DPS Compliance Hub Website Privacy Policy

Last updated 14 October 2026

1 About this policy

This privacy policy explains how Data Privacy and Data Security Services Limited collects and uses personal data when you visit https://dpscompliancehub.com/, contact us through the website, request a demonstration or quotation, discuss a potential partnership, or use the Ask DPS AI assistant. In this policy, “we”, “us” and “our” mean that company, and “website” means the public DPS Compliance Hub website.

This policy covers website visitor information, the enquiries and related communications generated through the website, and use of our public AI assistant. It does not govern personal data uploaded to, stored in or otherwise processed within ISMS Workspace, PIMS Workspace or Data Privacy Workspace. Those services have their own privacy policies and applicable contractual arrangements. Please read the privacy policy for the workspace you use. An enquiry about a workspace remains covered by this website policy until processing falls within the scope of the relevant service policy.

We process personal data in accordance with the EU General Data Protection Regulation (EU GDPR) and applicable Cypriot data protection legislation, including Law 125(I)/2018. Where applicable, we also comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended, including by the Data (Use and Access) Act 2025. Applicable national rules implementing the EU ePrivacy framework also govern cookies and electronic marketing.

2 Who is responsible for your personal data

The data controller for the processing described in this policy is Data Privacy and Data Security Services Limited, a company registered in the Republic of Cyprus with company number HE 432380. A data controller decides why and how personal data is processed.

Registered address: Griva Digeni, 51 Athineon Court, Office 202, 8047, Paphos, Cyprus.

For privacy enquiries, requests to exercise your rights or complaints, email info@dataprivacyservices.co.uk or write to our registered address, marked “Privacy enquiry”. You can also contact us using the contact details displayed on the website. Please identify DPS Compliance Hub in your message so we can direct it appropriately.

UK operating address: 124 City Road, London, EC1V 2NX, United Kingdom. Telephone: 0808 101 0155.

3 What personal data we collect

Information you provide: when you make an enquiry, we may receive your name, work email address, organisation, optional telephone number, the product or service you are interested in, your message and any information you include in correspondence. If you arrange a demonstration or request a quotation, we may also receive appointment details, business requirements and records of our discussions with you.

Technical information: when you visit the website, the hosting and security services used to deliver it may process information such as your IP address, browser and device information, requested pages, access dates and times, referring URLs, error information and security events. This information is used to serve the website, diagnose faults and protect it. It may be personal data where it identifies or can be linked to an individual.

Preference and compliance information: we may retain records of any marketing choices you make, requests to exercise your rights, complaints and the steps we take in response. We collect proportionate identity information only where reasonably necessary to verify a request.

Please do not include passwords, payment card details, sensitive personal data, or confidential client or workspace information in a website enquiry. If your enquiry requires sensitive information, contact us first to agree an appropriate way to share it.

AI interaction information: the question you enter into Ask DPS, a limited recent conversation and generated answers. Pseudonymous consent and security records support the assistant. See section 8 for the processing, retention and your choices. Do not enter personal or confidential information merely to obtain a general product answer.

4 How the website enquiry form works

When you submit the enquiry form, the website sends your name, work email address, organisation, optional phone number, selected interest and message to info@dataprivacyservices.co.uk, with a copy to george@dataprivacyservices.co.uk. We use these details to respond to your enquiry. The website also sends an acknowledgement to the email address you provide.

Microsoft 365 processes these emails on our behalf. The privacy acknowledgement confirms that you have read this notice; it does not subscribe you to marketing. We validate submissions and use a hidden spam field and limited security records to help prevent misuse.

5 Why we use personal data and our legal bases

Responding to enquiries and arranging demonstrations: we use your contact details, message and relevant business information to answer questions, organise demonstrations and discuss suitable services. We rely on our legitimate interests in responding to people who contact us and developing business relationships. If you are personally entering into a contract with us, we rely on taking steps at your request before entering into that contract where the processing is necessary for that purpose. For contacts acting for an organisation, legitimate interests will ordinarily be the appropriate basis.

Preparing quotations and maintaining business correspondence: we use relevant enquiry and discussion records to prepare and follow up quotations, keep an accurate record of communications and manage prospective customer or partner relationships. Our legal basis is legitimate interests in conducting and administering our business, or pre-contractual steps where the conditions described above apply.

Operating and protecting the website: we use technical information to deliver pages, maintain availability, investigate errors, prevent misuse and protect our systems. We rely on legitimate interests in providing a reliable and secure website. Where a particular processing activity is necessary to meet a binding legal obligation, we rely on that obligation instead.

