How we handle personal data when you visit our website or engage our services
DM Digital is a web and app development business based in Dublin, Ireland, operated by Lee Dempsey and James McGuirk. For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and the Data Protection Acts 1988 to 2018, DM Digital is the data controller in respect of the personal data described in this Policy.
If you have any questions about this Policy or how we handle your personal data, please contact us at info@dmdigital.ie — see also Section 13 below.
This Policy applies to personal data we process about:
The categories of personal data we collect depend on how you interact with us:
We do not collect or process special-category data (such as health, racial or ethnic origin, political opinions, religious beliefs or biometric data) in the ordinary course of our business. If a project requires us to process such data on a client’s behalf, that processing is governed by our DPA, not this Policy.
We process personal data only where we have a lawful basis under Article 6 GDPR. The most relevant bases for us are summarised in the table below.
| Purpose | Data used | Legal basis (Article 6 GDPR) |
|---|---|---|
| Responding to enquiries and discussing potential work | Contact details, enquiry content | 6(1)(b) — steps taken at your request before entering a contract; or 6(1)(f) — our legitimate interest in growing our business |
| Delivering services under a signed Statement of Work | Engagement records, client-team contact details | 6(1)(b) — performance of a contract |
| Issuing invoices and collecting payments | Contact details, payment status (Stripe handles card data) | 6(1)(b) — performance of contract; 6(1)(c) — legal obligations (accounting, tax) |
| Operating and securing dmdigital.ie | Server logs, usage data | 6(1)(f) — legitimate interest in maintaining a secure and functional website |
| Analytics (where you consent) | Cookies, page views | 6(1)(a) — your consent (see Section 9) |
| Compliance with legal and regulatory obligations | Engagement records, tax-relevant data, breach records | 6(1)(c) — legal obligation |
| Establishing, exercising or defending legal claims | Whatever is necessary for the claim | 6(1)(f) — legitimate interest in protecting our legal position |
We share personal data only with a small number of trusted third parties, and only to the extent necessary. The current categories are:
We do not sell personal data, and we do not use it for third-party advertising.
A current list of the sub-processors we use when acting as a processor on behalf of clients is maintained at Schedule 2 of the DPA.
Some of our service providers (notably Replit, Resend and Google) are based in the United States. Where we transfer personal data outside the European Economic Area (“EEA”), we rely on an appropriate transfer mechanism — typically the European Commission’s Standard Contractual Clauses — together with supplementary measures (such as encryption in transit and at rest) where required.
You can request a copy of the safeguards in place for any specific transfer by contacting us at info@dmdigital.ie.
We retain personal data for as long as we need it for the purpose for which it was collected, plus any further period required by law. Indicative retention periods:
| Enquiry records (prospects who did not become clients) | 24 months from last contact, then deleted |
| Client engagement records | For the duration of the engagement plus 7 years (to satisfy Irish accounting and tax record-keeping requirements) |
| Invoices and accounting records | 7 years (Section 886 Taxes Consolidation Act 1997) |
| Website server logs | 90 days (longer where needed to investigate a security incident) |
| Analytics data (where consent given) | 14 months in Google Analytics 4 (default) |
| Marketing communications consents and preferences | Until you withdraw consent or for 3 years from last interaction |
If you ask us to delete your data and we are required by law to retain certain records, we will inform you which records we are required to keep and for how long.
Under the GDPR you have the following rights in respect of personal data we hold about you:
To exercise any of these rights, please email info@dmdigital.ie. We will respond within one month of receiving a verifiable request, and we will not charge a fee unless the request is manifestly unfounded or excessive.
We use a small number of cookies on dmdigital.ie:
| Cookie / category | Purpose | Basis |
|---|---|---|
| Strictly necessary | Session management, security, cookie-consent preference itself | Set by default — no consent required (ePrivacy Regulations, Reg 5(5)) |
| Analytics (Google Analytics 4) | Counts visits, measures site performance, helps us improve content | Set only after you click “Accept” on the cookie banner. You can withdraw consent at any time via the cookie settings link in the footer. |
We do not use advertising or tracking cookies. We do not share device identifiers with ad networks.
You can also control cookies through your browser settings — most browsers let you block or delete cookies, though some site features may not work properly if you do.
We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These measures include encryption in transit (TLS 1.2 or higher), access control on systems holding personal data, multi-factor authentication for administrative access, regular patching of operating systems and software, monitoring and logging, and confidentiality undertakings from our personnel and sub-processors.
No system is perfectly secure. If we become aware of a personal data breach affecting your data, we will notify the Data Protection Commission and (where required by Article 34 GDPR) affected individuals without undue delay.
Our services are aimed at businesses and we do not knowingly collect personal data from children under the age of 16. If you believe a child has provided personal data to us, please contact us and we will delete it.
We may update this Policy from time to time. The current version is always available at dmdigital.ie/privacy with the version number and “last updated” date shown at the top. Where a change is material, we will give individuals whose personal data is materially affected reasonable notice (by email or a prominent notice on the website) before the change takes effect.
For any privacy question, request to exercise your rights, or concern about how we handle your personal data:
DM Digital, Dublin, Ireland
Email: info@dmdigital.ie
Web: www.dmdigital.ie
We try to resolve all complaints directly. If you are not satisfied with how we have handled your complaint, you have the right to lodge a complaint with the Irish Data Protection Commission:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Web: www.dataprotection.ie
Phone: +353 (0)761 104 800