Privacy Policy
This Privacy Policy explains how we collect, use, store and protect personal data in connection with our website, our commercial relationships and our email and SMS marketing campaign services.
Effective as of 3 November 2026.
1. Who we are
For the purposes of applicable data protection laws, including the UK GDPR, the EU GDPR where applicable and the Data Protection Act 2018, DMS Europe Ltd controls the data described in this policy, except as specified in other sections of this policy.
In accordance with Article 27 of the European Union GDPR, DMS Europe Ltd has appointed JC Management SAS as its representative in the European Union. Data subjects and EU supervisory authorities may contact this representative on any issue related to processing covered by the European Union GDPR.
2. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed in connection with our website, our contact and quotation forms, our commercial exchanges, our customer relationships, our newsletters, our campaign services and our opt-in audiences.
It also explains how we process personal data when we send email or SMS marketing campaigns to our own opt-in audiences on behalf of business customers, without transferring contact files to those customers.
Separate cookie information may be provided in our Cookie Policy, where applicable.
When a person reaches our website after clicking a Google Ads advertisement, we may process the click identifier added to the URL, such as GCLID, WBRAID or GBRAID. If that person submits an enquiry or creates an account during the same session, we associate the identifier with that conversion only. We do not attach the contact details entered in the form, the IP address or browsing history.
3. Who this policy applies to
This Privacy Policy applies to website visitors, people who contact us, newsletter subscribers, prospects, customers, representatives of customers or agencies, users of our services and people included in our opt-in audiences.
It may also apply to recipients of marketing campaigns routed by us on our own audiences, including individuals who receive an email or SMS campaign, click on a link, unsubscribe, send a STOP SMS request or submit a complaint.
4. Personal data we collect
The personal data we collect depends on the relationship we have with the individual and the context in which the data is processed.
For website visitors, prospects and people who contact us, we may process identification and contact details, such as first name, last name, business email address, phone number, company name, job title, country, language, message content, requested service, campaign requirements and any information voluntarily submitted through our forms.
For customers, agencies and business contacts, we may process business identity data, billing details, order details, campaign parameters, selected countries, target volumes, selected products, targeting criteria, budget information, website URLs, landing page URLs, creative assets, commercial content, communication history, support requests, contractual documents, invoices, payment status, account information and service usage information.
For people included in our opt-in audiences, we may process, depending on the data available and the relevant consent, contact details, demographic information, country, geographical area, age range, gender, socio-professional category, housing-related information, interests, commercial preferences, property-related interests, automotive interests, interaction history, campaign exposure history, email engagement data, SMS delivery status, unsubscribe status, email open tracking preference, SMS STOP status, complaint information, consent records, source of registration, timestamp, IP address, form or registration context and proof of consent.
We may also process technical data such as IP address, browser type, device information, operating system, language, pages viewed, logs, timestamps, security events and cookie-related identifiers where applicable.
We do not intentionally use special categories of data, criminal offence data, or criteria that allow such data to be inferred to build or target our audiences. Marketing audiences are restricted to adults; minors are excluded from our targeting criteria and campaigns.
5. How we collect personal data
We may collect personal data directly from individuals when they fill in a form, contact us, request an estimate, subscribe to a newsletter, interact with our website, communicate with us or use our services.
We may also collect personal data through our own opt-in audience acquisition processes, registration forms, preference forms, consent mechanisms, campaign interactions, unsubscribe links, SMS STOP messages, complaints and technical systems.
We may also purchase personal data from partners established in the European Union or in other countries. These purchases are governed by applicable data protection rules, including the UK GDPR, the European Union GDPR and, where applicable, adequacy decisions, standard contractual clauses or another recognised transfer mechanism. We regulate these purchases by contract and require the partner to provide assurances concerning the lawfulness of collection, data provenance, information provided to individuals and the granted rights of use.
In the context of customer campaigns, customers may provide us with campaign content, commercial information, landing page links, targeting instructions and other materials necessary for campaign preparation and routing. However, our standard service does not require customers to provide us with their own contact databases.
Customers may, however, create reusable exclusion lists containing only email or telephone hashes under section 7B. We do not accept plaintext contact details in those lists.