Handling privacy requests, complaints and legal matters: we use the information needed to comply with applicable data protection duties and other binding legal requirements. We rely on legal obligation for those activities and on legitimate interests where necessary to establish, exercise or defend legal claims.

Optional promotional communications: making an enquiry does not automatically subscribe you to marketing. If we offer updates or send promotional communications, we use consent where required by applicable electronic marketing law. Where that law permits communications without prior consent, we rely on legitimate interests and provide an effective way to object or unsubscribe. We do not assume that a permission available in one country applies in another. Service or enquiry replies are distinct from promotional messages.

Where we rely on legitimate interests, we consider the necessity of the processing, your reasonable expectations and the effect on your rights. You can ask us for further information about the relevant assessment. Where we rely on consent, you can withdraw it at any time; withdrawal does not affect processing that was lawful before withdrawal.

Providing Ask DPS answers: we rely on your consent under Article 6(1)(a) before your messages and recent context are processed by OpenAI. Limited abuse prevention relies on legitimate interests in protecting the service; necessary consent accountability supports our legal obligations. AI consent is separate from cookie choices, marketing and the enquiry form acknowledgement. Where special category or criminal offence information is involved, additional legal conditions are required; ordinary chatbot consent is not an invitation to provide it.

6 Whether you need to provide information

You can browse the public website without providing enquiry information. To use the enquiry form, the fields marked with an asterisk are required to prepare an enquiry that we can understand and answer; the telephone field is optional. You can also email us directly. If you do not provide a usable contact method or enough information about your enquiry, we may be unable to respond or provide the requested demonstration or quotation. You do not have to agree to marketing to receive an enquiry response.

You do not have to use Ask DPS or consent to AI processing to browse the website, request a demonstration, request seven-day showcase access or contact our team. Showcase access is arranged by DPS and is covered by the relevant showcase or workspace notice.

7 Cookies and similar technologies

Google Analytics 4

With your consent to the Analytics category, we use Google Analytics 4 to understand visits to the public DPS Compliance Hub website, the pages viewed, successful enquiry submissions and selections of downloadable PDF links. Download measurement records selection of a link, not confirmation that you saved or read a document. Google processes pseudonymous cookie identifiers, device and browser information, page paths, referral origins, IP-derived location and event information. We remove query strings and fragments from Analytics page URLs and do not send enquiry names, email addresses, telephone numbers, message text or Ask DPS conversation content to Analytics.

Our legal basis is consent. Analytics is blocked until you accept the Analytics category in CookieYes. Advertising consent is a separate choice. Refusing or withdrawing Analytics does not prevent browsing, brochure access, enquiries or use of Ask DPS. Withdrawal reloads the page to remove active measurement code. We disable Google signals, advertising personalisation and automatic enhanced measurement in this implementation. Analytics cookies are configured to expire after one year; activity may renew them. Event-level Analytics data is retained for two months, after which it is deleted automatically; aggregated reports can remain available. Google acts as a measurement-service provider under its Data Processing Terms. See Google’s Privacy Policy, our international-transfer information below and the Cookie Policy and Report.

Google Ads conversion measurement

With your consent to the Advertisement category, we use Google Ads to measure completed ISMS Workspace enquiries and requests to download its brochure. A brochure request measures selection of the PDF link, not whether you saved or read the document. Google may process ad-click and cookie identifiers, page URLs, IP address, browser information and conversion events to attribute activity to advertising. We do not include enquiry names, email addresses, phone numbers, messages or chatbot content in these events, and enhanced conversions and personalised advertising signals are disabled in this implementation.

Our legal basis for optional advertising measurement is consent. The Google Ads destination is blocked until you accept advertising measurement; Google Analytics follows its separate Analytics consent choice. Rejecting it does not prevent browsing, enquiries or brochure access. Withdrawing through Consent Preferences stops future measurement and reloads the page to remove the loaded tag. Google is a recipient of advertising measurement data; its processing and international transfers are described in Google’s Privacy Policy and Google’s advertising data protection terms. See the Cookie Policy and Report for storage details.

We use CookieYes to display our cookie notice, record your consent choices and let you change or withdraw them. CookieYes stores a necessary consent preference cookie. You can reopen the consent controls using the cookie preferences button displayed on this website. Optional cookies, where used, are enabled only with your permission.

Cookies and similar technologies can store information on, or access information from, your device. The enquiry form does not require advertising or analytics cookies. Technical website logs are separate from cookies and may be generated when pages are requested.

