Privacy Policy
This Privacy Policy explains how we collect, use, store and protect personal data in connection with our website, our commercial relationships and our email and SMS marketing campaign services.
Effective as of 17 October 2026.
1. Who we are
For the purposes of applicable data protection laws, including the UK GDPR, the EU GDPR where applicable, and the Data Protection Act 2018, the controller of the personal data described in this Privacy Policy is DMS Europe Ltd.
In accordance with Article 27 of the EU GDPR, DMS Europe Ltd has appointed JC Management SAS as its representative in the European Union. Data subjects and EU supervisory authorities may contact this representative on any issue related to processing covered by the EU GDPR.
2. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed in connection with our website, our contact and quotation forms, our commercial exchanges, our customer relationships, our newsletters, our campaign services and our opt-in audiences.
It also explains how we process personal data when we send email or SMS marketing campaigns to our own opt-in audiences on behalf of business customers, without transferring contact files to those customers.
Separate cookie information may be provided in our Cookie Policy, where applicable.
3. Who this policy applies to
This Privacy Policy applies to website visitors, people who contact us, newsletter subscribers, prospects, customers, representatives of customers or agencies, users of our services and people included in our opt-in audiences.
It may also apply to recipients of marketing campaigns routed by us on our own audiences, including individuals who receive an email or SMS campaign, click on a link, unsubscribe, send a STOP SMS request or submit a complaint.
4. Personal data we collect
The personal data we collect depends on the relationship we have with the individual and the context in which the data is processed.
For website visitors, prospects and people who contact us, we may process identification and contact details, such as first name, last name, business email address, phone number, company name, job title, country, language, message content, requested service, campaign requirements and any information voluntarily submitted through our forms.
For customers, agencies and business contacts, we may process business identity data, billing details, order details, campaign parameters, selected countries, target volumes, selected products, targeting criteria, budget information, website URLs, landing page URLs, creative assets, commercial content, communication history, support requests, contractual documents, invoices, payment status, account information and service usage information.
For people included in our opt-in audiences, we may process, depending on the data available and the relevant consent, contact details, demographic information, country, geographical area, age range, gender, socio-professional category, housing-related information, interests, commercial preferences, property-related interests, automotive interests, interaction history, campaign exposure history, email engagement data, SMS delivery status, unsubscribe status, email open tracking preference, SMS STOP status, complaint information, consent records, source of registration, timestamp, IP address, form or registration context and proof of consent.
We may also process technical data such as IP address, browser type, device information, operating system, language, pages viewed, logs, timestamps, security events and cookie-related identifiers where applicable.
We do not intentionally use special categories of data, criminal offence data, or criteria that allow such data to be inferred to build or target our audiences. Marketing audiences are restricted to adults; minors are excluded from our targeting criteria and campaigns.
5. How we collect personal data
We may collect personal data directly from individuals when they fill in a form, contact us, request an estimate, subscribe to a newsletter, interact with our website, communicate with us or use our services.
We may also collect personal data through our own opt-in audience acquisition processes, registration forms, preference forms, consent mechanisms, campaign interactions, unsubscribe links, SMS STOP messages, complaints and technical systems.
In the context of customer campaigns, customers may provide us with campaign content, commercial information, landing page links, targeting instructions and other materials necessary for campaign preparation and routing. However, our standard service does not require customers to provide us with their own contact databases.
6. Why we use personal data and lawful bases
The matrix below states the main purpose and the lawful basis normally used. The basis that applies in practice depends on the context, the recipient’s country and electronic communications law.
7. Marketing campaigns sent to our opt-in audiences
For campaigns sent to our own opt-in audiences, we act as controller for the audience data and for the routing of the campaign. We do not sell, rent or deliver contact files to our customers.
Customers select targeting criteria, campaign parameters, channels and volumes, but the technical routing is carried out by us or by technical providers acting under our instructions.
We may use personal data in our audiences to select relevant recipients, send the campaign, record delivery and interaction events, manage unsubscribes, process SMS STOP requests, suppress contacts from future campaigns and respond to complaints or regulatory requests.
Our emails may contain an invisible pixel and individualized links. They allow us to measure deliverability, opens and clicks, assess campaign performance and, where planned and permitted, adapt or trigger subsequent communications, including an SMS retargeting message after an open. For new collections and new permissions, we obtain prior consent to individual tracking where required by the applicable law, including in the United Kingdom, France, Italy and Spain. Measurements strictly necessary for transmission, security or limited technical deliverability are used without consent only where every condition of the local exemption is met.
