Privacy Policy

SMAS Worksafe Privacy Notice  

What is this and who is it for?  

The following information sets out who Safety Management Advisory Service Ltd (SMAS) are and what we do with your personal data. Our company details are:  

Safety Management Advisory Services Ltd.  

44b Estover Close  
Forresters Business Park 

Company number 05900081

Who are we and what do we do? 

Safety Management Advisory Services Ltd is one of a part of the Citation Group. A group of companies operating in aligned industries of compliance and standards; together we provide a wider and more comprehensive range of services to our customers.  

Our Group Companies Include:  

Food Alert 
HS Direct
SMAS Worksafe
Southall Associates Avec 

As for Safety Management Advisory Services Ltdwe act as data controller, our registration with the Information Commissioner is with registration number Z1392043. Further information about how we process your data as a processor and controller can be found throughout this notice. 

Whilst we don’t share that data outside the group, we do share it internally on occasion to help improve our service offering, which of our services we (or another company in the group) talk to you about and better support the compliance and standards of your business.   

Under data protection laws you have rights; if you think something is not quite right with the way we are handling your data please get in touch, the email address is   

Below is what you can expect in the way that we handle your data. Let us know if you think something is missing or you feel it is incorrect, we’d love to put it right.  

When you use our website or call our helpline  

We use cookies on our websites for a variety of reasons including remembering your settings, load balancing, marketing and analytics. They may collect information about your device, including where available your IP address, operating systems and browser typeCookies can be managed through your browser or our cookie consent tool which appears when you first click on the website, here you can manage any non-essential cookies you don’t want.  

Please see our cookie page for a list of cookies we use. 

Enquiries through our website 

When you fill out a “speak to a member of the team” or a “got a questions form” on our website, we will use your details to answer your questions by the means that you have provided us.  

In both cases you are providing consent for us to contact you and we have a legitimate interest in opening a record to ensure that we have made contact and can track our communications, ensuring your questions and requests have been answered, and information that we have discussed can be recorded   

Once your request has been actioned the initial request will be deleted, if your initial request has turned into a record, this will be retained until it is no longer required. It’s a legitimate interest to retain a record of what communications we have had with companies that have expressed an interest in our services.  

Third parties 

We use an external third party to manage our website, this company and the hosting is in the UK. Other third parties include associations, clients and consultants who have joined the SMAS scheme in order to find contractors like you to carry out work for them. 

Social Media  

We use social media (Facebook, Twitter, LinkedIn and YouTube) to provide informationanswer questions and to interact with youIf you have liked a post or followed us, the details you make available on the platform will be known to us and will be used on the platform in this regard. We might also use your contact data and any knowledge we have about your interests in certain areas which relate to SMAS or other group companies to place adverts in front of you.  

Any personal data is you put into the social media platform will be used by the platform provider for their own purposes.  

TestimonialsClient Comments and Referrals   

If as a client you provide us with a testimonial or similar comment to be published on our website, and/or is hard copy format we’ll do so only with your consent. These are retained indefinitely or until you ask us to remove them. 

As clients we will often ask you which other companies you know that would benefit from our service. This will often be done either by email, in person or the use of a thirdparty tool (this enables confidentiality of the referral so we can’t see it).  

If you use our services  

SMAS offers various services relating to accreditation and then as a facilitator of information and credentials to either SMAS partners, associations and contractors, companies looking for contractors with the SMAS accreditationWe also provide support for individuals wishing to become accredited.  

For the services we provide we are a data controller. We maintain and administer our portal and the SMAS scheme and therefore have access to your personal data which for the most part is namecontact details, basic employment details and identification. This data (depending on which of the purposes) is processed with your consent or for the performance of a contract between you and SMAS. We keep it for 2 years following completion of the assessment process.  

If you are a contractor registered under our scheme you are making your data available for our customers to access for them to enlist your services on projects and jobs they have. Customers can access your data here but cannot export it from us.  

To enable us to develop and communicate our platform-based services in a more effective way we export anonymised data and analyse, enabling greater insights into how the platform is used and if there are other area’s or services which could be used to provide greater benefit. Sometimes this will be reminders, on others it may be additional services. Any such areas shall be communicated to you through our platforms and can be stopped at any time, just let us know.  

Personal information we collect from you as a data controller shall be retained for as long as we have on ongoing legitimate business reason (for example to continue to provide a service, legal, accounting or taxation reasons. There are likely to be different legal conditions for this processing).  

We use third party’in three areas. The first is for some direct marketing campaigns, these parties are only allowed to use the information to send out the publications. This is who we use 

The second is for the hosting of our platforms, we use Microsoft, a link to their privacy notice: 

The third are analytic tools, the applications we use are:  

Amazon AWS

In all cases they fulfil their obligations under Article 28 of the GDPR and data is hosted in the EU or transferred using one of the lawful mechanisms set out in GDPR Chapter V.  


Where promoting our services, we have two routes. The first is through inbound enquiries either directly or through social media posts. The second is through opportunities presented by the rest of our group to clients of other group company services and in both cases is done in accordance with applicable data protection laws. Opting out, unsubscribing or objecting is your right, should you do so, it will be respected, and we will not contact you again.  

Job applicants, current and former Citation employees 

SMAS is the data controller for the information you provide during the process unless otherwise stated. If you have any queries about the process or how we handle your information, please contact us on the details at the bottom of the page. 

What will we do with the information you provide to us? 

All information you provide during the application process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary. 