Where a cookie or similar technology is strictly necessary to provide a service you request, it may be used without consent as permitted by applicable law. If we introduce optional analytics, advertising or other technologies that require consent, we will explain their purposes, providers and duration and obtain your consent before they operate. We will provide a way to refuse or withdraw that consent. We will apply the consent requirements relevant to UK and EU visitors rather than assuming a UK exception applies throughout the EU.

You can use your browser settings to control or remove cookies, although blocking necessary technologies can affect website functionality. If optional cookie controls are provided, you can change your choices through those controls. Contact us if you would like information about the technologies used to deliver the website.

Our Cookie Policy and Report identifies the technologies currently used, their purposes and lifetimes, and explains how to reject or withdraw optional choices. Cookie identifiers and consent records may be personal or pseudonymous data even without your name. Cookie consent does not authorise messages to be sent to OpenAI.

9 Who may receive your personal data

Access is limited to people and organisations that need the information for the purposes described in this policy. Recipients may include authorised staff and the service providers supporting website hosting, infrastructure, security, email and business communications. Relevant information may also be shared with professional advisers where necessary for advice, compliance or legal claims, and with authorities where disclosure is required by law or otherwise has a lawful basis.

Where a provider processes personal data on our behalf, we require appropriate contractual protections and instructions, including confidentiality and security obligations. Some recipients, such as authorities or professional advisers, may act as independent controllers for their own legally defined purposes.

If our business is involved in a proposed merger, acquisition or transfer, relevant information may be disclosed to advisers or prospective parties where necessary and lawful, subject to appropriate confidentiality and data protection safeguards. We do not sell website enquiry information or provide it to unrelated organisations for their own marketing.

Website providers include Hostinger for hosting and infrastructure, CookieYes for preference management, Microsoft 365 for enquiry emails and business communications, and OpenAI for questions and context submitted to Ask DPS with your consent. Providers may process technical identifiers as well as the content needed for the service.

10 International processing and transfers

We are established in Cyprus. Website enquiries and technical information may be processed in the European Economic Area, the UK or other countries where relevant providers or authorised personnel operate. Hosting locations for the separate workspaces are addressed in their own documentation and should not be assumed to be the hosting locations for this public website.

Where disclosure or access constitutes a restricted international transfer, we use a lawful mechanism under the applicable EU or UK rules. This may be an applicable adequacy decision or regulation, or appropriate contractual safeguards such as the European Commission’s Standard Contractual Clauses and, for relevant UK transfers, the UK International Data Transfer Agreement or UK Addendum. We assess the destination’s protection and apply supplementary measures where required. A transfer exception is used only where its specific conditions are met.

You can contact us to ask where your information is processed and obtain information about the relevant safeguards, including a copy where applicable, subject to lawful redactions needed to protect confidential information or other people’s rights.

11 How long we keep personal data

We keep personal data only for as long as needed for the purpose for which it was collected, taking account of legal requirements and the need to resolve disputes. The retention criteria below apply to website information; workspace retention is governed separately.

• Enquiries, demonstration requests and quotations: retained while we deal with the enquiry and any proportionate follow-up, then reviewed for deletion when there is no continuing business need. If an enquiry leads to a business relationship, relevant correspondence may become part of our business records and is retained according to the applicable contractual, statutory and claims requirements.
• Technical and security records: retained for the period necessary to operate the website, diagnose faults and investigate misuse. Records relating to an incident may be preserved for the investigation and any associated legal or regulatory process.
• Marketing preferences and objections: retained while necessary to honour your choices. A minimal suppression record may be retained after you unsubscribe so that you are not contacted again in error.
• Privacy requests and complaints: retained to manage the matter, demonstrate how we handled it and address any subsequent regulatory enquiry or legal claim. Identity evidence is deleted when no longer necessary for verification unless there is a separate lawful reason to retain it.

When deciding the period, we consider the information’s sensitivity, the purpose, the date of the last relevant interaction, applicable statutory retention duties and limitation periods, and any ongoing complaint, investigation or legal hold. Information no longer needed is deleted or anonymised. Copies in backups are removed through the applicable backup cycle and are not retained for routine use. You can ask us for the retention period or criteria applicable to a particular record.

AI conversation memory, consent grants and separate OpenAI retention are described in section 8. The cookie preference lifetime is explained in our Cookie Policy and Report. These are distinct from enquiry, hosting and business records.

12 How we protect your information

We use technical and organisational measures appropriate to the nature of the information and the risks, including proportionate access restrictions, confidentiality requirements and supplier controls. We review security arrangements and respond to suspected incidents. No internet transmission or system can be guaranteed completely secure. Please use the website enquiry function only for information appropriate to an ordinary business email.

