Privacy Policy

CMS Group Ltd ("CMS Group", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal data when you visit cms-group.net and related pages (the "Website"), use our online tools, or otherwise interact with us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

CMS Group Ltd is the data controller responsible for your personal data.

• Company: CMS Group Ltd (registered in England and Wales, company number 02513535)
• Address: Suite 6 & 12, Manor Court, Salesbury Hall Road, Ribchester, Lancashire, PR3 3XR, United Kingdom
• Email: hello@cms-group.net
• Telephone: +44 20 3404 4700

For any questions about this policy or how we handle your data, contact us using the details above.

2. Personal data we collect

The personal data we collect depends on how you interact with us. We may collect:

Information you provide directly

• Contact and enquiry details — name, email address, telephone number, company name, job title, and the content of your message when you use our contact form, qualification flow, quote request forms, ROI calculator, or similar enquiry tools.
• Newsletter and marketing sign-ups — email address and, where provided, your name.
• Referrals — details you provide about yourself and the person or organisation you refer, including names, email addresses, and company information.
• Community and roundtable sign-ups — email address and, where provided, name, company, and industry vertical.
• Digital maturity audit — assessment responses, scores, and contact details if you choose to provide them.
• Domain security scans — the domain you enter, scan results, and your email address if you request a report.

Information collected automatically

• Technical and usage data — IP address, browser type, device information, pages visited, referring URLs, and interaction data. This is collected via cookies and similar technologies when you consent to analytics and marketing cookies.
• Cookie preferences — your choices regarding analytics and marketing cookies, stored in your browser.

Some of our tools temporarily store context in your browser session (for example, calculator or assessment inputs) to improve your experience. This data is only sent to us when you complete a form or explicitly submit information.

3. How we use your personal data

We use personal data for the following purposes:

• Responding to your enquiries and providing requested information
• Delivering quotes, assessments, scan reports, and related services
• Sending service-related communications where you have asked us to contact you
• Sending marketing communications only where you have given explicit consent (for example, by ticking the marketing opt-in on our forms or subscribing to our newsletter)
• Operating, maintaining, and improving our Website and online tools
• Understanding how visitors use our Website (with your consent for analytics cookies)
• Measuring the effectiveness of our marketing (with your consent)
• Protecting our Website, systems, and users from fraud or abuse
• Complying with legal and regulatory obligations

We do not sell your personal data.

4. Legal bases for processing

Under UK GDPR, we rely on the following legal bases:

• Consent — for analytics and marketing cookies, newsletter subscriptions, and marketing communications where you have ticked an opt-in checkbox or otherwise given clear consent.
• Legitimate interests — to respond to your enquiries and quote requests, operate and improve our Website, maintain security, and manage our business, where those interests are not overridden by your rights. We do not rely on legitimate interests for direct marketing.
• Pre-contractual steps and contract — where processing is necessary to provide a quote, assessment, or service you have requested.
• Legal obligation — where we must process data to comply with applicable law.

5. Cookies and similar technologies

We use cookies and similar technologies on our Website. Essential cookies are required for the site to function. Analytics and marketing cookies are only activated if you click "Accept" on our cookie consent banner.

With your consent, we may use:

• Google Analytics 4 — to understand how visitors use our Website (IP addresses are anonymised)
• Google Ads — to measure advertising effectiveness
• Meta Pixel — to measure marketing campaign performance
• LinkedIn Insight Tag — to measure professional audience engagement

You can change your cookie preferences at any time by clearing your browser cookies and revisiting the Website, or by using your browser settings. For full details, see our Cookie Policy.

6. Who we share your data with

We share personal data only where necessary and with appropriate safeguards. Our service providers (data processors) include:

• Supabase — secure database hosting for form submissions and lead data
• Vercel — Website hosting and content delivery
• Microsoft (Azure / Microsoft Graph) — internal email notifications when you submit an enquiry
• CRM platform — customer relationship management for certain lead types (for example, contact forms, newsletter sign-ups, and maturity audits)
• Google, Meta, and LinkedIn — analytics and advertising platforms, only where you have consented to the relevant cookies

We require our processors to protect your data and use it only for the purposes we specify. We may also disclose data where required by law, court order, or to protect our legal rights.

7. International transfers

Some of our service providers are located outside the United Kingdom, including in the United States. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, UK Addendum to EU Standard Contractual Clauses, or an adequacy decision, as applicable.

8. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, including:

• Enquiry and lead data — retained while we have an active relationship or legitimate business interest, and thereafter in accordance with our data retention schedule
• Domain scan data — retained for a limited period to generate your report and improve our service
• Newsletter subscriptions — retained until you unsubscribe or ask us to delete your data
• Analytics data — retained according to the retention settings of the relevant analytics provider
• Cookie consent preferences — stored for up to 12 months

We may retain anonymised or aggregated data that cannot identify you for longer periods for statistical and improvement purposes.

9. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit, access controls, and secure hosting infrastructure. CMS Group is certified to ISO 27001 and Cyber Essentials Plus.

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data in certain circumstances
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format where applicable
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at hello@cms-group.net. We will respond within one month, as required by law.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

11. Children

Our Website and services are directed at business professionals and are not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

12. Third-party websites

Our Website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal data.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.

14. Contact us

If you have questions about this Privacy Policy or how we handle your personal data, please contact us:

• Email: hello@cms-group.net
• Post: CMS Group Ltd, Suite 6 & 12, Manor Court, Salesbury Hall Road, Ribchester, Lancashire, PR3 3XR, United Kingdom
• Telephone: +44 20 3404 4700