Privacy Policy
Last Updated: 28 October 2026
1. Introduction
Omnia Smart Technologies Limited ("Omnia", "AIOne", "we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.
This policy applies to all AiOne products and services, including:
- SolveSmart - Route optimisation and logistics management
- ModelSmart - Field service workforce management
- MapSmart - Territory mapping and management
- AssetSmart - Asset tracking and management
- JobSmart - Job and fleet management
- FlowSmart - Workflow automation and form submissions
- InvoiceSmart - Automated invoice processing and accounting integration
- InventorySmart - Network inventory planning and stock visibility
Using this website or our Services is not, by itself, consent to anything. We rely on different lawful bases for different processing: legitimate interests for this website, for business contacts and enquiries, and for marketing emails to corporate email addresses; contract for the customer organisations we provide the Services to; and consent for non-essential cookies on aione.uk and for marketing emails to individuals and sole traders. Section 5 sets these out.
2. Data Controller
Omnia Smart Technologies Limited is registered in England and Wales.
Who decides what happens to your data. When an organisation uses the AIOne products, that organisation is the data controller for the records it puts into them, and Omnia is its data processor: we hold and process those records on the organisation's instructions, and the organisation decides what is collected and how long its own records are kept. If your employer or council uses AIOne and you have a question about your data, they are usually the first place to ask; we will help them answer. For this website, for our own staff, suppliers and business contacts, and for people who contact us directly, Omnia is the data controller.
Registered Office:
Omnia Smart Technologies Limited
Centaur House Ancells Business Park
Ancells Road, Fleet
England, GU51 2UJ
Data Protection Contact: privacy@weareomnia.com
3. Information We Collect
3.1 Account Information
- Name, email address, and contact details
- Username and encrypted password
- Organisation name and job title
- Authentication tokens for secure access
3.2 Operational Data
- Location data (GPS coordinates) for route optimisation and vehicle tracking
- Job and task information including schedules and assignments
- Asset details including location, condition, and maintenance records
- Territory and boundary data for mapping services
- Customer and delivery information as provided by your organisation
- Inventory levels, stock movements, and node locations (InventorySmart)
- Invoice line items, tax details, and accounting references (InvoiceSmart)
3.3 Technical Data
- IP addresses and device information
- Browser type and version
- Operating system and platform
- Session data and access logs
- API usage and integration data
3.4 Usage Data
- Features accessed and actions taken within the platform
- Performance metrics and analytics
- Error logs for troubleshooting
- Customer feedback and survey responses
4. How We Use Your Information
We use your information for the following purposes:
4.1 Service Delivery
- Providing and maintaining our platform services
- Processing and optimising routes, schedules, and territories
- Managing assets, jobs, and workforce assignments
- Authenticating users and managing access permissions
4.2 Service Improvement
- Analysing usage patterns to enhance functionality
- Developing new features based on user needs
- Monitoring system performance and reliability
- Troubleshooting technical issues
4.3 Communication
- Responding to enquiries and support requests
- Sending service notifications and updates
- Providing training and onboarding assistance
- Marketing emails about our products. To people at a company, using their work email address, we rely on legitimate interests. To individuals and sole traders, we send them only with your consent. Every marketing email has an easy way to opt out.
4.4 Legal and Compliance
- Complying with legal obligations
- Protecting our rights and interests
- Preventing fraud and ensuring security
- Meeting regulatory requirements
5. Legal Basis for Processing (UK GDPR)
We process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to fulfil our service agreement with you or your organisation
- Legitimate Interests: Processing for our legitimate business interests, such as running this website, responding to business contacts and enquiries, improving services, preventing fraud, ensuring security, and marketing emails to corporate email addresses (with an opt-out in every message)
- Legal Obligation: Processing required to comply with UK law and regulations
- Consent: For non-essential (analytics) cookies on aione.uk, which do not run until you accept them on our cookie banner (section 11), and for marketing emails to individuals and sole traders. You can withdraw consent at any time
6. Data Sharing
We may share your information with:
6.1 Service Providers
We use service providers (sub-processors) for hosting, sign-in, mapping and address lookup, messaging, notifications, error monitoring and AI features. Each one, what it receives and where it processes data is listed in section 12.
6.2 Business Partners
- Integration partners when you connect third-party services
- Resellers and distributors as part of service delivery
6.3 Legal Requirements
- Law enforcement when legally required
- Regulatory authorities for compliance purposes
- Legal advisors for the protection of our rights
We do not sell your personal data to third parties.
