Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains how Data Privacy and Data Security Services Limited, trading as Data Privacy Services (DPS), collects, uses, shares and protects personal data, and how you can exercise your rights. It covers our public website, enquiries, business relationships and the Ask DPS AI assistant.

1. Who we are and how to contact us

Data Privacy and Data Security Services Limited is a company registered in Cyprus, company number HE 432380.

Registered address:
Griva Digeni, 51 Athineon Court, Office 202
8047, Paphos, Cyprus

United Kingdom operating address:
124 City Road
London, EC1V 2NX, United Kingdom

For the processing described in this policy, we act as a data controller: we decide why and how personal data is used. Where we handle personal data on a client’s documented instructions, we may instead act as its data processor, as explained below.

Privacy contact: info@dataprivacyservices.co.uk — please mark your message “Privacy / Data Protection”.
Telephone: 0808 101 0155
Website: dataprivacyservices.co.uk
You may also write to either address above or use our Contact Us page.

2. Scope and applicable legislation

This policy applies to website visitors, people who enquire about our services, clients and their authorised representatives, suppliers, business partners and people who communicate with us about their personal data. We apply the EU General Data Protection Regulation (EU GDPR), applicable Cyprus data protection legislation, and the UK GDPR and Data Protection Act 2018, as amended, where relevant. UK electronic marketing and storage or access technologies are also subject to the Privacy and Electronic Communications Regulations (PECR).

Client portals, software workspaces, training platforms and particular services may have additional privacy information explaining their specific processing. Recruitment and employment processing should be read with the relevant employment or applicant notice. Following a link to another organisation’s website brings you within that organisation’s own privacy arrangements.

When a client supplies records for consultancy, DSAR support, incident management or another contracted service, the client normally remains responsible for its own controller obligations. Our contract and any data processing agreement determine our instructions, responsibilities, security requirements and return or deletion of that information. This public website notice does not replace the client’s privacy notice.

3. Personal data we collect and its sources

Depending on your interaction with us, we may process:

• Identity and business contact information: name, business role, company, email address, telephone number and correspondence or billing address.
• Enquiry and relationship information: the service you are interested in, your requirements, proposals, appointments, correspondence and information you choose to include in a message.
• Contract and financial information: orders, agreements, invoices, payment status and details needed to administer payments and accounts.
• Service and portal information: authorised user details, roles, tasks, shared documents, meeting records, privacy registers and support or incident information relevant to the agreed service.
• Technical and usage information: IP address, browser and device information, pages visited, timestamps, referral information and security or diagnostic records. Cookie-related collection depends on the technology and your preferences.
• Preference and rights information: consent choices, marketing preferences, privacy requests, complaints, correspondence and proportionate identity verification information.
• AI interaction information: messages you enter into Ask DPS, recent conversation context and the assistant’s responses, as described in section 8.

We receive information directly from you through forms, email, telephone, meetings, service interactions and the chatbot. We may also receive information from your employer, an authorised colleague, a client, a representative acting for you, a referring partner or a service provider. Business contact details may come from professional or publicly available sources. Where applicable, we provide the required information about indirect collection within the statutory period, normally no later than one month, or earlier when first communicating with you or disclosing the information.

Please provide only information relevant to your request. Do not use public forms or Ask DPS to send passwords, identity documents, payment card details, confidential client records or sensitive personal data. If sensitive information is needed for an agreed service, contact us to arrange an appropriate secure channel.

4. Our purposes and lawful bases

We identify a lawful basis for each purpose. The appropriate basis depends on the circumstances; the existence of a business relationship does not make every activity contractually necessary.