13 Your data protection rights

Depending on the circumstances and the applicable law, you have the following rights:

• Access: to obtain confirmation that we process your personal data and receive a copy and the required supporting information.
• Rectification: to have inaccurate data corrected and incomplete data completed.
• Erasure: to request deletion where the legal conditions are met.
• Restriction: to request limits on processing in the circumstances provided by law.
• Portability: to receive data you provided in a structured, commonly used, machine-readable format, and have it transmitted where technically feasible, where processing is automated and based on consent or contract.
• Objection: to object to processing based on legitimate interests on grounds relating to your particular situation. We will stop unless we demonstrate compelling legitimate grounds overriding your interests and rights, or the processing is needed for legal claims. Your right to object to processing for direct marketing, including related profiling, is unconditional.
• Withdrawal of consent: to withdraw consent at any time where we rely on it, without affecting the lawfulness of earlier processing.
• Automated decisions: to receive the protections applicable to decisions made solely by automated means that produce legal or similarly significant effects.

We do not use website enquiries to make solely automated decisions that produce legal or similarly significant effects about you. If this changes, we will provide the information and safeguards required by the relevant law before the processing begins.

To exercise a right, use the contact details in section 2. No particular form or legal wording is required. We may ask for proportionate information to verify your identity or understand your request, but will not routinely require identity documents.

We normally respond without undue delay and within one month of receiving a request. Where legally permitted because of the complexity or number of requests, we may extend the period by up to two further months and will tell you within the initial month, explaining why. Any adjustment for necessary identity checks or clarification will follow the applicable law. Requests are normally free. If a statutory exception permits a fee, refusal or limitation, we will explain the basis and the available complaint rights. These rights are subject to the conditions and exemptions in the relevant legislation.

Our DSAR Policy explains how requests are handled. You may make a request verbally or in writing without a mandatory form. UK rules on necessary clarification, identity information and permitted fees are applied only where legally relevant; a UK clarification pause is not automatically applied to an EU GDPR request. Access concerns records we hold or are responsible for; we cannot reconstruct a chat that is no longer available, but consider relevant provider-held information where required.

14 Complaints and supervisory authorities

If you have concerns about how we use your personal data, please contact us using section 2. We will acknowledge a data protection complaint within 30 days, make appropriate enquiries, keep you informed where needed and communicate the outcome without undue delay. Please describe the issue and how we can contact you. You do not need to use a particular complaint form.

You also have the right to complain to a competent data protection supervisory authority. Our authority in Cyprus is the Office of the Commissioner for Personal Data Protection. Its website provides current contact details and complaint information: https://www.gov.cy/dataprotection/en/.

If the EU GDPR applies, you may complain to the supervisory authority in the EU Member State of your habitual residence, place of work or the alleged infringement. For matters falling within UK data protection law, you may complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. You may also seek a judicial remedy where the law provides one. Contacting us does not remove your statutory rights.

Our Data Handling Complaints Process explains the internal route. You may complain directly to a competent supervisory authority without first exhausting our procedure. See the Cyprus Commissioner complaint information or the ICO complaint route.

15 Children and external websites

The website promotes business software and professional services and is not directed at children. We do not knowingly solicit children’s personal data through website enquiries. If you believe a child has provided personal data, please contact us so we can assess and address the matter.

The website contains links to other sites and services, including separate workspace services. Their processing may be covered by different privacy information. Please read the relevant policy when you follow a link. This policy applies to the public DPS Compliance Hub website and the associated enquiry processing described here.

16 Changes to this policy

We may update this policy to reflect changes in the website, our processing or the law. The date at the top identifies the latest revision. Where a change requires additional notice or consent, we will provide it as required before carrying out the affected processing.

Demo scheduling with Calendly

You can choose to load the Calendly calendar on our demo scheduling pages or follow a link to Calendly. The embedded calendar is not loaded until you select “Load demo calendar”. Calendly then receives technical information from your browser and processes the booking information you enter, such as your name, email address, chosen meeting time and answers to booking questions. Booking details are made available to DPS and our connected calendar so we can arrange and deliver your demonstration and related communications.

We use your booking information to take steps at your request before entering a contract and to manage the requested meeting. Do not include sensitive or confidential information in booking questions. Scheduling information is covered by the enquiry retention and international-transfer provisions in this policy. For Calendly’s own processing and storage information, read Calendly’s Privacy Notice. Our Cookie Policy and Report explains when the calendar loads. If you consent to website measurement, a completed booking may be recorded as a lead event; we do not send the booking payload, name, email address or meeting answers to Google Analytics or Google Ads.