Trust Centre
Your data, handled with care
How we protect the information you trust us with, and the documents you need for your own due diligence.
Registered with the ICO
Duckham Meridian Group Limited is registered with the Information Commissioner’s Office, the UK’s data protection regulator.
- Registration
- ZC265320
- Expires
- 02 October 2027
Data Processing Agreement
Our standard DPA sets out how we process personal data on your behalf under UK GDPR. It is a template for review by your legal advisers. Contact us for an agreed, signed copy.
How we protect your data
Encryption in transit
All our websites and products are served over HTTPS (TLS), so data moving between your browser and our services is encrypted.
Password-free sign-in
Your DMG account uses a one-time code sent to your email, so there is no password to reuse or leak. Codes expire quickly and can be used once.
Role-based access
Account owners decide who can manage plans, see invoices or open products. A finance contact can see billing only.
Card payments handled by Stripe
Card details are entered on Stripe’s secure pages. We never see or store full card numbers.
Managed cloud hosting
Our products run on managed cloud infrastructure, with each customer’s data kept separate from other customers.
Account activity records
Key account events, such as plan changes, cancellations and team changes, are recorded so you have a clear history.
UK GDPR
We process personal data in line with the UK GDPR and the Data Protection Act 2018. We collect only what we need to provide our services, use it for the purposes we tell you about, and keep it only as long as necessary. You can ask to see, correct or delete your personal data at any time.
Where data leaves the UK, for example through a supplier, we make sure an approved safeguard is in place.
Sub-processors
We use a small number of trusted suppliers. A full named list is available on request.
Questions
Are you ISO certified?
Duckham Meridian Group is working towards ISO certification. Our products are designed to support organisations working towards standards such as ISO 9001, ISO 13485 and ISO 27001, but using them does not certify you.
Who is the data controller?
For data you enter into our products, you are the controller and we act as your processor. For data you give us directly, such as a contact form, we are the controller.
Can I get a signed Data Processing Agreement?
Yes. Download our template below, then email [email protected] and we will arrange an agreed, signed version.
How do I report a security concern?
Email [email protected] with “Security” in the subject line. We will acknowledge your report and keep you updated.
How do I ask for a copy of my data, or for it to be deleted?
Email [email protected]. We respond to data protection requests within one month, as UK GDPR requires. Our privacy policy explains all your rights.
See also our privacy policy, cookie policy and live service status.