Privacy Policy

Smythe Geanga Ltd ("we", "us", "our") operates the Aperio FM platform. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our website at aperio-fm.com and the Aperio FM software-as-a-service platform (collectively, the "Service").

We are registered in England and Wales (company number 16677693) and our registered office is 3rd Floor, 86-90 Paul Street, London EC2A 4NE. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information we collect

Account information

When you register for an account, we collect your name, email address, password (hashed), and the name of your organisation. You can optionally add a phone number and job title to your profile later.

Usage data

We automatically collect information about how you interact with the Service, including your IP address, browser type, operating system, the actions you take within the platform, and timestamps. This is used for security and audit purposes.

Platform data

As a facilities management platform, Aperio FM stores data that you and your team enter into the system, including work orders, asset records, compliance certificates, contractor details, financial records, documents, and other operational data. This data belongs to you and your organisation.

Cookies and tracking

We use strictly necessary cookies and similar technologies to maintain your session, keep your account secure, and remember your preferences. For full details, see our Cookies Policy.

2. How we use your information

We use your personal data for the following purposes:

• To provide, operate, and maintain the Service.
• To create and manage your account and authenticate your identity.
• To manage your subscription and respond to enquiries about plans and pricing.
• To send you transactional emails (account confirmations, password resets, subscription updates, and compliance alerts configured within the platform).
• To respond to your support requests and communicate with you about the Service.
• To detect, prevent, and address technical issues and security threats.
• To comply with legal obligations.

3. Legal bases for processing

We process your personal data under the following legal bases:

• Contractual necessity: Processing necessary to perform our contract with you (providing the Service).
• Legitimate interests: Processing necessary for our legitimate business interests (improving the Service, preventing fraud, ensuring security), where these interests are not overridden by your rights.
• Consent: Where you have given explicit consent (e.g. marketing communications).
• Legal obligation: Processing necessary to comply with applicable laws.

4. Data storage and security

Your data is stored on secure servers in the United Kingdom. We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), role-based access controls, and two-factor authentication options.

Each tenant's data is logically isolated within our multi-tenant architecture. Your organisation's data is not shared with or accessible to other tenants.

5. Data sharing

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service providers: Third-party providers who assist us in operating the Service (hosting, content delivery, email delivery), bound by data processing agreements.
• Legal authorities: Where required by law, court order, or governmental regulation.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate notice provided to affected users.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you cancel your subscription, we will retain your data for up to 90 days to allow for data export, and will then delete it, unless we are required by law to retain certain records (e.g. financial records for tax purposes).

7. Your rights

Under the UK GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Restriction: Request restriction of processing in certain circumstances.
• Portability: Request transfer of your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

8. International transfers

We store your personal data in the United Kingdom. Some third-party service providers that help us operate the Service (such as content delivery and email services) may process data outside the UK. Where they do, we ensure appropriate safeguards are in place, such as UK adequacy regulations or standard contractual clauses.

9. Children's privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by a prominent notice on the Service. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Smythe Geanga Ltd
3rd Floor, 86-90 Paul Street, London EC2A 4NE
Email: [email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.