GDPR Statement
Last updated: [October 2026]

Introduction
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 govern how organisations in the UK hold and process personal data. Together with the Privacy and Electronic Communications Regulations (PECR), they set out the rights individuals have over their data and the responsibilities of organisations that use it.

This statement explains how Design and Management Systems Ltd (DMS), company number [05412088], registered office [2a-4 Avery Hill Road, New Eltham, SE9 2BD], collects and uses personal data about our customers, the people we work with at those customers, business contacts we approach about our services, and anyone who contacts us or visits our website. DMS is the controller of this data and is registered with the Information Commissioner’s Office (ICO) under registration number [ZA474201].

DMS Commitment
DMS are committed to high standards of information security, privacy and transparency and will comply with applicable data protection law. Working alongside our customers, we will explore opportunities within our services to assist our customers to meet their own data protection obligations.

DMS is certified to ISO 27001, the international standard for information security management. Our controls include encryption of portable devices, encrypted remote access, access limited to staff who need it, and secure Microsoft cloud services with backup and disaster recovery.

How We Use Personal Data
We use personal data for the following purposes, each with a lawful basis under UK GDPR:
• Providing our IT, cyber security and electrical services, including support and account management: contract with your organisation, and our legitimate interest in delivering and managing that contract.
• Billing and financial records: legal obligation.
• Monthly communications to customers: legitimate interests.
• Contacting business contacts and prospects about services that may be relevant to their organisation: legitimate interests (see Business Contacts and Prospects below).
• Answering enquiries: legitimate interests, or steps taken at your request before entering a contract.
• Keeping our systems and data secure, and handling complaints or legal claims: legitimate interests and, where it applies, legal obligation.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by yours. You can ask us for details of that assessment.

When we provide IT support, we may have access to personal data held on our customers’ systems. We process that data only on our customers’ instructions, under our contract with them. Our customer is the controller of that data, and their own privacy notice applies.

Data Retention
DMS retain personal data only for as long as necessary to provide the services you have requested and thereafter for legitimate legal or business purposes. In particular:
• Customer contract and service records are kept for [6 years] after the contract ends.
• Billing and financial records are kept for 6 years, as required by law.
• Details of business contacts we have approached who do not respond are deleted [12 months] after our last contact.
• General enquiries are kept for [2 years] after the enquiry is closed.
• If you ask us not to contact you, we keep only the minimum needed (your name, email address and the date) so that we can respect your choice.

Monthly Communications
DMS sends monthly communications to provide updates, relevant topics, and service-related information to our customers. These communications are intended to keep you informed and ensure that you are up to date with our latest offerings and developments. You can opt-out of these communications at any time by following the unsubscribe instructions in the email or contacting us directly.

Data Management in Our CRM System
Our Customer Relationship Management (CRM) system plays a crucial role in managing interactions with current and potential customers. It records personal data essential for providing personalised services and support. We ensure the integrity and security of data within our CRM system, adhering to strict data protection principles. Access to this data is limited to authorised personnel who require it to perform their job functions. We commit to using this information responsibly, maintaining its accuracy, and keeping it up to date. Our CRM is provided by monday.com, which processes this data on our behalf.

Business Contacts and Prospects
We may contact people in senior roles at organisations where our IT and cyber security services are likely to be relevant, even if they have not contacted us first.
• Where we get your details: from third-party business contact databases such as Apollo.io, and from public information such as your organisation’s website, Companies House, public contract award notices and public job adverts.
• What we hold: your name, job title, business email address, business phone number, company and LinkedIn profile URL, plus a record of our contact with you and any reply. We do not use personal email addresses or information about your private life.
• Why: our lawful basis is legitimate interests, namely telling organisations about services relevant to them. We only email limited companies, LLPs and PLCs without prior consent.
• How we contact you: by email, and sometimes by telephone on a business number. We screen business numbers against the Corporate Telephone Preference Service (CTPS) before calling.
• Use of AI tools: we use Microsoft 365 Copilot, within our own Microsoft 365 environment, to help research organisations, prioritise who to contact and draft emails. A member of our team reviews every email before it is sent and decides who we contact. We do not make automated decisions that have legal or similarly significant effects on you.
• Stopping our contact: you can object at any time and we will stop. Use the unsubscribe link in any of our emails, reply asking us to stop, or contact us. Your right to object to direct marketing is absolute.

Sharing Your Data
We do not sell personal data. We share it only with service providers who process it on our behalf under contract, and only for the purposes in this statement:
• Microsoft, for Microsoft 365 (email, documents and Copilot) and Azure (backup and disaster recovery)
• monday.com, for our CRM
We may also share data with professional advisers, or where the law requires it.
Some of these providers may process data outside the UK. Where they do, we make sure the transfer is protected by approved safeguards, such as a UK adequacy decision, the International Data Transfer Agreement or the UK Addendum to standard contractual clauses.

Cookies
Our website uses cookies. Non-essential cookies are only used with your consent, which you can withdraw at any time. See our [cookie policy] for details.

Data Protection Officer
DMS has designated a Data Protection Officer (DPO), who is taking full responsibility for all matters relating to data protection and GDPR compliance. The DPO will ensure that we are accountable and transparent to the supervisory authorities.

Data Breaches
DMS have processes in place for identifying, reviewing and promptly reporting data breaches to our DPO, who would be provided with:
• an overview of the breach
• all relevant contact information
• potential consequences of the data breach
• suggested actions and measures taken to manage the situation
Where the law requires, we report breaches to the ICO within 72 hours and inform the people affected.

Access to Personal Information and Your Rights
Individuals possess the right to obtain and review the personal data we hold about them. This right ensures individuals can check and confirm the legality of how we process their data. You also have the right to:
• have inaccurate data corrected
• ask for your data to be erased, or its use restricted, in some circumstances
• object to our use of your data based on legitimate interests, including an absolute right to object to direct marketing
• data portability, where it applies
• withdraw consent at any time, where we rely on it
Requests for accessing personal data, or using any of these rights, should be directed to us via email at enquiries@dmsystem.co.uk. We will respond within one month, and there is normally no charge.
If you are unhappy with how we have handled your data, please contact our DPO first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to This Statement
We review this statement regularly and will update it when the way we use personal data changes. The date at the top shows when it was last updated.

Contact
Design & Management Systems Ltd
Mohammed Iqbal – Data Protection Officer – 01322 420140
mohammediqbal@dmsystem.co.uk