This notice covers https://scos.co.uk only.
1. Who this notice covers
This Website Privacy Policy explains how Smart City Operating System Limited ("scOS", "we", "us") collects, uses and protects personal information when you visit scos.co.uk, use a form on that site, or subscribe to a website mailing list.
It does not cover:
- the Home Intelligence Service or Business Intelligence Service (cameras, the Intelligence Hub, detection, alerts or voice announcements): see the Service Privacy Policy;
- the scOS iOS and Android apps: see the App Privacy Policy.
If you use the service or the app as well as the website, those notices apply to that processing. This notice applies to the website.
This notice is given under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The Privacy and Electronic Communications Regulations 2003 (PECR) also apply to cookies, similar technologies and electronic marketing. We serve customers and website visitors in the United Kingdom. We do not target this website at people in the EU or EEA as a separate market. The Information Commissioner's Office (ICO) is our supervisory authority.
2. Who we are
Controller: Smart City Operating System Limited, trading as scOS.
| Company number | 13569571 (England and Wales) |
| ICO registration | ZB346678 |
| Registered office (legal identity) | 71 Manor Road, Caddington, Luton, LU1 4EE, United Kingdom |
| Correspondence / mailing address | 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB, United Kingdom |
| Website | https://scos.co.uk |
| Contact | Contact Us: email, telephone and other methods |
We have not appointed a Data Protection Officer. The person responsible for data protection is the sole director, Flynn Robinson, as the controller's representative.
Please use the registered office for formal legal notices. Please use the London correspondence address for ordinary mail and postal data-protection complaints. Do not treat the London address as the company's registered office.
3. What we collect on the website
3.1 Information you give us
Depending on how you use the site, this may include:
- Enquiries. If you email us after obtaining our address from the contact page, we process the content of that email, your address and any phone number you include.
- Crime-alert sign-up. Email address, UK postcode, and whether you also want occasional product messages. We use the postcode only to work out your local area (town or city) from the Office for National Statistics Postcode Directory. We then discard the postcode and keep the area name with your subscription.
- Orders and checkout. Name, email, phone number, delivery / installation address, appointment choices, and order details. If you set up a Direct Debit, payment details are collected by GoCardless Ltd, which is an independent controller for that payment processing: see the Service Privacy Policy.
- Email preferences. Your address and unsubscribe / preference choices.
- Feedback you send through a site form or by email.
We do not ask the website to collect special-category data or criminal-offence data. Please do not put that kind of information in a website form.
3.2 Contact page and bot checks
The contact page does not collect a message through a form. It uses Cloudflare Turnstile to check you are human and then shows our email and phone number. Turnstile is configured without tracking cookies. Cloudflare receives the technical information needed to run that check (typically your IP address, browser details and a one-time token).
Other forms on the site (crime-alert sign-up, checkout and similar) also use Turnstile for the same purpose.
3.3 Information collected automatically
When pages load, our servers and content-delivery network see ordinary technical data: IP address, date and time, pages requested, referrer, browser and device type. We use this to operate, secure and diagnose the site.
We also use Umami Cloud for first-party, cookie-free analytics. Umami records anonymised page views, referrer, browser and device type, country derived from an anonymised IP address, and named in-page events (for example that a labelled button was clicked on a particular URL). It does not record form contents, keystrokes or cursor movement, and it does not try to identify you. If your browser sends a Do Not Track signal, we do not load Umami.
3.4 Session storage and local storage (not cookies)
We do not use tracking cookies on scos.co.uk. We do not run advertising cookies, social-media tracking pixels or third-party ad networks on this site.
We use the browser's session storage for short-lived, first-party functions: for example remembering that we have already shown you a crime-alert offer in this visit. Session storage stays in your browser, is not sent with every request the way a cookie is, and is deleted when you close the tab.
We may use local storage for non-personal settings such as a cached price. That is not used to identify you.
4. Cookies and PECR: why there is no separate cookie policy
The Privacy and Electronic Communications Regulations 2003, regulation 6, read with Schedule A1, restrict storing or accessing information on your device unless you consent, or unless an exception applies. The exceptions we rely on are: strictly necessary for a service you requested, statistics, and appearance preferences.
Our position on this site:
- We do not set tracking cookies, and we do not use analytics cookies.
- Umami is loaded without cookies and does not store an identifier on your device. To the extent PECR still applies to the analytics script, we rely on the statistical-purposes exception in PECR (analytics to improve this site, using aggregate information that is not used to identify you). You can object by sending a Do Not Track signal (we will then not load Umami) or by using Contact Us. This is not advertising.
- Turnstile is used in a cookie-free configuration, solely to protect forms and the contact reveal.
- Session storage used so we do not repeat the same pop-up in one visit is strictly necessary for that function, or falls under PECR’s appearance exception. We do not use it for advertising, and we do not use it to attribute a form submission to a browsing journey.
- Self-hosted fonts are served from our own infrastructure. No third-party font service receives your IP address.
We do not publish a separate cookie policy, because this site does not use tracking cookies. Everything that would sit in a cookie notice is in this section.
If we later introduce a technology that stores a non-essential identifier on your device, we will update this notice and, where PECR requires it, ask for consent.