We will not share any of the information you provide during SMAS’s internal recruitment process with any third parties for marketing purposes. The information you provide will be held securely by us. If you have provided your data in electronic form it shall be held securely in a third-party data centre in the EU.  

We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for. 

What information do we ask for, and why? 

We do not collect more information than we need to fulfil our stated purposes. The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for, but it might affect your application if you don’t. 

Application stage 

Applications may be received by email, physically by post or through a third-party recruitment agency. We will ask you for your personal details including name and contact details. We will also ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for. Our recruitment team will have access to this information. 


We might ask you to participate in assessment days; complete tests or occupational personality profile questionnaires; and/or to attend an interview – or a combination of these. Information will be generated by you and by us. For example, you might complete a written test, or we might take interview notes. This information is held by SMAS. 

If you are unsuccessful following assessment for the position you have applied for, we will retain your details for 12 months. 

Conditional offer 

If we make a conditional offer of employment, we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. We are required to confirm the identity of our staff, their right to work in the United Kingdom and seek assurance as to their trustworthiness, integrity and reliability. 

You will therefore be required to provide: 

Proof of your identity – you will be asked to attend our office with original documents, we will take copies. 

Proof of your qualifications – you will be asked to attend our office with original documents, we will take copies. 

You will be asked to complete a criminal records declaration to declare any unspent convictions. 

For certain positions we will contact you to complete an application for a Basic Criminal Record check via the Disclosure and Barring Service, which will verify your declaration of unspent convictions. 

We will contact your referees, using the details you provide in your application, directly to obtain references  

Bank details – to process salary payments 

Emergency contact details – so we know who to contact in case you have an emergency at work 

Use of third-party recruitment 

If you are employed by Citation, relevant details about you will be provided to a number of third-party providers, including our payroll and pensions providers. All colleagues will be given an appropriate privacy notice to explain this in detail. 

How long is the information retained for? 

If you are successful, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus 7 years following the end of your employment. This includes your criminal records declaration, fitness to work, records of any security checks and references. 

If you have been unsuccessful at either the shortlisting stage or assessment stage your data will only be retained for 6 months apart from your name. This will be kept for 2 years so we have a record of who we have previously interviewed. This is a legitimate reason to ensure a consistent robust selection and recruitment process. 

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. 


If you sign up to our newsletters and other communications, you can easily unsubscribe at any time following the link at the bottom.  These communications are sent using a thirdparty tool which enables us to see how useful the content has been to you and if the email has been opened. This is done with the use of beacons and pixels in our emails.  

Your rights 

Under data protection legislation, you have rights as an individual which you can exercise in relation to the information we hold about you. 

These rights include: 

The Right of Subject Access – this is the right to access data we hold about you and, where required, an explanation of that data. 

The Right to Rectification – this is the right to have inaccurate or incomplete data rectified. 

The Right to Erasure – this is also known as the ‘right to be forgotten’ and means that in certain circumstances you have the right to ask us to delete data we hold on you. 

The Right to Restrict Processing – this is where you can request that we restrict/block processing of personal data (but still retain it) 

The Right to Data Portability – this allows people to reuse their persona data by requesting it in a useable format. 

The Right to Object – this right allows you to object to us processing your personal data. This is typically related to processing based on legitimate interest, performance of a task in the public interest, direct marketing and processing for scientific or historical research. 

You can read more about these rights here – 

Automated decision-making 

In some instances, our use of your personal information may result in automated decisions being taken (including profiling) that legally affect you or similarly significantly affect you. 

Automated decisions mean that a decision concerning you is made automatically on the basis of a computer determination (using software algorithms), without human review.  For example, we use automated decisions to assess the current engagement level of customers and potential customers visiting the website or otherwise engaging with SMAS. We have implemented measures to safeguard the rights and interests of individuals whose personal information is subject to automated decision-making. 

When we make an automated decision about you, you have the right to contest the decision, to express your point of view, and to require a human review of the decision.  You can exercise this right by contact us using the contact details provided under the “How to contact us” heading below. 

Complaints or queries 

SMAS tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures. 

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of SMAS’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below. 

If you want to make a complaint about the way we have processed your personal information, you can contact the Information Commissioner’s Office in their capacity as the statutory body which oversees data protection law –

Access to Personal information 

SMAS tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’. If we do hold information about you we will: 

Give you a description of it; 

Tell you why we are holding it; 

Tell you who it could be disclosed to; and 

Let you have a copy of the information in an intelligible form. 

To make a request to the SMAS for any personal information we may hold you need to put the request in writing to the address provided below. 

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone. 

If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting the Group Data Protection Officer. 

Disclosure of personal information 

In many circumstances we will not disclose personal data without consent, unless legally obliged to do or as part of contractual obligations with our customers (where you are a party to the agreement or service). 

We may disclose your personal information to the following categories of recipients: 

to our group companies (as identified at the top of this notice), third party services providers and partners who provide data processing services to us (for example, to support the delivery of, provide functionality on, or help to enhance the security of our Website), or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we collect your personal information.  

To any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person; To a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice; 

To enforce or apply our Terms of Service or other agreements or to protect SMAS and its customers (including with other companies and organisations for the purposes of fraud protection and credit risk reduction) to any other person with your consent to the disclosure. 

Legal basis for processing personal information 

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “How to contact us” heading below. 

Links to other websites 

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.  

Changes to this privacy notice 

We keep our privacy notice under regular review. This privacy notice was last updated on 15th January 2020 

How to contact us 

If you want to request information about our privacy policy, you can email us or write to: 

Group Data Protection Officer
Kings Court
Water Lane