Permissions already obtained are not automatically invalidated. Where national law provides a documented transitional arrangement, we may continue tracking historical addresses on its conditions. In France, for addresses collected before 14 April 2026, this notably requires compliant notice offering a right to object to have been sent within the permitted period and the conditions of marketing to remain unchanged. This French transitional rule is not extended to other countries; without a valid basis in the country concerned, individual tracking is disabled or consent is requested.
The “Disable tracking” link in each email allows consent to be withdrawn or an objection to open tracking to be made. We then stop all marketing use of the pixel and delete or disassociate previous opens from the profile according to the applicable basis. A separate signal may remain only for an exempt technical purpose, in a minimised form that is not used for profiling or retargeting. This choice does not unsubscribe the individual; a separate link allows them to unsubscribe.
Segmentation and profiling combine declared or available criteria — for example country, area, age range, socio-professional category, interests, exposure history and permitted interactions — to assign an individual to segments and select campaigns likely to be relevant. No special category data is used, minors are excluded, and no solely automated decision produces legal or similarly significant effects on an individual.
We may keep evidence of consent and related compliance records for the duration of the processing concerned and for up to five years after the end of the relevant processing, where this is necessary to demonstrate compliance, manage complaints, defend legal claims or respond to competent authorities.
7A. Business-to-business prospecting
We may process business contact details to send content and offers relevant to a person’s role or organisation. This processing is based on our legitimate interest in developing our business and communicating with relevant professional contacts, balanced against their rights and reasonable expectations.
Data may include a business email address, first and last name, job title, company, business phone number, website, country, language, source and the history of sends, unsubscribes, deliverability, opens and clicks. It may come from public professional sources, our network and B2B data providers. We notably check the validity of an address before sending.
Our emails may contain a pixel and individualised links to measure deliverability, opens and clicks, subject to the territorial rules and conditions described in section 7. Data used for strictly technical or statistical measurement does not trigger individual marketing action; any use for profiling or retargeting follows the applicable lawful basis. Known automated opens, preloads and scanners are filtered. A link in every email allows recipients to opt out of this tracking without unsubscribing, and a separate link allows them to unsubscribe from all newsletters.
Where data was not obtained directly from the individual, we provide this information no later than our first email. Prospecting data is retained for three years from collection or the person’s last active contact, unless they object sooner. Minimal suppression evidence may then be retained to honour that objection. Individuals may exercise their rights of access, rectification, erasure, restriction and objection by emailing privacy@dmseurope.com.
8. Customers’ landing pages and lead collection
Campaigns routed by us may direct recipients to a landing page, website, form or digital environment operated by the customer or by a third party selected by the customer.
The customer is responsible for the content of the campaign, the promoted offer, the landing page, any form displayed after a click, and any personal data collected from individuals after they leave our campaign environment.
When a recipient clicks on a campaign and submits information on a customer’s page or form, the customer is responsible for providing the required privacy information, identifying the appropriate lawful basis, collecting any required consent and respecting the rights of the individuals concerned.
10A. AI-assisted campaign creation
We offer an optional feature that prepares a campaign draft using a generative artificial intelligence system. It may analyse the user’s instructions and answers, campaign parameters, brand, offer, tone, selected countries and channels, supplied URLs, short extracts from the corresponding pages, and references and labels associated with uploaded visuals. It then produces suggested targeting, scheduling, and email or SMS content.
We process this information to provide the requested service, take
steps before entering into and perform the contract and, where
relevant, for our legitimate interests in improving the efficiency,
security and quality of our tools. We currently use the OpenAI API,
with OpenAI acting as a processing provider. Data sent through the
API is not used by default to train OpenAI models. All our Responses
API integrations currently send store=false, including
the campaign creation assistant; this setting does not delete our
own drafts or the history needed for the platform to operate.
OpenAI may retain
abuse-monitoring logs for up to thirty days, unless a legal obligation
or a shorter applicable retention control applies. More information is
available in
OpenAI’s API data usage documentation.
In our own systems, the prompt, brief, generated responses and related diagnostics are kept for thirty days and then deleted. Content that a user chooses to incorporate into a campaign is then kept with that campaign record for the retention periods applicable to it. Any international transfers are safeguarded as described in section 11.
We do not intentionally send the model any personal data from our audiences or campaign recipients. Users must not include in their instructions, URLs or visuals any third-party personal data, special category or sensitive data, audience data, login credentials or confidential information that is not strictly necessary and that they are not authorised to have us process.