7. Where Your Data Is Held, and Transfers Outside the UK
7.1 Hosting
All live data in the AIOne products, and the database backups made from it, is held in Amazon Web Services (AWS) in London (the eu-west-2 region).
- AWS account activity logs, which record actions taken by our own staff in AWS and do not contain the records held in the products, are kept in AWS US East (us-east-1).
- Some static website files are served from AWS Stockholm (eu-north-1). The previous version of AssetSmart also ran there; it was switched off in October 2026 and is being decommissioned.
7.2 Transfers outside the UK
Some of the service providers listed in section 12 process data outside the UK, most importantly Anthropic in the United States, which provides the AI behind Ori and the other AI features (see section 12.2). Where a provider is outside the UK and not covered by a UK adequacy decision, the safeguard we use is the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. We are confirming the data processing agreement, processing location and transfer mechanism with each of these providers; where one is not yet confirmed, section 12 says so. You can ask us for the current position at any time.
8. Data Retention
We keep personal data only as long as it is needed. These are the periods in our Data Retention Policy.
8.1 Data organisations hold in the AIOne products
- Records in a product (jobs, routes, sites, contacts, schedules, forms, photographs): for the life of the contract, on the customer organisation's instructions. The organisation can ask us to delete specific records at any time, and can set its own retention period for them.
- After a contract ends: 30 days, so the organisation can export its data, then deleted from live systems. The organisation can ask for earlier deletion, or for its data to be returned.
- User accounts: until the organisation removes the user, or the contract ends.
- Files a product generates for download (exports, reports, rendered documents), where a product stores them: 90 days from creation, then deleted automatically.
8.2 Backups
- Database backups: 7 days, rolling. Backups cannot be edited, so a record deleted from a live system stays in the backups until they expire, at most 7 days later. Backups are encrypted and covered by the same access controls as the live system.
8.3 Operational records
- Application and server logs: 30 days, then deleted automatically.
- Audit logs (who did what, and when): 12 months, then removed automatically. In MapSmart this automatic removal is being introduced; until it is in place, MapSmart audit logs are kept for the life of the account and deleted with it.
- Driver-assignment history (which driver was put on which job, and by whom): 13 months, so the same week in the previous year can still be read.
- Error monitoring records: 90 days, then deleted automatically.
- Support tickets, and screenshots attached to them: for the life of the customer relationship; deleted on request or when the relationship ends.
- Files uploaded to Ori, and voice clips: files 7 days, voice clips 1 day.
8.4 Omnia's own records
- Contracts, invoices and financial records: 6 years after the end of the financial year.
- Record of data protection requests and how each was answered: 5 years.
- Marketing contacts and event leads: until the deletion date we gave when we collected them, or until you ask us to delete them.
We keep data longer than these periods only where the law requires it or it is needed for a legal claim. It is then kept securely, used only for that purpose, and deleted when the reason ends.
9. Data Security
We implement robust security measures to protect your data:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Multi-factor authentication options
- An independent penetration test by a CREST-accredited supplier, commissioned and starting in November 2026
- Automated alerts and update requests for known vulnerabilities in the software libraries we use
- An automated check in the build pipeline of several of our products that flags a change introducing a known kind of data-access mistake
- Access controls and role-based permissions
- Secure data centres with ISO 27001 certification
- Regular staff training on data protection
10. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data (subject to legal requirements)
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
To exercise your rights: Contact us at privacy@weareomnia.com. We will verify your identity and respond within 30 days.
12. Service Providers and Third-Party Services
12.1 Who receives personal data
These are the providers that receive personal data when the AIOne products and this website are used: what each one is for, what it receives, and where it processes it. "To be confirmed" means we are still confirming that detail with the provider.
- Amazon Web Services: hosting, databases, file storage, email, text messages (SMS) and voice transcription, for every product. Receives all data held in the products. London (see section 7.1).
- Anthropic: the AI behind Ori and the other AI features (section 12.2). Receives the content each feature needs, which can include names, addresses, job details, form answers, uploaded files, ticket text and screenshots. United States.
- Google Maps Platform: turning addresses into map positions in SolveSmart and ModelSmart, the nearest address to a handset's position in FlowSmart, and street names from road positions in MapSmart. Receives addresses, postcodes and coordinates. United States.
- Meta (WhatsApp Cloud API): WhatsApp messages to and from customers and staff in SolveSmart and ModelSmart, and support ticket updates. Receives phone numbers and message content. European Union and United States.
