Privacy Policy
How we handle personal data when you visit our website or engage our services
1. Who we are
DM Digital Studios Limited (trading as DM Digital) is a private limited company registered in Ireland and based in Dublin. Its directors are Lee Dempsey and James McGuirk. For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and the Data Protection Acts 1988 to 2018, DM Digital Studios Limited is the data controller in respect of the personal data described in this Policy.
If you have any questions about this Policy or how we handle your personal data, please contact us at info@dmdigital.ie — see also Section 13 below.
2. Scope of this Policy
This Policy applies to personal data we process about:
- Visitors to dmdigital.ie and any subdomain we operate.
- Prospects who contact us through enquiry forms, email, WhatsApp or other channels to discuss potential work.
- Clients (and their staff) for whom we provide services under a signed Statement of Work. Everyday requests are handled by email (info@dmdigital.ie); urgent issues via our WhatsApp Business number. We keep copies of client WhatsApp conversations in our Google Workspace (Google Drive) for record-keeping.
- Other individuals who correspond with us in connection with our business (for example, suppliers and prospective collaborators).
3. What personal data we collect
The categories of personal data we collect depend on how you interact with us:
3.1 Information you give us
- Contact details: name, email address, phone or WhatsApp number, company name, role.
- Call-back form: your name, business name, phone number, email address, business type, current website (optional) and a description of what you need.
- Enquiry content: the contents of any message, brief, document or attachment you send us.
- Engagement records: contracts, statements of work, change requests, invoices, correspondence and meeting notes.
- Payment details: we use Stripe to process payments. Stripe collects payment-card and bank-account details directly — we do not store full card numbers or bank-account numbers ourselves.
3.2 Information we collect automatically
- Usage data: pages viewed on dmdigital.ie, referral source, approximate location (country/region from IP), device and browser type, language, time and duration of visit.
- Cookies and similar technologies: see Section 9 below.
- Request logs: basic request logs (IP address, timestamp, page requested, browser type) kept by Google Firebase Hosting, which serves our website, for security, abuse prevention and diagnostic purposes.
3.3 Information from third parties
- Public sources: for example, the Irish Companies Registration Office, your own website or LinkedIn profile, used to verify business details before entering into an engagement.
- Referrals: if someone refers you to us, we may receive your name and contact details from them.
We do not collect or process special-category data (such as health, racial or ethnic origin, political opinions, religious beliefs or biometric data) in the ordinary course of our business. If a project requires us to process such data on a client’s behalf, that processing is governed by our DPA, not this Policy.
4. Why we collect it & legal basis
We process personal data only where we have a lawful basis under Article 6 GDPR. The most relevant bases for us are summarised in the table below.
| Purpose | Data used | Legal basis (Article 6 GDPR) |
|---|---|---|
| Responding to enquiries and discussing potential work | Contact details, enquiry content | 6(1)(b) — steps taken at your request before entering a contract; or 6(1)(f) — our legitimate interest in growing our business |
| Delivering services under a signed Statement of Work | Engagement records, client-team contact details | 6(1)(b) — performance of a contract |
| Issuing invoices and collecting payments | Contact details, payment status (Stripe handles card data) | 6(1)(b) — performance of contract; 6(1)(c) — legal obligations (accounting, tax) |
| Operating and securing dmdigital.ie | Request logs, usage data | 6(1)(f) — legitimate interest in maintaining a secure and functional website |
| Analytics (where you consent) | Cookies, page views | 6(1)(a) — your consent (see Section 9) |
| Compliance with legal and regulatory obligations | Engagement records, tax-relevant data, breach records | 6(1)(c) — legal obligation |
| Establishing, exercising or defending legal claims | Whatever is necessary for the claim | 6(1)(f) — legitimate interest in protecting our legal position |
5. Who we share data with
We share personal data only with a small number of trusted third parties, and only to the extent necessary. The current categories are:
- Website hosting & enquiry email — Google Cloud / Firebase Hosting and Google Workspace (Google Ireland Limited / Google LLC). dmdigital.ie is a static site served by Firebase Hosting. Enquiries sent through our call-back form are delivered by a Google Apps Script service as an email to our Google Workspace mailbox; we do not store them in any other database.
- Client project infrastructure — Google Cloud (Belgium, europe-west1), GitHub, Inc. (private code repositories) and Neon (Databricks, Inc.; databases, London region), used only where a client engagement requires them.
- Analytics — Google Ireland Limited / Google LLC (Google Analytics 4). Only where you have consented via the cookie banner (see Section 9).
- Payments — Stripe Payments Europe Limited (Ireland) and the Stripe group. Stripe acts as an independent controller of payment-card and SEPA mandate data under its own terms.
- Messaging — WhatsApp Ireland Limited (part of Meta; Ireland) where you communicate with us via WhatsApp Business (our shared company number, used for urgent support).
