SmartAlex United Kingdom GDPR and PECR Notice
1. Purpose and scope
THERCSGROUP PTE. LTD., trading as SmartAlex ("SmartAlex", "we", "us", "our"), operates the SmartAlex platform, websites, applications, and APIs (the "Services"). SmartAlex is a company incorporated in Singapore.
This United Kingdom GDPR and PECR Notice (this "Notice") is a United Kingdom overlay. It sets out the position that applies specifically under United Kingdom data protection and electronic communications law where our processing falls within their scope. It supplements, and should be read together with, our GDPR Article 13 Notice, which owns the layered transparency detail (the categories of personal data, the purposes and lawful bases, the recipients, the retention periods, and the full description of data subject rights). Where this Notice and the GDPR Article 13 Notice both apply, they are intended to be consistent, and the substantive detail in the GDPR Article 13 Notice and our Privacy Policy continues to govern, applied on a United Kingdom basis.
2. Application of the UK GDPR
In this Notice, the "UK GDPR" means the General Data Protection Regulation as it forms part of the law of the United Kingdom (as retained and amended under United Kingdom law), read together with the United Kingdom Data Protection Act 2018.
Where we process personal data of individuals in the United Kingdom in a way that falls within the scope of the UK GDPR, this Notice explains the United Kingdom specific position. The substantive elements of that processing, including the categories of personal data, the purposes for which we process it, the lawful bases we rely on, the recipients, retention, and the rights available, are set out in our GDPR Article 13 Notice and Privacy Policy and are applied on a United Kingdom basis under the UK GDPR. Whether the UK GDPR applies to a particular processing activity depends on the facts, and nothing in this Notice is an admission that the UK GDPR applies to any given activity.
3. Your rights under the UK GDPR
Where the UK GDPR applies to our processing of your personal data, you have, subject to the conditions and exemptions in United Kingdom law, the following rights:
- Right of access to your personal data and to information about how we process it.
- Right to rectification of personal data that is inaccurate or incomplete.
- Right to erasure of your personal data in certain circumstances.
- Right to restriction of processing in certain circumstances.
- Right to data portability, allowing you to receive certain personal data in a structured, commonly used, and machine readable format and to have it transmitted to another controller where technically feasible.
- Right to object to processing in certain circumstances, including processing for direct marketing.
- Rights related to automated decision-making, including profiling, where decisions are based solely on automated processing and produce legal or similarly significant effects.
To exercise any of these rights, contact us at privacy@getsmartalex.com. We may need to verify your identity before responding, and we will handle your request in accordance with United Kingdom law. Where SmartAlex processes personal data on behalf of a customer as a processor, we will refer your request to the relevant customer as the controller, or assist that customer in responding, as appropriate.
4. UK representative
Where a United Kingdom representative is required under Article 27 of the UK GDPR and has been appointed, the identity and contact details of that representative are published in our EU and UK Representative Notice. Please refer to that notice for the current position. The appointment of a representative does not, in itself, determine whether the UK GDPR applies to any particular activity.
5. PECR: electronic marketing
The Privacy and Electronic Communications Regulations 2003 (as amended) ("PECR") govern marketing communications sent to recipients in the United Kingdom, including marketing calls, emails, and text messages. Where such communications are sent to United Kingdom recipients, they must comply with the applicable PECR rules, which can include consent requirements, screening against relevant preference services, and the provision of sender identification and an opt-out.
Our platform enables customers to design and run their own outbound calling and messaging campaigns. Where a customer uses the Services to send marketing communications, that customer is responsible for ensuring that its own marketing complies with PECR and any other applicable law, including obtaining any required consent, honouring opt-outs, and carrying out any required screening. Our expectations of customers, and the controls that apply, are set out in our Outbound Calling and Telemarketing Policy. Where we send our own marketing communications, we aim to do so in accordance with PECR.
6. PECR: cookies and similar technologies
PECR also governs the storing of information, and the gaining of access to information stored, on a user's device, including through cookies and similar technologies. The cookies and similar technologies used on our own websites, the purposes for which they are used, and the way consent is obtained where required, are described in our Cookie Policy. Where consent is required for non-essential cookies or similar technologies, we seek that consent as described in that policy.
7. International transfers
SmartAlex is established in Singapore, and processing personal data in connection with the Services may involve transfers of personal data from the United Kingdom to Singapore and to other jurisdictions, including transfers to the third parties that support the Services. Where personal data is transferred out of the United Kingdom, we rely on the transfer mechanisms and safeguards recognised under United Kingdom data protection law, applying the safeguards described in the GDPR Article 13 Notice and Privacy Policy on a United Kingdom basis. The third parties that process personal data on our behalf are listed in our Subprocessor List.
8. Complaints
If you have a concern about how we handle your personal data, we encourage you to contact us first at privacy@getsmartalex.com so that we can try to resolve it. Where the UK GDPR applies, you also have the right to lodge a complaint with the United Kingdom Information Commissioner's Office (ICO), the United Kingdom's supervisory authority for data protection. You may also have the right to seek a remedy through the courts.
9. Relationship to other documents
This Notice does not replace our other legal documents and should be read together with them. In particular, the GDPR Article 13 Notice and Privacy Policy set out the substantive detail of our processing, the Cookie Policy addresses cookies and similar technologies, the EU and UK Representative Notice addresses representative details, the Outbound Calling and Telemarketing Policy addresses marketing and campaign conduct, and the Subprocessor List identifies the third parties that process personal data on our behalf. Where there is any inconsistency between this Notice and those documents on a matter of substantive detail, those documents govern, and this Notice explains the United Kingdom specific overlay.
10. Updates and contact
We may update this Notice from time to time to reflect changes in our practices or in the law. The current version is the one published on our website with the effective date shown below.
For any question about this Notice, or to exercise a right or raise a concern, you can contact us at privacy@getsmartalex.com. Legal notices may be sent to legal@getsmartalex.com. Where the UK GDPR applies, individuals may also complain to the United Kingdom Information Commissioner's Office (ICO).
This Notice is issued by THERCSGROUP PTE. LTD. (UEN 202543608D), 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914, and is governed by the laws of the Republic of Singapore.
11. Version and effective date
This United Kingdom GDPR and PECR Notice is version 1.0 and is effective from 8 July 2026.