This policy explains what personal information CM System Designs Ltd collects when you use this website or get in touch with us, why we collect it, who we share it with, how long we keep it and the rights you have over it.
We are a small business and we try to collect as little personal information as we can. We never sell personal information.
Who we are
CM System Designs Ltd ("we", "us", "our") is the controller of the personal information described in this policy. This means we decide how and why it is used, and we are responsible for looking after it.
- Company number: 11011912 (registered in England and Wales)
- Registered office: 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom
- Information Commissioner's Office (ICO) registration number: ZB513174
- Contact: through our contact form, or by post to our registered office
We are not required to appoint a Data Protection Officer. If you have any questions about this policy or how we handle your information, please contact us.
The information we collect
When you contact us
When you use our contact form, email us or call us, we collect the information you give us. Through the form this is your name, email address and message, and optionally your phone number and company name. We also record the date and time of your enquiry.
Please don't include sensitive information (such as health details) in your message unless you need to.
When you become a client
If we work together, we hold business contact details for you and your colleagues, along with correspondence, meeting notes, project records, contracts and invoices.
We may also have access to personal information held in your systems while we build, integrate or support them. In that situation we act as your processor and handle that information only on your instructions under the terms of our written agreement with you. This policy does not cover that information.
When you appear in a testimonial or case study
If you agree to give us a testimonial or be named in a case study, we publish your name, job title, company, your comments and, if you supply one, a photograph.
When you browse the website
Like most websites, our servers automatically record technical information when you visit, such as your IP address, browser type, the pages you request and the time of your visit. We use this to keep the site running securely, to prevent abuse (for example, limiting repeated form submissions from the same address) and to fix problems.
If you agree to analytics cookies, we also collect information about how you use the site. This is explained in the cookies section below.
How we use your information and our lawful basis
UK data protection law requires us to have a lawful basis for each way we use personal information. We rely on the following:
- Replying to your enquiry and discussing a potential project. Taking steps at your request before entering into a contract, or our legitimate interest in responding to people who contact us.
- Delivering and managing our work for clients. Performing our contract with you or your organisation, and our legitimate interest in managing client relationships.
- Sending occasional emails about our services, insights and events. Our legitimate interest in keeping in touch with business contacts, or your consent where the law requires it. You can unsubscribe at any time.
- Protecting the website and our contact form from spam and abuse. Our legitimate interest in keeping our website and systems secure.
- Understanding how the website is used so we can improve it. Your consent, which you give through our cookie banner.
- Publishing testimonials and case studies. Your consent.
- Keeping financial and business records, and complying with the law. Our legal obligations, for example to HMRC.
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and expect our use of your information to be something you would reasonably expect. You can ask us for more detail about this.
We do not make decisions about you based solely on automated processing.
Marketing emails
We may send occasional emails to business contacts about our services, insights and events. We only do this where the law allows. For example, we may email people at organisations that have enquired about or used our services, and we will ask for consent where it is required. Every email includes an unsubscribe link, and you can also opt out by contacting us.
We use e-shot to send these emails. e-shot tells us whether emails are delivered and opened and which links are clicked, so we can understand what is useful. If you unsubscribe, we keep a record of your email address on a suppression list so that we don't contact you again.
Cookies and similar technologies
Cookies are small files that websites store on your device. We use as few as possible.
Strictly necessary cookies
These cookies are needed for the website to work and to keep it secure, so they don't require your consent:
- cmsystemdesigns-session: keeps track of your visit while you browse, for example so the contact form works. It expires after 120 minutes of inactivity.
- XSRF-TOKEN: protects forms against cross-site request forgery attacks. It expires after 120 minutes of inactivity.
- Google reCAPTCHA: on our contact page we use Google reCAPTCHA to tell people apart from automated spam. reCAPTCHA collects information about your device and how you interact with the page and sends it to Google, and may set its own cookies. Google's use of this information is covered by the Google Privacy Policy and Terms of Service.