6. Why we use personal data and lawful bases
The matrix below states the main purpose and the lawful basis normally used. The basis that applies in practice depends on the context, the recipient’s country and electronic communications law.
7. Marketing campaigns sent to our opt-in audiences
For campaigns sent to our own opt-in audiences, we act as controller for the audience data and for the routing of the campaign. We do not sell, rent or deliver contact files to our customers.
Customers select targeting criteria, campaign parameters, channels and volumes, but the technical routing is carried out by us or by technical providers acting under our instructions.
We may use personal data in our audiences to select relevant recipients, send the campaign, record delivery and interaction events, manage unsubscribes, process SMS STOP requests, suppress contacts from future campaigns and respond to complaints or regulatory requests.
Our emails may contain an invisible pixel and individualized links. They allow us to measure deliverability, opens and clicks, assess campaign performance and, where planned and permitted, adapt or trigger subsequent communications, including an SMS retargeting message after an open. For new collections and new permissions, we obtain prior consent to individual tracking where required by the applicable law, including in the United Kingdom, France, Italy and Spain. Measurements strictly necessary for transmission, security or limited technical deliverability are used without consent only where every condition of the local exemption is met.
Permissions already obtained are not automatically invalidated. Where national law provides a documented transitional arrangement, we may continue tracking historical addresses on its conditions. In France, for addresses collected before 14 April 2026, this notably requires compliant notice offering a right to object to have been sent within the permitted period and the conditions of marketing to remain unchanged. This French transitional rule is not extended to other countries; without a valid basis in the country concerned, individual tracking is disabled or consent is requested.
The “Disable tracking” link in each email allows consent to be withdrawn or an objection to open tracking to be made. We then stop all marketing use of the pixel and delete or disassociate previous opens from the profile according to the applicable basis. A separate signal may remain only for an exempt technical purpose, in a minimised form that is not used for profiling or retargeting. This choice does not unsubscribe the individual; a separate link allows them to unsubscribe.
Segmentation and profiling combine declared or available criteria — for example country, area, age range, socio-professional category, interests, exposure history and permitted interactions — to assign an individual to segments and select campaigns likely to be relevant. No special category data is used, minors are excluded, and no solely automated decision produces legal or similarly significant effects on an individual.
We may keep evidence of consent and related compliance records for the duration of the processing concerned and for up to five years after the end of the relevant processing, where this is necessary to demonstrate compliance, manage complaints, defend legal claims or respond to competent authorities.
7A. Business-to-business prospecting
We use our internal prospect relationship management tool (PRM) and, separately, Apollo.io for our own business-to-business prospecting. DMS Europe is the controller for these activities. We send offers relevant to the person’s role or their organisation’s activity, based on our legitimate interest in developing our business, balanced against their rights and reasonable expectations. National marketing rules still apply; we must obtain prior consent where those rules require it.
7A.1. Prospect management and outreach through our PRM
Data and sources. Our teams enter information in the PRM or import it through CSV files. Depending on information obtained during exchanges or from public professional sources, our network or B2B data providers, a record may contain: professional identity and contact details, company, job title and decision-making role, country, language, recorded source, collection date, needs, qualification notes, summaries of calls or meetings, projects, amounts and commercial proposals, documents and message history. Notes and documents must be limited to professional information relevant to the relationship.
Sales follow-up and reminders. We use this data to qualify enquiries, assign records to salespeople, organise tasks, prepare proposals and follow opportunities. Authorised people prepare templates and follow-up sequences; the system then sends messages on the dates and according to the delays, sending hours and limits configured. This automation does not make decisions producing legal or similarly significant effects on the individual.
Emails and replies. PRM emails are sent from a domain dedicated to DMS Europe’s prospecting. They contain neither an open-tracking pixel nor individualised click-tracking technology. We record messages, sending dates and statuses, delivery failures and objections. Replies received by prospecting addresses are forwarded to salespeople’s professional mailboxes. The PRM retrieves messages it can match to a contact or an outgoing email and stops the associated automated follow-ups when it recognises a reply. Exchanges continued from the professional mailbox may be logged manually in the record.