5. How we use website information, and our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Operate the website, keep it secure, diagnose faults, and prevent abuse (including Turnstile) | Legitimate interests: running a secure, usable site (Art 6(1)(f)) |
| Understand how the site is used, using Umami, so we can improve content and journeys | Legitimate interests: improving the site (Art 6(1)(f)). Disabled when Do Not Track is set |
| Answer an enquiry you send us | Legitimate interests: responding to you (Art 6(1)(f)); or steps toward a contract if you are asking to buy (Art 6(1)(b)) |
| Process an order, installation booking or account set-up started on the site | Contract (Art 6(1)(b)) |
| Send crime-rate alerts you signed up for | Consent (Art 6(1)(a)). You can unsubscribe in every email |
| Send occasional scOS product messages, where you ticked that option | Consent (Art 6(1)(a) and PECR regulation 22). You can unsubscribe in every email |
| Keep tax and accounting records of orders | Legal obligation (Art 6(1)(c)) |
| Handle a data-protection complaint or rights request started from the site | Legal obligation (Art 6(1)(c), including DPA 2018 s.164A) |
We do not use website analytics for advertising, profiling for ads, or sale of data.
You can object to legitimate-interests processing via Contact Us. For marketing and crime-alert mail, use the unsubscribe link or contact us: that is a withdrawal of consent and we will stop.
6. Who we share website data with
We do not sell personal data. On the website we use:
| Recipient | Role | What they receive |
|---|---|---|
| Amazon Web Services (AWS) | Processor: hosting and content delivery | The site and form submissions we host |
| Umami Cloud | Processor: analytics | Anonymised usage events described in §3.3 |
| Cloudflare, Inc. | Processor: Turnstile bot check | Technical data needed to verify a form or contact reveal |
| GoCardless Ltd | Independent controller: Direct Debit, if you start a subscription | Name, email, bank details and mandate information you give them. See gocardless.com/privacy |
| Professional advisers, insurers or a purchaser | Recipients as needed | Only what is needed for that purpose |
| Police or other authorities | Recipients where the law requires it, or where an exemption applies | Only what is necessary. See below |
If you follow a link to X, Instagram, LinkedIn, TikTok or another site, that site's own privacy notice applies.
Police and other authorities. A police force or other authority does not have a general right to website records just by asking. We disclose information when the law requires it (for example a warrant or a court order) or when a data-protection exemption applies and disclosure is necessary. We assess each request. For this website, that is usually account, order or enquiry information. Camera footage and alert records are not website data. They are described in the Service Privacy Policy.
7. Where website data is processed
The website files are stored on AWS in the United Kingdom and the European Economic Area. They are delivered through Amazon CloudFront. A CloudFront edge that serves a page can be outside the United Kingdom and the EEA. The origin store remains in the UK or the EEA. The UK treats the EEA as adequate, so storing the site there is not a restricted transfer. Delivery through an edge outside the UK or the EEA can be a restricted transfer of technical data such as an IP address. Where that happens we rely on Amazon's transfer terms where they are in force for our account.
Umami Cloud and Cloudflare Turnstile are services of companies that operate internationally. Limited technical data (for example an IP address used to count a page view or to run a bot check) may be processed outside the United Kingdom. Where a restricted transfer occurs we intend to rely on an Article 46 safeguard, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, or on an adequacy decision if one applies, where those tools are in force for that provider. We have not confirmed every vendor addendum on a company-held account.
Processing for the Intelligence Service is explained only in the Service Privacy Policy.
8. How long we keep website data
| Data | Period |
|---|---|
| Crime-alert and marketing subscriptions | Until you unsubscribe. If you unsubscribe from everything, we delete the subscription record |
| Order and billing records started on the site | 7 years (UK tax and accounting) |
| Account information created via the site | Duration of the account plus up to 2 years: see the Service Privacy Policy |
| Support and enquiry email | As long as needed to deal with it, then a short quality/audit tail |
| Umami analytics | Up to 26 months |
| Application logs | Up to 30 days |
| Session storage | Until you close the tab |
When deletion happens. For application logs, the period above is when the data becomes due for deletion. Deletion is then automatic. Amazon Web Services carries it out as a routine background process, which usually finishes within three days of the end of the period.
Logs. Application logs expire automatically within 30 days (some groups at 14 days). We do not keep a separate website access-log store beyond that.
9. Your rights
You have the rights of access, rectification, erasure, restriction, portability (where it applies), and objection, and the right to withdraw consent. We will respond within one month, or tell you if we are entitled to extend that.
Some records must be kept (for example tax records). We will say so if that applies.
To exercise a right about website data, use Contact Us or write to us at the correspondence address. You can also use the complaints form at /privacy/complaints/.
If your request is about camera footage or a classification at a property, use the Service Privacy Policy: Hub recordings are held by the person who operates that property, not in a form we can search.
10. Complaints
You can complain to us about how we handle your personal data. You do not need to be a customer.
- Online: /privacy/complaints/
- Other electronic and telephone contact: Contact Us
- Post: Smart City Operating System Limited, 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB
We must acknowledge a data-protection complaint within 30 days and respond without undue delay, keeping you informed of progress (Data Protection Act 2018, section 164A). The full procedure is on the complaints page.
You can complain to the ICO at any time, before, during or after complaining to us, at https://ico.org.uk/make-a-complaint/ or 0303 123 1113. Complaining to us first is not required. Our ICO registration is ZB346678.
11. Children
This website is not for anyone under 18. We do not knowingly collect personal data from children through scos.co.uk. If you think a child has given us information via the site, use Contact Us and we will delete it.
12. Changes
We may update this notice. We will change the "Last updated" date above. If a change is material, we will say so on the site.
13. How to contact us
Smart City Operating System Limited
Registered office (legal identity): 71 Manor Road, Caddington, Luton, LU1 4EE
Correspondence: 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB
Email, telephone and other contact methods: Contact Us
Related notices: Service Privacy Policy · App Privacy Policy · Complaints