reasonably necessary to:

• service providers supporting hosting, cloud infrastructure, communication, analytics, payment processing, security, professional advice or technical operations;
• employees, contractors and project partners who require access for an authorised business purpose;
• a purchaser, successor or adviser involved in a merger, acquisition, restructuring or sale of all or part of the business;
• a court, law-enforcement body, regulator or public authority where disclosure is required or lawfully requested;
• protect SmartApps, our clients, users or other persons from fraud, security threats, misuse or harm; or
• enforce an agreement or establish, exercise or defend legal rights.

Service providers are expected to process information only for agreed purposes and to apply appropriate confidentiality and security protections.

SmartApps may share aggregated or de-identified information that does not reasonably identify an individual.

06 AI services and client-provided data

Some SmartApps services may include artificial intelligence, document processing, chat assistants, workflow automation or predictive functionality. Information submitted to these services may be processed to provide the requested output, operate the workflow, monitor performance and maintain security.

Clients are responsible for ensuring that they have an appropriate legal basis and authority to provide personal information for processing through a client-controlled system.

Unless specifically agreed, users should not submit confidential, sensitive or legally restricted information into an AI feature. Project-specific agreements may establish additional controls concerning model providers, data storage, retention, access, human review and use of submitted information.

07 Cookies, analytics and communications

Cookies

A cookie is a small identifier stored by your browser. SmartApps may use necessary cookies to support security, sessions, preferences and website functionality. With appropriate consent where required, we may also use analytics or marketing cookies.

Website analytics

We may collect information such as IP address, device and browser details, pages viewed, visit duration, referring source and interactions. This information helps us understand website performance and improve content and services.

Email communications

Service emails may be sent when required to manage an account, project, security matter or client relationship. Marketing messages may include mechanisms that help measure delivery or engagement. You can opt out of marketing emails using the unsubscribe instructions provided in the message or by contacting us.

Opting out of marketing does not prevent SmartApps from sending essential transactional, project, account or security communications.

08 Security and retention

Information security

SmartApps uses reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, alteration, loss, misuse or disclosure. Measures may include access controls, authentication, encryption, backups, monitoring, staff confidentiality obligations and security reviews.

No website, internet transmission or storage system can be guaranteed to be completely secure. Users are responsible for protecting their passwords, devices and account credentials.

Retention

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, including providing services, maintaining business and financial records, resolving disputes, enforcing agreements and meeting legal obligations.

Retention periods vary according to the type of information, contractual requirements, sensitivity, security considerations and applicable law. When information is no longer required, it may be securely deleted, anonymised or archived where legally permitted.

09 International data transfers

SmartApps may use cloud, communication, payment or technical service providers located outside Malawi. This may result in personal information being processed or stored in another country.

Where personal information is transferred internationally, SmartApps will seek to use a lawful transfer basis and appropriate safeguards required by applicable law. These may include contractual protections, approved service-provider terms, consent where appropriate or other recognised transfer mechanisms.

10 Your privacy rights

Subject to applicable law and any lawful limitations, you may have the right to:

• request confirmation that SmartApps processes your personal information;
• access personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of information in appropriate circumstances;
• object to or request restriction of certain processing;
• withdraw consent where processing is based on consent;
• request portability of eligible information;
• object to direct marketing;
• request human review where a significant decision is based solely on automated processing; and
• submit a complaint to the relevant data-protection authority.

To exercise a right, contact enquires@smartapps.mw. We may need to verify your identity and clarify the request before responding. Some requests may be limited where retaining or processing information is required by law or necessary to protect the rights of another person.

You may also contact the Malawi Data Protection Authority regarding concerns about the handling of personal information.

11 Children’s privacy

The general SmartApps website and commercial services are not directed to children under 18. We do not knowingly collect personal information directly from a child without an appropriate legal basis and, where required, consent or authorisation from a parent, guardian, school, client or other authorised party.

Some systems developed or operated for educational institutions or other clients may process information relating to children under the client’s instructions. In such cases, the relevant institution or client is generally responsible for providing appropriate notices, obtaining required authorisation and determining the lawful purpose of processing.

If you believe a child has provided personal information to SmartApps without appropriate authorisation, contact us so that we can investigate and take suitable action.

12 Changes to this policy

SmartApps may update this Privacy Policy to reflect changes to our services, technology, business practices or legal obligations. The revised version will be published on this page with an updated effective or “last updated” date.

Where a change materially affects how personal information is handled, we may provide additional notice through the website, email, account interface or another appropriate communication channel.

13 Contact SmartApps