Access and objections. Authorised salespeople, managers and administrators access records according to their permissions. Providers needed for hosting and email services act under the conditions described in sections 10 and 11. PRM documents are downloaded subject to access controls. Each PRM prospecting email includes a link to confirm an objection without creating an account; recipients may also reply to the salesperson or use our data rights request form. An objection recorded in the PRM stops the contact’s sequences and cancels their queued messages; minimal information is retained to prevent further sends to that address.
Period of use and conversion to a customer. The PRM blocks new prospecting emails to a contact three years after the recorded collection date or their last recorded active contact, whichever is later. An email sent by our teams or a routine administrative edit does not restart this period. Archiving a record does not erase it. When a prospect becomes a customer, necessary information may be copied to the customer account and the sales record remains linked to it; the company’s sequences and queued emails are stopped. Conversion does not automatically subscribe the contact to a newsletter. Retention periods and exceptions are described in section 12; they also cover exchanges kept in mailboxes.
7A.2. Prospecting through Apollo.io
We also use Apollo.io to find and organise business contacts and manage our outreach and commercial follow-ups. Data may come from public professional sources, our network and B2B data providers, including Apollo.io. It may include first and last name, business email and phone number, job title, company, website, country, language, source and the history of exchanges, sends, replies, delivery failures and objections. Apollo.io and the relevant email providers participate in these activities according to their role; sections 10 and 11 apply to recipients and any international transfers.
In our current Apollo.io configuration, pixel-based open tracking and individualised click tracking are disabled. Reply tracking and events necessary to manage exchanges and deliverability remain distinct from those technologies. You may object to outreach by replying to the salesperson, using the unsubscribe mechanism provided in messages or using our data rights request form. Prospecting data is retained for three years from collection or the person’s last active contact, subject to the periods and exceptions in section 12. Any tracking data collected before tracking was disabled remains subject to applicable retention periods; disabling tracking does not, by itself, erase earlier data.
For both channels, where data is not obtained directly from the person, information must be provided as soon as possible, no later than the first contact and, in all cases, within one month of collection, unless a statutory exception applies. This information includes the data categories and source. You may exercise your rights of access, rectification, erasure, restriction and objection through our data rights request form. The tracking rules for audience campaigns and newsletters described elsewhere do not describe the untracked prospecting emails presented here.
7B. Customer-provided exclusion lists
Customers can create, name, modify and delete email or telephone exclusion lists through their account, an authorised administrator or the API. They can select them for audience counts, saved audiences and manual or AI-assisted campaign creation. The individuals concerned are the customer’s contacts whom it wishes to exclude, whether or not they are present in our audiences.
We receive only unsalted hexadecimal hashes: 32 characters for MD5 or 64 for SHA256, with automatic algorithm detection. Before hashing, the customer must trim leading and trailing whitespace from emails and lowercase them; telephone numbers must use E.164 including the + sign. These hashes remain pseudonymised personal data, not anonymous data. The customer is responsible for normalisation, lawful sources, informing individuals and the lawful basis for its instructions. A hash’s format cannot establish whether the original number was normalised correctly. Invalid values are ignored and reported in the processing summary.
For exclusion lists supplied by customers, we act as processor on their instructions; the customer remains the controller. We process them on its behalf under documented instructions, Article 28 of the applicable EU or UK GDPR and section 5A of our Data Protection Agreement. Their sole purpose is to compare hashes against normalised audience contact details and exclude the whole contact when either an email or telephone matches, during counting and actual recipient selection. We do not use them to market to the customer’s contacts or enrich our audiences. Our roles concerning our own audience data remain as described above.
Hashes are stored in dedicated SQL tables, with access restricted to the relevant customer and authorised personnel. CSV files are temporary and deleted after processing; incomplete transfers are cleaned up. Hashes and file contents are never sent to an AI model or copied to application logs. Only references and metadata needed to select a list may be used by the assistant.
A reusable list is retained for twelve months from initial import or the latest content update (replacement, addition or removal of hashes). Renaming, viewing, counting or using it does not extend the displayed expiry date. A scheduled campaign fixes the version used; later modifications do not change its exclusions. A version still needed for a scheduled campaign is retained until thirty days after the last relevant campaign is completed or cancelled. References from drafts are released after thirty days of inactivity without shortening the reusable list’s twelve-month period.
