Legal

Privacy policy

Who we are, what personal data we collect through dmg-limited.com and your DMG account, why we use it, how long we keep it and the rights you have.

Last updated: 15 October 2026

1. Who we are (the data controller)

This website and the DMG account centre are run by Duckham Meridian Group Limited (“DMG”, “we”, “us”), a company registered in England and Wales. For the personal data described in this policy, we are the data controller.

Email: [email protected]
ICO registration number: ZC265320

We are not required to appoint a Data Protection Officer. Questions about privacy go to the email address above, with “Privacy” in the subject line.

Data inside our products. When your organisation uses one of our products (such as Orbis ERP, SafeThread, QMS, PTA Hive or Regulyse), your organisation is the controller of the data it puts in and we act as its processor under our Data Processing Agreement. Each product has its own privacy information.

2. What we collect and why

When	What we collect	Why we use it	Lawful basis (UK GDPR Art. 6)
You contact us, book a demo or ask for a pilot	Name, email, phone (optional), organisation, job role, the product you are interested in and your message	To reply, arrange demos and follow up on your enquiry	Legitimate interests (responding to enquiries); steps before entering a contract
You use a free tool (assessments, ROI estimator, fit report, process analyser, exit-intent brief)	Your answers and results, and your email if you choose to give it	To produce and email your report, and to send up to two follow-up emails about it	Legitimate interests; you can opt out of follow-ups at any time
You sign in to or manage a DMG account	Email, name, organisation, team members you invite, sign-in codes (stored in scrambled form), account activity	To give you secure access and run your account	Contract
You buy a plan	Billing name, address, VAT number, plan and invoice history. Card details go directly to Stripe; we never see full card numbers	To take payment, issue invoices and meet tax law	Contract; legal obligation (tax and accounting records)
You raise a support ticket	Your messages and contact details	To help you	Contract; legitimate interests
You post a review, join the partner programme or refer someone	Name, organisation, your review or referral details, and contact details of the person you refer (with their agreement)	To publish reviews (after moderation), run the partner programme and pay commission	Consent (reviews, referrals); contract (partners)
You chat with the DMG Assistant or use AI features	What you type	To answer your question. Please do not enter sensitive personal data	Legitimate interests
You browse the site	Technical data such as IP address, browser and pages requested (server logs); analytics only if you accept cookies	To keep the site secure, prevent abuse and, with consent, understand how the site is used	Legitimate interests (security); consent (analytics cookies)

We do not collect special category data (such as health information) through this website, and we do not sell personal data.

3. Marketing emails

If you contact us or use one of our tools, we may send you a small number of follow-up emails about the products you showed interest in. Every email tells you how to opt out, and you can reply “unsubscribe” or email [email protected] at any time. We will then stop and keep only a note that you opted out.

4. Automated assessment and AI

We use AI to write your reports and to sort enquiries by likely fit so we can reply to the most relevant ones quickly. This only helps us prioritise. It never decides whether we reply to you and does not produce legal or similarly significant effects for you. You can ask us to explain or review any assessment.

5. Who we share data with

We share personal data only with suppliers who help us run DMG, under contracts that require them to protect it and use it only on our instructions:

Cloud hosting and database: runs this website and stores your data
Email delivery: sends sign-in codes, reports and account emails
Stripe: processes payments and stores payment details
AI model providers: generate reports and power the DMG Assistant
Google Analytics: anonymous site statistics, only if you accept analytics cookies
Our accountants and professional advisers, where needed

We may also disclose data where the law requires it, or to protect our rights. A named list of suppliers is available on request.

6. International transfers

Some of our suppliers store or process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Agreement or Addendum, so your data keeps an equivalent level of protection.

7. How long we keep data

Data	How long
Enquiries, demo requests and free-tool results	24 months after our last contact with you, then deleted
Opt-out records	For as long as needed to respect your choice
Account and team details	While your account is open, then 12 months after it closes
Invoices, payments and billing records	6 years after the end of the financial year they relate to, as UK tax law requires
Support tickets	While your account is open, then 24 months
Sign-in codes	Expire after 10 minutes and can be used once
Published reviews	Until you ask us to remove them
Partner and referral records	For the partnership and 6 years after, for commission and tax records
Analytics data (with consent)	No longer than 14 months

8. Your rights

Under UK GDPR you have the right to:

access the personal data we hold about you
rectification of data that is wrong or incomplete
erasure of your data in certain circumstances
restrict how we use it in certain circumstances
object to processing based on legitimate interests, and to direct marketing at any time
data portability for data you gave us under a contract or consent
withdraw consent at any time, for example by changing your cookie settings
not be subject to decisions based solely on automated processing that significantly affect you

To use any of these rights, email [email protected]. We respond within one month, and there is normally no charge. We may need to confirm your identity first.

9. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

10. Security

We use HTTPS encryption, password-free one-time sign-in codes, role-based access and managed cloud hosting to protect your data. See the Trust Centre for details.

11. Children

This website is for businesses and organisations and is not aimed at children. PTA Hive is used by school PTAs; its own privacy information covers parents and supporters.

12. Changes to this policy

We will update this page when the way we use personal data changes, and change the date at the top. Where a change is significant, we will tell account holders by email.