Privacy & Legal / Privacy Notice

Privacy Notice

How we collect, use, store and protect personal data.

Last updated: June 2026

Data Privacy Management Consultants Ltd (DPMC Ltd) (“we”, “us”, “our”) is a UK-based data protection and AI governance consultancy supporting clients across the UK, Africa, UAE and other global regions. We are committed to protecting the privacy of individuals whose data we process and ensuring full compliance with the UK GDPR, Data Protection Act 2018, and relevant international best practice.

This Privacy Notice explains how we collect, use, store and protect personal data when individuals interact with our website, contact us, or engage our consultancy services.

1. Who we are (Controller information)

Data Privacy Management Consultants Ltd (DPMC Ltd)
Purley, London, United Kingdom
Email: info@dataprivacymc.com

For all enquiries relating to this Privacy Notice or your data protection rights, please contact us using the details above.

2. What personal data we collect

Website & enquiry data

  • Name
  • Email address
  • Organisation and role
  • Message content
  • Any documents you choose to upload or send

Client engagement data

  • Contact details of client representatives
  • Contract and billing information
  • Project-related documents (e.g., policies, DPIAs, SAR materials)
  • Meeting notes and communications

Technical & analytics data

  • IP address
  • Browser type
  • Device information
  • Pages visited and time spent on site
  • Cookie preferences

We do not collect special category data unless strictly necessary for a client engagement (e.g., SAR review) and only under a lawful basis.

3. How we collect personal data

  • Website contact forms
  • Direct email communication
  • Client onboarding and contracting
  • Consultancy delivery (e.g., SAR handling, DPIAs, audits)
  • Privacy-friendly analytics tools

We do not use invasive tracking technologies or advertising cookies.

4. How we use personal data

  • Responding to enquiries
  • Providing information about our services
  • Arranging consultations or discovery calls
  • Delivering consultancy services
  • Conducting DPIAs, LIAs, TRAs
  • Supporting SAR responses
  • Providing privacy, AI governance and compliance advice
  • Delivering training and workshops
  • Managing client relationships
  • Contract management
  • Invoicing and financial administration
  • Internal record-keeping
  • Service improvement
  • Understanding how visitors use our site
  • Maintaining security and functionality

We do not use personal data for automated decision-making or profiling.

5. Lawful bases for processing

We rely on:

  • Legitimate interests — responding to enquiries, improving services, maintaining business operations
  • Contract — delivering consultancy services
  • Legal obligation — financial record-keeping, regulatory compliance
  • Consent — when you opt in to receive updates or resources

Where special category data is processed (e.g., SAR support), we rely on Article 9(2)(g) (substantial public interest) and relevant DPA 2018 conditions.

6. International transfers

DPMC Ltd supports clients in the UK, Africa, UAE, US and EU.

Where data is transferred outside the UK:

  • We assess the destination country’s adequacy
  • We implement ICO-approved IDTAs or EU SCCs (where applicable)
  • We ensure appropriate technical and organisational measures
  • We only transfer data where necessary for service delivery

We do not transfer data to jurisdictions without safeguards.

7. Data sharing

We may share personal data with:

  • Trusted service providers (secure email, cloud storage, scheduling tools)
  • Subcontractors working under NDA and data processing terms
  • Regulators or authorities where legally required

We do not sell or share personal data for marketing.

All processors are vetted for security, compliance and data protection maturity.

8. Data retention

  • Enquiries: 12 months
  • Client project files: 7 years
  • Financial records: 7 years
  • Mailing list: until you unsubscribe
  • SAR-related data: retained only for the duration of the engagement unless otherwise agreed

Data is securely deleted once retention periods expire.

9. Your rights

Under the UK GDPR, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion
  • Restrict processing
  • Object to processing
  • Data portability (where applicable)
  • Withdraw consent
  • Lodge a complaint with the ICO

To exercise your rights, email: info@dataprivacymc.com

10. Cookies

We use minimal cookies:

  • Essential cookies — required for site functionality
  • Analytics cookies — anonymous usage data

We do not use advertising or tracking cookies.

You can manage your preferences at any time through our Cookie Policy or the panel.

11. Security

We implement strong technical and organisational measures, including:

  • Encrypted email and storage
  • Access controls and MFA
  • Secure file transfer
  • Data minimisation
  • Regular security reviews

We take all reasonable steps to protect personal data from loss, misuse or unauthorised access.

12. Updates to this Privacy Notice

We may update this notice to reflect changes in law or our services. The latest version will always be available on this page.

13. Contact

For any privacy-related questions:

Data Privacy Management Consultants Ltd (DPMC Ltd)
Email: info@dataprivacymc.com
Location: UK-based, supporting UK, Africa, UAE & global clients.

← Back to Privacy & Legal