Expiry or a deletion request makes the list unavailable for new uses. A saved audience referencing it requires replacement or explicit removal of that exclusion before reuse. Eligible hashes and versions are progressively purged by a daily batch job. Versions protected for scheduled campaigns are purged only once the period above ends. Obsolete versions that are no longer needed are also deleted.
After the list and its retained versions have actually been deleted from active storage, the customer account holder receives an email in their language through the platform’s notification profile. It identifies the list, date and reason, without hashes. Delivery failure does not delay deletion: only metadata needed to retry the notification remains pending. Residual backups are isolated from ordinary use and expire within the maximum thirty- day cycle in section 12; any restoration must reapply deletions.
The customer is the primary contact for rights concerning its lists. If an individual contacts us, we forward the request to the relevant customer and assist it, subject to necessary verification, without disclosing another customer’s data or revealing our audience contacts.
8. Customers’ landing pages and lead collection
Campaigns routed by us may direct recipients to a landing page, website, form or digital environment operated by the customer or by a third party selected by the customer.
The customer is responsible for the content of the campaign, the promoted offer, the landing page, any form displayed after a click, and any personal data collected from individuals after they leave our campaign environment.
When a recipient clicks on a campaign and submits information on a customer’s page or form, the customer is responsible for providing the required privacy information, identifying the appropriate lawful basis, collecting any required consent and respecting the rights of the individuals concerned.
10A. AI-assisted campaign creation
We offer an optional feature that prepares a campaign draft using a generative artificial intelligence system. It may analyse the user’s instructions and answers, campaign parameters, brand, offer, tone, selected countries and channels, supplied URLs, short extracts from the corresponding pages, and references and labels associated with uploaded visuals. It then produces suggested targeting, scheduling, and email or SMS content.
We process this information to provide the requested service, take steps before entering into and perform the contract and, where relevant, for our legitimate interests in improving the efficiency, security and quality of our tools. The necessary information is sent to the OpenAI API under the conditions described in section 10.
In our own systems, the prompt, brief, generated responses and related diagnostics are kept for thirty days and then deleted. Content that a user chooses to incorporate into a campaign is then kept with that campaign record for the retention periods applicable to it. Any international transfers are safeguarded as described in section 11.
We do not intentionally send the model any personal data from our audiences or campaign recipients. Users must not include in their instructions, URLs or visuals any third-party personal data, special category or sensitive data, audience data, login credentials or confidential information that is not strictly necessary and that they are not authorised to have us process.
AI does not decide which individual contacts receive a campaign, does not trigger payment or sending, and does not make a decision producing legal or similarly significant effects on an individual. Its outputs are suggestions that a user must review, amend where necessary and expressly approve before any distribution.
10B. Public FAQ assistant
The assistant available on public pages uses the OpenAI API to answer from our FAQ. The question, language and page context, recent history supplied by the browser, and a selection of relevant FAQ excerpts are sent to produce the requested response. Users must not enter personal, sensitive or confidential information in the assistant.
DMS Europe does not retain the content of this assistant’s questions and answers in its systems and does not use it to improve the system. History remains only in the browser’s session storage and disappears when that session ends. Remote application-state storage for responses is disabled with OpenAI. The processing terms and any OpenAI abuse-monitoring logs described in section 10 remain applicable. The thirty-day period stated for our own systems in section 10A applies only to campaign creation, not to this assistant.
10C. AI assistance for managing our services
We use artificial intelligence assistance tools to facilitate the processing and understanding of content needed to manage our services, including in a multilingual environment. This content may include personal data within the categories described in section 4.
This processing is based on our legitimate interests in efficient internal management and consistent service across languages, subject to the rights, freedoms and reasonable expectations of the individuals concerned.
Content needed for this assistance is sent to the OpenAI API under the conditions described in section 10. Any international transfers are covered by section 11.
Generated versions retained in our tools are accessible to authorised personnel and follow the retention rules in section 12. This assistance does not make automated decisions producing legal or similarly significant effects on an individual. The rights described in section 13 apply, including the right to object on grounds relating to the individual’s particular situation.