- Expo: building and updating the AIOne field app, and delivering its push notifications. Receives device push tokens and notification text. United States.
- Apple and Google: app stores and push notification delivery for the field app. Receive device identifiers and notification content. United States and other countries.
- Cloudflare (Turnstile): checking that a person, not a bot, is using a public job request form. Receives the visitor's IP address and browser signals. Worldwide, including the United States.
- Sentry: error monitoring for the products. Receives technical error data, which can incidentally include an identifier in a web address. European Union (Frankfurt).
- HERE Technologies: turn-by-turn navigation in the field app. Receives the device position and route requests. European Union.
- Flespi (Gurtam): collecting vehicle telematics. Receives vehicle positions and events, which can identify the driver of a vehicle. Location to be confirmed.
- IcePack: route optimisation for SolveSmart, ModelSmart and MapSmart. Receives job and vehicle locations, jobs, vehicles and shift times. Location to be confirmed.
- OpenStreetMap Foundation (Nominatim): address search on the MapSmart property import screen, and some position-to-address lookups. Receives the addresses typed and coordinates. This is a public service used without a contract. European Union and UK.
- Ordnance Survey and Esri: map backgrounds in MapSmart, the resident portal and AssetSmart. Receive the viewer's IP address and the area of map being viewed. UK and worldwide.
- Microsoft and Google sign-in: signing in with an organisation's own Microsoft or Google account, where the organisation chooses this. Receive the sign-in identity, under the organisation's own arrangement with that provider.
- Xero and Intuit (QuickBooks Online): accounting integrations in InvoiceSmart, connected by the customer organisation under its own contract with the provider. Receive names, invoices and attachments. Worldwide; United States.
- DVLA and DVSA: vehicle checks in FlowSmart, SolveSmart, ModelSmart and MapSmart. Receive a vehicle registration number. UK.
- Email delivery for support tickets: FixSmart support ticket notification emails. Receives the recipient's email address and the notification. Provider and location to be confirmed.
- Google Analytics 4 and Plausible Analytics: visitor statistics on aione.uk only, and only after you accept analytics on our cookie banner (section 11). Google Analytics: United States; Plausible: European Union.
When an organisation connects AIOne to one of its own systems (for example its CRM, mapping or identity system), data passes to that system on the organisation's instructions and under its own arrangements.
12.2 Ori and the AI features
These features use an AI model provided by Anthropic, PBC, which processes the data in the United States:
- the Ori assistant, in every product where it is switched on
- AI reports, debriefs and the purchase-order reader in SolveSmart and ModelSmart
- debriefs in MapSmart
- the TrainSmart chat
- analysis of support tickets in FixSmart, including any screenshots attached
- the Product Fit tool on this website, which sends the company name and website address you enter, and text from that public website
When you use one of these features, the content it needs to answer is sent to Anthropic. That can include names, addresses, job details, form answers, uploaded files and ticket text. We do not remove names or other identifiers before sending. This is a transfer of personal data to the United States (section 7.2).
We are moving these features to an AI model hosted by AWS in London (Amazon Bedrock). That work is in progress; we will update this notice when it is complete.
Voice messages to Ori are transcribed by AWS in London. Files uploaded to Ori are deleted after 7 days, and voice clips after 1 day.
13. Children's Privacy
Our Services are designed for business use and are not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. For significant changes, we will notify you via email or through our platforms.
We encourage you to review this policy periodically.
15. Data Deletion Requests
You have the right to request deletion of your personal data at any time. To request deletion of your data:
- Email us at privacy@weareomnia.com with the subject line "Data Deletion Request"
- Include your full name and the email address associated with your account
- Specify which AiOne services/products you use
- We will verify your identity and process your request within 30 days
Please note: Some data may be retained where required by law, for legitimate business purposes (such as fraud prevention), or to fulfil contractual obligations. We will inform you if any data cannot be deleted and explain why.
For mobile app users, you can also request data deletion through your organisation's administrator.
16. Contact Us
For questions, concerns, or to exercise your data protection rights:
Email: privacy@weareomnia.com
General Support: support@weareomnia.com
Postal Address:
Omnia Smart Technologies Limited
Centaur House Ancells Business Park
Ancells Road, Fleet
England, GU51 2UJ
Websites:
omniast.com | aione.uk
Supervisory Authority:
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ico.org.uk/concerns