Purpose	Lawful basis and relevant interests
Responding to enquiries, preparing proposals and arranging discussions	Legitimate interests in answering business enquiries and developing appropriate service relationships. Where you personally request steps before entering a contract, Article 6(1)(b) may apply.
Delivering and administering services, training or accounts	Performance of a contract where you are a party to it; otherwise legitimate interests in delivering services and communicating with a client’s or supplier’s representatives.
Managing invoices, payments, accounting and tax records	Legal obligations and, for relevant administration or recovery of payments, contractual necessity or legitimate interests.
Operating and protecting our website, systems and business	Legitimate interests in reliable services, preventing fraud and abuse, maintaining security and investigating technical problems; legal obligations where applicable.
Optional analytics, advertising and similar website technologies	Consent where required by applicable cookie and data protection rules. See our Cookie Policy.
Providing Ask DPS AI answers	Your consent under Article 6(1)(a), obtained before a message can be submitted. Limited security controls use legitimate interests; necessary compliance records support our legal obligations.
Service updates and marketing	Contractual necessity or legitimate interests for operational communications. Marketing uses consent where required, or legitimate interests for appropriate business marketing where applicable electronic communications rules permit it.
Handling rights requests, complaints, disputes and legal claims	Legal obligations and legitimate interests in resolving concerns, maintaining accountability and establishing, exercising or defending legal claims.

When relying on legitimate interests, we consider the purpose, necessity and impact of the processing, and balance our interests against your rights and reasonable expectations. You may object to this processing, as explained in section 12.

If special category information is necessary, we must also identify an applicable Article 9 condition, such as explicit consent or the establishment, exercise or defence of legal claims. Criminal offence information requires the additional authority or legal conditions applicable under Article 10 and relevant national law. Ordinary website or chatbot consent is not an invitation to supply these categories.

5. Information you need to provide

Some information is needed to answer a request, establish an account, perform a contract or meet a legal obligation. Required form fields are indicated at collection. If necessary information is not supplied, we may be unable to respond fully or provide the requested service. Optional information, optional cookies and use of the AI assistant are your choice. You can contact our team without using Ask DPS.

6. Marketing and your preferences

We may communicate about services relevant to a business relationship, subject to applicable data protection and electronic marketing rules. Where consent is required, we obtain it separately. A service enquiry, cookie choice or agreement to use Ask DPS does not, by itself, subscribe you to marketing.

You can stop direct marketing at any time using an unsubscribe option in the communication or by emailing us. Your right to object to direct marketing is unconditional. We may retain a limited suppression record so we can respect your objection. Essential service, billing or security communications are not marketing and may continue while relevant to our relationship.

7. Cookies, analytics and Cloudflare verification

Our website uses CookieYes to present cookie choices and remember preferences. Necessary technologies support functions such as preference management and security. Optional technologies may support analytics, enhanced features and advertising. Device identifiers and cookie information can be personal data even where they do not contain your name.

Read our Cookie Policy and cookie information for purposes, providers, durations and controls. You can revisit your choices through the website’s Consent Preferences control. Consent to cookies is separate from consent to the AI assistant.

Cloudflare Turnstile protects website forms against automated abuse. Cloudflare may process technical information about your browser, device and connection to perform verification. A verification token is submitted with the form and checked by the form integration. This security check does not subscribe you to marketing. Cloudflare explains its processing in its Turnstile privacy information.

Google Ads conversion measurement

With your Analytics and Advertising cookie consent, we use Google Ads to measure successful DPO enquiry submissions and requests for our DPO brochure, and to understand which advertising brought visitors to those actions. Measurement may involve an advertising click identifier, cookie identifiers, page and browser or device information. A brochure request means selection of the PDF link; it does not confirm that the document was saved or read.

The conversion event does not send your name, email address, telephone number, enquiry message or AI chat content to Google. Enhanced conversions and advertising personalisation are disabled for this measurement. Google may process technical information outside the UK or EEA under the transfer arrangements described below. See Google’s Privacy Policy and Google’s cookie information. You can refuse or withdraw either Analytics or Advertising consent through Consent Preferences. Withdrawal stops further measurement by this integration and reloads the page; it does not recall information already sent.

8. Ask DPS AI chatbot

What it does and what is sent to OpenAI

Ask DPS provides automated answers about DPS services and basic data privacy guidance. We use the OpenAI API to process your message, a limited recent conversation history and relevant public reference material. The assistant may use web search restricted to Information Commissioner’s Office (ICO) sources to support privacy guidance. Relevant search queries may therefore be processed as part of the AI service.