11. International transfers
Personal data may be processed in the United Kingdom, the European Economic Area and other countries where we or our service providers operate.
Where personal data is transferred outside the United Kingdom, the European Economic Area or the country of residence of the relevant individual, we ensure that an appropriate transfer mechanism is in place where required.
Such mechanisms may include adequacy regulations or adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard recognised by applicable data protection laws.
12. How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to provide our services, manage our business, comply with legal obligations, resolve disputes and demonstrate compliance.
Contact requests and prospect data may generally be kept for up to three years after the last meaningful interaction, unless a longer period is justified by an ongoing relationship, legal requirement or dispute.
Customer, contractual, billing and accounting records may be kept for the duration of the business relationship and for up to eleven years after the document is issued, so as to cover ten years after the end of the relevant financial year, or for any longer period required by applicable law.
Technical logs are generally kept for a limited period, usually between six and twelve months, unless longer retention is necessary for security, fraud prevention, investigation or legal purposes.
Hosting and database backups are managed on a rolling cycle that does not exceed thirty days.
Unsubscribe, objection and SMS STOP records may be kept for as long as necessary to ensure that the person is not contacted again in breach of their request.
Consent evidence and related compliance records may be kept for the duration of the relevant processing and for up to five years after the end of that processing, where necessary to demonstrate compliance, manage complaints or defend legal claims.
Customer exclusion lists follow the specific periods in section 7B: twelve months after the last content update; retention of versions needed for scheduled campaigns until thirty days after their completion or cancellation; release of draft references after thirty days of inactivity. The general periods for customer records or compliance evidence do not extend retention of these hashes.
Language versions retained for internal assistance follow the retention periods applicable to the content to which they relate. They are removed during cleanup operations following the deletion or expiry of that content, without extending its retention period. Temporary translation caches expire after thirty days.
13. Your rights
Depending on the applicable law and the circumstances, individuals may have the right to request access to their personal data, ask for inaccurate data to be corrected, request erasure, request restriction of processing, object to processing, request data portability or withdraw consent where processing is based on consent.
These rights are not absolute and may be subject to conditions, limitations or exemptions under applicable data protection laws. For example, we may need to retain certain information to comply with legal obligations, maintain suppression lists, demonstrate consent or defend legal claims.
To exercise a privacy right, individuals can use our data rights request form. We may need to verify the identity of the person making the request before responding.
14. Unsubscribes, tracking preferences and SMS STOP requests
Individuals who receive an email campaign routed by us can use the unsubscribe link included in the message, where available, or contact us to request removal from future marketing campaigns.
They can also use the “Disable tracking” link to object to the marketing use of future opens without unsubscribing. The strictly technical signal needed to measure deliverability may be retained; clicks continue to be measured. This preference is recorded so it can be respected over time.
Individuals who receive an SMS campaign can follow the STOP instructions provided in the message, where available. We process SMS STOP requests and apply suppression measures to prevent future marketing messages where required.
Suppression records are maintained to ensure that unsubscribe, objection and STOP requests are respected over time.
15. Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.
These measures may include access controls, confidentiality obligations, secure hosting, encryption or pseudonymisation where appropriate, monitoring, backups, provider due diligence and internal procedures designed to reduce privacy and security risks.
No system can be guaranteed to be completely secure. However, we work to maintain a level of security appropriate to the nature of the personal data processed and the risks involved.
16. Complaints
Individuals can use our data rights request page if they have any question or concern about how we process personal data.
Individuals also have the right to lodge a complaint with the UK Information Commissioner’s Office, or with their local data protection authority where applicable.
We encourage individuals to contact us first so that we can review and address the concern where possible.
17. Reference language
This Privacy Policy may be made available in several languages to facilitate understanding. In the event of any discrepancy, contradiction or interpretation difficulty, the English version prevails.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, our processing activities, legal requirements or operational practices.
The updated version will be published on this page. Where changes are material, we may take additional steps to inform affected individuals where required by applicable law.
19. Contact
For any question about this Privacy Policy, our processing of personal data, unsubscribe requests, SMS STOP requests, complaints or the exercise of privacy rights, individuals can use our data rights request form.
Contact us about privacy