- cmsd_cookie_consent: remembers whether you have accepted or rejected analytics cookies, so we don't ask you on every page. It lasts one year.
Analytics cookies (only with your consent)
With your consent, we use Google Analytics 4 to understand how visitors find and use our website, such as which pages are popular and how people move between them. Google Analytics sets cookies named _ga and _ga_<ID>, which last up to two years.
Google Analytics does not log or store full IP addresses. We do not use Google Analytics for advertising, and we keep analytics data for 14 months.
We will not set analytics cookies unless you accept them. You can change your mind at any time using the cookie settings link in the website footer, or by clearing cookies in your browser.
Who we share your information with
Your information is only seen by the people at CM System Designs who need it. We share it with trusted service providers that help us run our business. They may only use it on our instructions and must keep it secure:
- Website hosting: our website and its database, including contact form enquiries, are hosted on servers in the UK or European Economic Area.
- Microsoft 365: our business email and documents, including the email notifications we receive when you submit an enquiry.
- Google: reCAPTCHA spam protection and, with your consent, Google Analytics.
- e-shot: our email marketing service.
- Professional advisers: such as our accountants, lawyers and insurers, where necessary.
We may also disclose information where the law requires it, to protect our legal rights, or to a buyer or successor if our business is ever sold or reorganised. In that case we would make sure your information continues to be protected.
International transfers
Some of our service providers, including Microsoft and Google, may process personal information outside the UK, including in the United States. Where this happens, we make sure the transfer is protected. This means the destination is covered by UK adequacy regulations (such as the UK Extension to the EU–US Data Privacy Framework) or protected by approved safeguards, such as the UK International Data Transfer Agreement or Addendum. You can contact us for more information.
How long we keep your information
- Enquiries: 24 months after we receive them, then deleted automatically. If your enquiry leads to a project, the details we need are kept as part of our client records.
- Client records: for the length of our relationship and then six years after it ends, to meet our legal, tax and accounting obligations and in case of disputes.
- Marketing contacts: until you unsubscribe or we stop sending that type of email. After you unsubscribe, we keep only the details needed to make sure we don't contact you again.
- Testimonials and case studies: until you ask us to remove them.
- Analytics data: 14 months.
- Server and security logs: for a short period, only as long as needed for security and troubleshooting.
How we protect your information
We use appropriate technical and organisational measures to protect personal information. These include encrypted (HTTPS) connections, restricted access to our systems for named people only, multi-factor authentication and keeping our software up to date. No system is completely secure, but if a breach affecting your information ever happened, we would deal with it promptly and tell you and the ICO where the law requires us to.
Your rights
Under UK data protection law you have the right to:
- Access: ask for a copy of the personal information we hold about you.
- Rectification: ask us to correct information that is inaccurate or incomplete.
- Erasure: ask us to delete your information where there is no good reason for us to keep it.
- Restriction: ask us to limit how we use your information, for example while we check a complaint about its accuracy.
- Objection: object to our use of your information where we rely on legitimate interests. You have an absolute right to object to direct marketing.
- Portability: ask us to transfer information you have given us to you or another organisation in a commonly used, machine-readable format, where this applies.
- Withdraw consent: where we rely on your consent, you can withdraw it at any time. This doesn't affect anything we did before you withdrew it.
To exercise any of these rights, please contact us through our contact form or by post to our registered office. There is usually no charge. We may need to confirm your identity before we respond. We will reply within one month, or tell you within that time if we need longer because your request is complex.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put things right. We will acknowledge your complaint within 30 days.
You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
Children
Our website and services are aimed at businesses and are not intended for children. We do not knowingly collect information from anyone under 16.
Other websites
Our website links to other websites, such as social networks and our service providers. We are not responsible for how those websites handle personal information, so please read their privacy policies.
Changes to this policy
We review this policy regularly and will update it if the way we handle personal information changes. The date at the top of this page shows when it was last updated. If we make a significant change that affects you, we will tell you directly where we can.