AI does not decide which individual contacts receive a campaign, does not trigger payment or sending, and does not make a decision producing legal or similarly significant effects on an individual. Its outputs are suggestions that a user must review, amend where necessary and expressly approve before any distribution.
10B. Public FAQ assistant
The assistant available on public pages uses the OpenAI API to answer from our FAQ. The question, language and page context, recent history supplied by the browser, and a selection of relevant FAQ excerpts are sent to produce the requested response. Users must not enter personal, sensitive or confidential information in the assistant.
DMS Europe does not retain the content of this assistant’s questions and answers in its systems and does not use it to improve the system. History remains only in the browser’s session storage and disappears when that session ends. Remote application-state storage for responses is disabled with OpenAI. The processing terms and any OpenAI abuse-monitoring logs described in section 10A remain applicable. The thirty-day period stated for our own systems in section 10A applies only to campaign creation, not to this assistant.
11. International transfers
Personal data may be processed in the United Kingdom, the European Economic Area and other countries where we or our service providers operate.
Where personal data is transferred outside the United Kingdom, the European Economic Area or the country of residence of the relevant individual, we ensure that an appropriate transfer mechanism is in place where required.
Such mechanisms may include adequacy regulations or adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard recognised by applicable data protection laws.
12. How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to provide our services, manage our business, comply with legal obligations, resolve disputes and demonstrate compliance.
Contact requests and prospect data may generally be kept for up to three years after the last meaningful interaction, unless a longer period is justified by an ongoing relationship, legal requirement or dispute.
Customer, contractual, billing and accounting records may be kept for the duration of the business relationship and for up to eleven years after the document is issued, so as to cover ten years after the end of the relevant financial year, or for any longer period required by applicable law.
Technical logs are generally kept for a limited period, usually between six and twelve months, unless longer retention is necessary for security, fraud prevention, investigation or legal purposes.
Hosting and database backups are managed on a rolling cycle that does not exceed thirty days.
Unsubscribe, objection and SMS STOP records may be kept for as long as necessary to ensure that the person is not contacted again in breach of their request.
Consent evidence and related compliance records may be kept for the duration of the relevant processing and for up to five years after the end of that processing, where necessary to demonstrate compliance, manage complaints or defend legal claims.
13. Your rights
Depending on the applicable law and the circumstances, individuals may have the right to request access to their personal data, ask for inaccurate data to be corrected, request erasure, request restriction of processing, object to processing, request data portability or withdraw consent where processing is based on consent.
These rights are not absolute and may be subject to conditions, limitations or exemptions under applicable data protection laws. For example, we may need to retain certain information to comply with legal obligations, maintain suppression lists, demonstrate consent or defend legal claims.
To exercise a privacy right, individuals can contact us at privacy@dmseurope.com. We may need to verify the identity of the person making the request before responding.
14. Unsubscribes, tracking preferences and SMS STOP requests
Individuals who receive an email campaign routed by us can use the unsubscribe link included in the message, where available, or contact us to request removal from future marketing campaigns.
They can also use the “Disable tracking” link to object to the marketing use of future opens without unsubscribing. The strictly technical signal needed to measure deliverability may be retained; clicks continue to be measured. This preference is recorded so it can be respected over time.
Individuals who receive an SMS campaign can follow the STOP instructions provided in the message, where available. We process SMS STOP requests and apply suppression measures to prevent future marketing messages where required.
Suppression records are maintained to ensure that unsubscribe, objection and STOP requests are respected over time.
15. Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.
These measures may include access controls, confidentiality obligations, secure hosting, encryption or pseudonymisation where appropriate, monitoring, backups, provider due diligence and internal procedures designed to reduce privacy and security risks.
No system can be guaranteed to be completely secure. However, we work to maintain a level of security appropriate to the nature of the personal data processed and the risks involved.
16. Complaints
Individuals can contact us at privacy@dmseurope.com if they have any question or concern about how we process personal data.
Individuals also have the right to lodge a complaint with the UK Information Commissioner’s Office, or with their local data protection authority where applicable.
We encourage individuals to contact us first so that we can review and address the concern where possible.
17. Reference language
This Privacy Policy may be made available in several languages to facilitate understanding. In the event of any discrepancy, contradiction or interpretation difficulty, the English version prevails.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, our processing activities, legal requirements or operational practices.
The updated version will be published on this page. Where changes are material, we may take additional steps to inform affected individuals where required by applicable law.
19. Contact
For any question about this Privacy Policy, our processing of personal data, unsubscribe requests, SMS STOP requests, complaints or the exercise of privacy rights, individuals can contact us by email.
Contact us about privacy