- Accountants, tax advisers and professional advisers — where engaged for our compliance, audit or legal needs.
- Authorities — where we are required to disclose by law (for example, Revenue Commissioners, courts, regulators).
We do not sell personal data, and we do not use it for third-party advertising.
A current list of the sub-processors we use when acting as a processor on behalf of clients is maintained at Schedule 2 of the DPA.
6. International transfers
Some of our service providers, or their parent companies, are based in the United States (Google LLC, GitHub, Inc., Meta Platforms, Inc., Stripe, Inc. and Databricks, Inc., which owns Neon). Where personal data is transferred outside the European Economic Area (“EEA”), we rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses, together with supplementary measures such as encryption in transit and at rest. Neon databases we operate are hosted in London; the United Kingdom benefits from an EU adequacy decision.
You can request a copy of the safeguards in place for any specific transfer by contacting us at info@dmdigital.ie.
7. How long we keep data
We retain personal data for as long as we need it for the purpose for which it was collected, plus any further period required by law. Indicative retention periods:
| Enquiry records (prospects who did not become clients) | 24 months from last contact, then deleted |
| Client engagement records | For the duration of the engagement plus 7 years (to satisfy Irish accounting and tax record-keeping requirements) |
| Invoices and accounting records | 7 years (Section 886 Taxes Consolidation Act 1997) |
| WhatsApp conversation records (clients) | For the duration of the engagement plus 7 years |
| Website request logs | Up to 30 days (longer only where needed to investigate a security incident) |
| Analytics data (where consent given) | 2 months in Google Analytics 4 |
If you ask us to delete your data and we are required by law to retain certain records, we will inform you which records we are required to keep and for how long.
8. Your rights
Under the GDPR you have the following rights in respect of personal data we hold about you:
- Access — ask for a copy of the personal data we hold about you (Article 15).
- Rectification — ask us to correct inaccurate or incomplete data (Article 16).
- Erasure — ask us to delete data, subject to limited legal exceptions (Article 17).
- Restriction — ask us to suspend processing while a question is resolved (Article 18).
- Portability — receive certain data in a structured, machine-readable format (Article 20).
- Objection — object to processing based on our legitimate interests, including for any direct marketing (Article 21).
- Withdraw consent — where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
- Complain — lodge a complaint with the Data Protection Commission (see Section 13).
To exercise any of these rights, please email info@dmdigital.ie. We will respond within one month of receiving a verifiable request, and we will not charge a fee unless the request is manifestly unfounded or excessive.
9. Cookies & analytics
We use one item of browser storage and, only if you click “Accept”, two Google Analytics cookies:
| Name | Type & purpose | Duration | Basis |
|---|---|---|---|
| dm_cookie_consent | Browser localStorage (first party, not a cookie). Remembers whether you chose Accept or Reject. | Until you clear it or change your choice | Strictly necessary — no consent required (Reg. 5(5), S.I. 336/2011) |
| _ga | Google Analytics 4 first-party cookie. Distinguishes visitors. | 2 years | Your consent |
| _ga_PB6SYYVJZH | Google Analytics 4 first-party cookie. Keeps session state. | 2 years | Your consent |
Changing your mind: click ‘Cookie Settings’ in the footer of any page and choose ‘Reject’. Analytics stops immediately and we delete the Google Analytics cookies from your browser.
Google Analytics data is processed by Google Ireland Limited / Google LLC and kept for 2 months. Google Signals and advertising features are switched off. We do not use advertising or cross-site cookies, our fonts are self-hosted, and the site works fully without cookies.
10. Security
We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These measures include encryption in transit (TLS 1.2 or higher), access control on systems holding personal data, multi-factor authentication for administrative access, keeping software and dependencies up to date, monitoring and logging, and confidentiality undertakings from our personnel and sub-processors.
No system is perfectly secure. If we become aware of a personal data breach affecting your data, we will notify the Data Protection Commission and (where required by Article 34 GDPR) affected individuals without undue delay.
11. Children
Our services are aimed at businesses and we do not knowingly collect personal data from children under the age of 16. If you believe a child has provided personal data to us, please contact us and we will delete it.
12. Changes to this Policy
We may update this Policy from time to time. The current version is always available at dmdigital.ie/privacy with the version number and “last updated” date shown at the top. Where a change is material, we will give individuals whose personal data is materially affected reasonable notice (by email or a prominent notice on the website) before the change takes effect.
13. Contact & complaints
For any privacy question, request to exercise your rights, or concern about how we handle your personal data:
DM Digital Studios Limited (trading as DM Digital), Dublin, Ireland
Email: info@dmdigital.ie
Web: www.dmdigital.ie
We try to resolve all complaints directly. If you are not satisfied with how we have handled your complaint, you have the right to lodge a complaint with the Irish Data Protection Commission:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Web: www.dataprotection.ie
Phone: +353 (0)761 104 800