Privacy Policy

This website is operated by SmartOne POS Europe Limited (company registration no. C 115037), a private limited liability company registered in Malta, with registered office at Level 6, Room 2, Tagliaferro Business Centre, Sqaq Gaiety, Sliema SLM 1551, Malta. We are the controller of the personal data described here.

For any privacy question, or to exercise your rights, write to info@smartoneglobal.com.

This policy covers this website and the enquiries you send us through it. It does not cover the payment services themselves: those are provided by our regulated partner, which handles the related data under its own terms and its own regulatory obligations.

When you contact us or request a terminal, we collect the details you provide: your name, business name, email address, phone number, country, the type and size of your business, your current card processor and how you heard about us (all of these except name, email and country are optional), and the message you send.

If you agree to the Marketing category, we store in your browser's local storage which campaign tag or referring site brought you here (so_first_touch). If you later send us an enquiry, it is submitted with the form so we know which channel it came from. It contains no name or contact details and is not shared with advertising networks. If you do not, nothing is stored.

When you browse the site, we use necessary cookies that remember your country, your language and your cookie choice, and one that protects our enquiry form against automated abuse.

If you agree to it, we also use analytics and advertising technologies from Google and Meta. What they do and who receives the data is in section 5; each cookie is listed in our Cookie Policy. Nothing in those two categories operates unless you agree, and nothing is loaded before you answer the cookie notice.

Our servers keep short-lived technical logs (IP address, request time, page requested, browser type) to keep the site running and secure.

To respond to your enquiry and to set up your account and device — processing necessary to take steps at your request and to perform a contract (GDPR Art. 6(1)(b)). This covers your name, business name, email, phone and message.

To qualify and price our offer to you — your business type, monthly card-sales band and current processor, all optional — on the basis of our legitimate interest in preparing a suitable commercial proposal (GDPR Art. 6(1)(f)). You can object to this at any time.

To understand which channels our enquiries come from, to measure how the site is used, to see combined statistics across the devices of a signed-in Google user, and to match an enquiry to the advertisement that produced it — your consent, given through our cookie notice (GDPR Art. 6(1)(a)). None of this happens unless you agree, and you can withdraw your consent at any time from Cookie settings at the bottom of every page, which also deletes what was stored in your browser.

To run the functional cookies that remember your country, language and that you have answered the cookie notice — our legitimate interest in a working site (GDPR Art. 6(1)(f)).

To keep the site available and secure and to meet our legal, tax and accounting obligations — our legitimate interest in the security of our systems (GDPR Art. 6(1)(f)) and compliance with a legal obligation (GDPR Art. 6(1)(c)).

Payment, electronic-money and card-acquiring services are provided by Paynetics AD, an authorised electronic-money institution regulated by the Bulgarian National Bank and passported into the European Union. Where those services apply to you we share only what is needed to provide them, and that partner is the party responsible for payment-related regulatory checks, including AML and KYC.

We use processors who act only on our instructions under a data-processing agreement: our website host, the service that receives and routes the contact form, and our email and CRM providers.

We may share your details with other companies in the SmartOne group in Malta, Spain, Cyprus, Slovakia and the United Kingdom where that is needed to serve you in your market.

Where we and Meta are joint controllers, we have the arrangement that Article 26 of the GDPR requires, and this is the substance of it: we decide which events on this site are sent and we are responsible for asking for your agreement and for the information on this page; Meta is responsible for what it does with the data once it has it. You may bring a request about your rights to either of us. If you bring it to us, we will answer for our part and pass the rest to Meta within seven days; we cannot answer on Meta's behalf.

We do not sell your personal data, and we do not share it with data brokers. Apart from the providers named above, we do not share it with advertising networks.

This website, and the enquiries you send through it, are hosted on servers located in the United States. Your personal data is therefore transferred outside the European Economic Area.

For that transfer, for the analytics and advertising providers named in section 5, and for any other provider outside the EEA, we rely on one of the following. If you agree to analytics or advertising cookies, data about your visit — including your IP address — is received by Google and Meta and may be processed by their group companies in the United States.

• an adequacy decision of the European Commission (GDPR Art. 45), where the receiving company is certified under the EU–US Data Privacy Framework. The United Kingdom is likewise covered by an adequacy decision.
• for data reaching Meta from the United Kingdom, the Data Privacy Framework does not apply, and the Standard Contractual Clauses below are used instead.
• the European Commission's Standard Contractual Clauses (GDPR Art. 46), together with a transfer impact assessment and any additional technical and organisational measures required, where no adequacy decision applies — including if the EU–US Data Privacy Framework ceases to apply to a recipient.

You can ask us which safeguard applies to a specific provider by writing to info@smartoneglobal.com.

We do not make decisions about you based solely on automated processing, and we do not build profiles of you for our own decisions: your enquiry is read and answered by a person. If you agree to analytics or advertising, Google and Meta use the data they receive for their own advertising purposes, which include profiling by them and, where Google Signals applies, linking your visit to your Google account across devices. The volume band you select on the site only helps us prepare the conversation.

We keep data only as long as needed for the purpose it was collected, then delete or anonymise it.

Enquiries from people who do not become customers: 24 months from your last contact with us, after which they are deleted from our CRM. Analytics data held in Google Analytics: 14 months. Advertising identifiers in your browser: as set out in the Cookie Policy, the longest being 90 days. Data held by Google and Meta for their own purposes is kept by them under their own policies, which we do not control.

Customer and transaction records: for the duration of the relationship, and afterwards for the statutory retention periods that apply under Maltese law — including approximately 6 years for VAT records (VAT Act, Cap. 406) and up to 9–10 years for tax and accounting records (Income Tax Management Act, Cap. 372; Companies Act, Cap. 386).

Technical server logs: a short period, normally no more than a few weeks.

Under the GDPR you can ask us to give you access to your data, correct it, delete it, or send it to another provider; you can object to processing based on our legitimate interest, ask us to restrict processing, and where we rely on consent you can withdraw it at any time without affecting what we did before.

To exercise any of these, write to info@smartoneglobal.com. We respond within one month.

You also have the right to lodge a complaint with a data protection authority. Our lead authority is the Office of the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, High Street, Sliema SLM 1549, Malta, tel +356 2328 7100, idpc.info@gov.mt. You can also complain to the authority in the country where you live or work.

This site and our products are aimed at businesses, not at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us their details, write to us and we will delete them.

We may update this policy as our services change; the date at the top shows the current version. If a change materially affects how we use your data, we will make that clear on this page.