Anything you type may be included in the information sent to OpenAI, including personal data you choose to enter. We do not need your name, contact details or confidential records to answer a general question. The public assistant does not have access to your private client portal records merely because you visit the website.

Your consent and how to withdraw it

Before questions can be submitted, the assistant presents a processing notice and an unticked consent checkbox. You must actively agree and select Agree and start. Server-side checks also require a valid consent grant. Declining the chatbot has no effect on your ability to browse the website or contact our team.

Select Withdraw consent and clear chat to revoke the grant, clear the conversation from the assistant and stop further messages being sent through that chat. Withdrawal does not affect the lawfulness of processing already undertaken and cannot recall a request already processed by OpenAI. Clear chat clears the displayed conversation but is not the same as withdrawing consent. Closing the chat panel alone does neither.

Storage, security records and provider retention

The chatbot application does not save conversation transcripts in our website database. It maintains a limited conversation in the current webpage’s memory to support follow-up answers. That context is cleared when you clear the chat, withdraw consent or reload or leave the page.

A pseudonymous consent grant records the time of agreement and notice version. It expires after 24 hours and is removed through routine system cleanup; withdrawal revokes it immediately. Limited rate-limit and security records use a hashed network identifier to control abuse. These are separate from normal hosting security and access logs.

We configure OpenAI requests not to store responses as retrievable application state. This is not a guarantee that OpenAI retains no information. Under its standard API arrangements, OpenAI may retain inputs, outputs and related information in abuse-monitoring logs for up to 30 days, with longer retention in specified legal or safety circumstances. OpenAI states that API data is not used to train its models by default unless an organisation opts in to sharing. Its current API data controls information explains these arrangements.

Limits of the assistant

Answers are generated by AI and may be incomplete or inaccurate. They do not replace advice on your circumstances and do not constitute a decision about your legal position. The public assistant does not make solely automated decisions producing legal or similarly significant effects about you, book appointments, create support tickets or notify regulators. For an incident, urgent deadline or confidential matter, contact your DPO or our team through an appropriate channel.

9. Who receives personal data

We restrict disclosure to the information needed for the relevant purpose. Recipients may include:

• Authorised DPS personnel and contracted professionals delivering or supporting the relevant service.
• Hosting, infrastructure, security, email, collaboration, document management and business administration providers. These may include Hostinger and Microsoft services used to support our operations.
• Website providers such as CookieYes and Cloudflare, analytics providers such as Google where enabled, and advertising or booking providers where their features are used.
• OpenAI for messages and context submitted to Ask DPS with your consent.
• Banks, payment services, accountants, auditors, insurers and legal advisers where needed for transactions, professional advice or business administration.
• Relevant delivery partners or suppliers where required for a service you have requested or an agreed engagement.
• Authorities, regulators, courts or other recipients where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Where a recipient processes information on our behalf, the relationship must be governed by appropriate data processing terms. Some recipients act as independent controllers for their own legal, professional, payment or security purposes. You can contact us for more information about recipients relevant to your interaction.

10. International transfers

Our Cyprus and UK operations and the providers we use may involve access to or processing of personal data in the EEA, the United Kingdom, the United States or other countries where a relevant provider operates. Use of a cloud service does not, by itself, guarantee that all processing remains in the UK or EEA.

Where a transfer is restricted under applicable law, it must be covered by an appropriate transfer mechanism. Depending on the transfer, this may be an applicable adequacy decision or regulation, European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK Addendum to the EU clauses. Where required, we assess the protection afforded by the destination and adopt supplementary safeguards. We do not treat ordinary chatbot consent as a blanket waiver of international transfer requirements.

You can request information about the destination and safeguards applicable to your data, or a copy of relevant safeguards, by contacting our privacy contact. Confidential business information may be appropriately redacted.

