Privacy Policy
This policy explains how CEHG collects, uses and protects personal data through the smoc.cloud marketing website, including the analytics and session-recording technologies we operate on it. It covers this public website only — not the smoc.cloud operational platform, which is governed by the contract with each tenant.
1. Who we are
CEHG is the data controller for personal data collected through this website. Our registered office is 128 City Road, London EC1V 2NX, United Kingdom.
For any privacy question, data subject request or complaint, contact us through the contact form on this website and mark your message “Privacy request”. We respond to data subject requests within one month.
2. What data we collect
We do not ask for, and ask you not to submit, special category data (such as health, political or religious information) through this website.
- Demo and sales enquiries: your name, work email address, company name, the utility types you operate, approximate estate size, the nature of your enquiry and any free-text message you send us.
- Analytics data (Google Analytics 4): pages viewed, referring page and campaign parameters, approximate location derived from a truncated IP address, device, browser and operating system, screen size, language, session duration, scroll depth, clicks on links and buttons, form starts and submissions, and a randomly generated analytics identifier stored in a cookie.
- Session recording data: a replay of your interaction with the pages you visit — mouse movement, clicks, taps, scrolling, page navigation, viewport size and rage/error signals — together with heatmap aggregates.
- Technical data processed by our hosting provider in server logs, including IP address, timestamp and requested URL, for security and availability purposes.
3. Analytics and session recording in detail
With your consent we operate Google Analytics 4 across the full site, and a session-recording and heatmap capability that reconstructs how visitors move through pages. Both are used to understand which parts of the site are useful, where visitors abandon a flow, and how to improve the content and layout — not to build advertising profiles.
Session recordings are configured to suppress the content of form fields: text you type into the demo or sales form is masked in the replay, and password, email and message inputs are never captured as keystrokes. Recordings are pseudonymous — they are identified by a random session identifier, not by your name — but a recording can still constitute personal data, which is why we only capture it after you accept analytics cookies.
Both technologies are strictly optional. If you decline analytics cookies, or withdraw consent later, Google Analytics is not loaded, no recording is made, and any identifiers those tools previously set are no longer used.
Google Analytics data is processed by Google (Google Ireland Limited, with onward processing by Google LLC in the United States) as our processor, under Google’s data processing terms and the EU/UK standard contractual clauses together with the UK extension. IP addresses are truncated before storage and we do not enable Google Signals, advertising features, or data sharing for ads personalisation.
4. Cookies and similar technologies
We set a small number of cookies and equivalent browser-storage entries. They fall into two groups.
| name | type | purpose | retention |
|---|---|---|---|
| smoc_consent | Essential | Records your cookie choice so we do not ask again. | 12 months |
| smoc_lang | Essential | Remembers the site language you selected. | Persistent (until cleared) |
| _ga, _ga_* | Analytics | Google Analytics 4 — distinguishes visitors and sessions, measures page and event data. | Up to 24 months |
| Session-recording ID | Analytics | Links the pages of a single visit into one replay and prevents duplicate recordings. | Session / up to 12 months |
Essential entries are set without consent because the site cannot function correctly without them and they store only your own preferences. Analytics cookies and session recording are set only after you press “Accept analytics” in the cookie banner.
You can change your mind at any time using the cookie settings link in the banner or by clearing this site’s cookies in your browser. You can also install Google’s browser add-on to opt out of Google Analytics across all sites.
5. Why we process your data and on what legal basis
- To respond to demo and sales enquiries and to prepare for a possible contract — legitimate interests and, where applicable, steps taken at your request prior to entering a contract.
- To operate analytics and session recording in order to measure and improve the website — your consent, which you may withdraw at any time.
- To keep the website secure, available and free from abuse — legitimate interests.
- To comply with legal, tax and regulatory obligations — legal obligation.
6. Who we share data with
We share personal data only with service providers acting on our instructions: our website hosting and platform provider, Google as our analytics processor, our session-recording and heatmap provider, and our email and CRM tooling used to follow up on enquiries. Each is bound by a data processing agreement.
We do not sell personal data and we do not share it with advertising networks. We may disclose data where required by law or to establish or defend legal claims.
7. International transfers
Some of our processors are located outside the UK and EEA, principally in the United States. Where that is the case we rely on the UK International Data Transfer Addendum or the EU standard contractual clauses, together with additional technical measures such as IP truncation and encryption in transit.
8. How long we keep data
- Demo and sales enquiries: up to 24 months after our last contact with you, unless a commercial relationship begins, in which case contractual retention applies.
- Google Analytics event data: 14 months, after which it is deleted by Google.
- Session recordings and heatmaps: up to 12 months, then deleted automatically.
- Server security logs: up to 12 months.
9. Your rights
You have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent for analytics and session recording at any time. Exercising these rights is free of charge.
If you are unhappy with how we have handled your data you may complain to the UK Information Commissioner’s Office (ico.org.uk) or to your local supervisory authority.
10. Security and changes to this policy
We protect data in transit with TLS, restrict access to enquiry data to the people who need it, and review our processors’ security posture. No online service can be guaranteed absolutely secure.
We may update this policy as the website and our tooling change. The version in force is the one published here, last updated 21 September 2026.