CMSG privacy policy

Who We Are (Data Controller)

CMSG is the data controller for the data we collect from the cmsg.uk.com website (“your data” or “your personal data”).

What Personal Data We Collect

Depending on how you interact with us through our website, we may collect the following categories of personal data:

Data you provide directly:
•    Name and contact details (email address, phone number, postal address)
•    Company name and job title
•    Information submitted via contact forms, enquiry forms, or event registrations
•    Communications you send to us (emails, messages, feedback)
•    Marketing preferences and consent records

Data collected automatically:
•    IP address and browser type
•    Pages visited and time spent on our website
•    Device and operating system information
•    Referring URLs and search terms
•    Cookie identifiers (see Section 10 on Cookies)

Data from third parties:
•    Information from third-party platforms (e.g. LinkedIn, event platforms) where you have consented to sharing
•    Publicly available business information

How We Use Your Personal Data

We use your personal data only for legitimate purposes. The table below sets out our main processing activities and the legal basis for each:

Where we rely on legitimate interest, we have assessed that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interest at any time (see below).

Marketing Communications 

We will only send you marketing communications if you have given your consent, or where we have a legitimate interest to do so under UK GDPR (for example, where you are an existing customer and the communication is relevant to a similar product or service).

You can withdraw your consent or opt out of marketing communications at any time by:
•    Clicking the unsubscribe link in any marketing email
•    Emailing us at marketing@cmsg.uk.com
•    Updating your preferences via our website

Withdrawing consent will not affect the lawfulness of any processing carried out before your withdrawal.

How We Share Your Personal Data 

We do not sell your personal data. We may share it with the following categories of third parties, only where necessary:

•    IT and software service providers (e.g. CRM platforms, website hosting, email delivery services)
•    Analytics providers (e.g. website analytics tools)
•    Professional advisers (e.g. legal, accountancy, or insurance services)
•    Regulatory or law enforcement authorities, where required by law

All third-party processors are required to handle your data securely and in accordance with applicable data protection law. We enter into data processing agreements with them where required.

International Data Transfers 

Your personal data is transferred to and stored in the United States. This occurs because CMSG uses HubSpot as its CRM and marketing platform, and CMSG’s HubSpot account is hosted on servers located in the US East region (Amazon Web Services).

The transfer of your data to the US is governed by appropriate safeguards under UK GDPR. HubSpot’s Data Processing Agreement includes the following transfer mechanisms:
•    Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office (ICO)
•    The UK Extension to the EU–US Data Privacy Framework

In addition, certain HubSpot sub-processors may process your data outside the US. A full list of HubSpot’s sub-processors is available at legal.hubspot.com.

You may request details of the safeguards we use by contacting us at info@cmsg.uk.com.

How Long We Keep Your Data 

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, or reporting requirements.

Our standard retention periods are:
•    Contact and enquiry records: 3 years from last contact
•    Customer records: 7 years from end of contract (for legal and tax purposes)
•    Marketing consent records: Until consent is withdrawn, plus 1 year
•    Website analytics data: 26 months (rolling)
•    Cookie consent records: 12 months

When data is no longer required, it is securely deleted or anonymised.

Your Data Protection Rights

Under UK GDPR, you have the following rights in relation to your personal data:

•    Right of access — you can request a copy of the personal data we hold about you.
•    Right to rectification — you can ask us to correct inaccurate or incomplete data.
•    Right to erasure — you can ask us to delete your data in certain circumstances.
•    Right to restrict processing — you can ask us to limit how we use your data.
•    Right to data portability — you can ask us to provide your data in a structured, machine-readable format.
•    Right to object — you can object to processing based on legitimate interest or for direct marketing.
•    Rights related to automated decision-making — you have the right not to be subject to solely automated decisions that significantly affect you.

To exercise any of these rights, please contact us at info@cmsg.uk.com. We will respond within one calendar month. There is no charge for making a request.

We may need to verify your identity before processing your request.

Cookies

Our website uses cookies to improve your browsing experience and to help us understand how the site is used. Cookies are small text files placed on your device.

We use the following types of cookies:
•    Strictly necessary cookies — essential for the website to function. These cannot be disabled.
•    Analytical/performance cookies — help us understand how visitors use our site (e.g. pages visited, time on site).
•    Functional cookies — remember your preferences and settings.
•    Targeting/marketing cookies — used to deliver relevant content and track the effectiveness of our communications.

When you first visit our website, you will be asked to accept or decline non-essential cookies. You can change your preferences at any time via your browser settings or our cookie banner.

Data security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration.

These measures include:
•    Encryption of data in transit and at rest
•    Access controls and authentication requirements
•    Regular security reviews and staff training
•    Data processing agreements with all third-party processors

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals directly.

Contact us & how to complain

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

CMSG
Ivy House, Evesham Road, Worcester, WR7 4QS (Trading)

info@cmsg.uk.com
0121 389 2288
For data protection complaints, please email:
dataprotection@cmsg.uk.com

If you are not satisfied with how we handle your data or respond to a request, you have the right to lodge a complaint with the UK’s supervisory authority:

Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Helpline: 0303 123 1113