11. How long information is kept

We retain information for no longer than needed for its purpose, unless a legal obligation or properly justified legal hold requires longer. We determine the period using the nature and sensitivity of the information, the relationship or request, relevant accounting and tax obligations, applicable limitation periods, complaint requirements and contractual instructions.

Information	Retention criterion
Enquiries and proposals	For the enquiry or proposal and an appropriate follow-up period, then only where a continuing relationship, dispute or other justified purpose requires it.
Client and service administration records	For the engagement and the period needed to satisfy contractual, regulatory or legal accountability requirements.
Invoices and financial records	For the statutory accounting and tax retention period applicable to the record and the relevant jurisdiction.
Client-controlled information	According to the client’s lawful instructions and the return, deletion and retention terms of the relevant agreement, subject to legal requirements.
Marketing preferences	While the relevant permission or relationship continues; a minimal suppression record may be retained to honour an objection.
Privacy requests and complaints	For handling and evidencing the outcome, and the period needed for regulatory accountability or relevant legal claims.
Cookies and related browser storage	The duration associated with the particular technology, described in our Cookie Policy and preference information.
AI interactions and consent	As explained in section 8: current-page chat memory, a 24-hour consent grant, limited abuse controls, and separate OpenAI provider retention.

When information is no longer required, it is securely deleted, returned or anonymised as appropriate. Backup copies may remain until the backup cycle overwrites or removes them; access is restricted and a restoration must respect applicable deletion requirements. Contact us for the retention criteria applicable to a particular record.

12. Your rights

Subject to the applicable law and any lawful limitations, you may request access to your personal data, correction of inaccurate or incomplete information, erasure, restriction of processing, and portability of information where the conditions apply. You may object to processing based on legitimate interests and have rights in relation to qualifying automated decision-making. You may withdraw consent at any time and object to direct marketing without having to give a reason.

Use the contact details in section 1. Our Data Subject Access Request and Individual Rights Policy explains how requests are handled. You do not have to use a particular form or submit an access request in writing. We may ask for proportionate information if we reasonably need to verify identity or authority.

We respond without undue delay, normally within one calendar month under the applicable rules. An extension of up to two further months may be permitted for complex or multiple requests; we explain any extension and its reasons within the required period. Where the UK GDPR lawfully permits a pause for necessary clarification, or specific rules about identity information or a permitted fee apply, we explain the effect on the response date. Access is normally free of charge; any lawful fee or refusal is assessed individually and explained.

13. Concerns and complaints

If you are concerned about our handling of personal data, contact our privacy contact. We will consider your concern, investigate where appropriate and explain our response. Our Data Handling Complaints Policy and Process explains how to complain.

You may also complain directly to the competent supervisory authority. Contacting us first can help resolve a concern, but is not a condition of exercising your regulatory rights.

• United Kingdom: the Information Commissioner’s Office (ICO).
• Cyprus: the Office of the Commissioner for Personal Data Protection.
• Elsewhere in the EEA: the supervisory authority in your habitual residence, place of work or place of the alleged infringement, where applicable.

14. Security

We use technical and organisational measures proportionate to the risks. These include appropriate access restrictions, staff confidentiality obligations, authentication, secure transfer methods, security monitoring and protection of systems and records. Encryption, backup and incident management controls are applied where appropriate to the system and information involved. No internet transmission or information system can be guaranteed completely secure.

If a personal data breach occurs, we assess it and notify the relevant authority and affected individuals where the applicable law requires us to do so.

15. Children and sensitive service information

Our public website and Ask DPS are intended for business and professional enquiries, rather than services directed at children. Our contracted work for schools, healthcare providers and other organisations may involve children’s or sensitive information under an appropriate agreement and the relevant controller’s instructions. This does not make the public chatbot a suitable channel for those records.

16. Changes to this policy

We review this policy when our processing, services or applicable requirements change. The date at the top identifies the latest revision. Where a material change requires further information or renewed consent, we provide it before relying on that change. Reading this policy or continuing to browse is not, by itself, consent to optional processing.