Privacy Policy

CMC Technology Partners Limited uses personal information only to run its consultancy, keeps it secure, and never sells it.

  • CMC Technology Partners Limited ("CMC", "we", "us") is the controller of the personal information described in this policy.

    •      Company number: 17483204

    •      Registered office: 1st Floor, Victoria House, St John’s Road, Hedge End, Southampton, SO30 4AB

    •      ICO registration number: Pending

    •      Privacy contact: referrals@cmc.partners

  • This policy applies to people who visit our website, contact or meet us, work with us as clients, suppliers or partners, or are named in information we handle on client projects.

    When we work on a client's systems on their instructions, the client decides how that information is used and we act as its processor. The client's own privacy notice then applies. See "Client project data" below.

Information we collect

Category

Contact details

Enquiries and correspondence

Client and supplier records

Website information

Marketing preferences

Examples

Name, job title, employer, business email, phone number

Emails, messages, meeting notes, call details

Contract terms, purchase orders, invoices, payment details, site contacts

IP address, device and browser type, pages visited

Subscriptions, opt-outs, content you have engaged with

Where it comes from

You, event conversations, introductions, business cards

You, and our own records

You and your organisation

Our website

You

We do not knowingly collect special category data (such as health information) or information about children. We do not make automated decisions that have legal or similarly significant effects on individuals.

How we use it

Purpose

Responding to enquiries and arranging meetings

Providing services, quotations and contracts

Invoicing, accounts and tax

Maintaining business relationships with clients

Sending news, articles and invitations

Keeping our website and systems secure and working

Handling complaints, claims and legal requirements

Lawful basis (UK GDPR)

Legitimate interests: running our business and answering people who contact us

Contract, or steps taken at your request before entering one

Legal obligation and contract

Legitimate interests: promoting our services to relevant businesses

Consent where required, or legitimate interests for business contacts, with an easy opt-out

Legitimate interests

Legal obligation or legitimate interests

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time. Where we rely on consent, you can withdraw it at any time.

  • During assessments and projects, we may be given access to client networks and systems. We aim to avoid personal data, but some may be visible, such as camera footage, access control records, device names or user accounts. In these cases:

    •      We act as a processor, on the client's documented instructions, usually through the distributor or contractor that engaged us.

    •      We access only what the agreed scope requires, and we do not copy or keep client data unless instructed.

    •      We record the roles, scope and safeguards for each job before access begins.

    •      We tell the client without undue delay if we become aware of a personal data breach affecting their data.

    •      We return or securely delete the data when the work ends, normally within 30 days, unless the law requires us to keep it.

  • This policy applies to people who visit our website, contact or meet us, work with us as clients, suppliers or partners, or are named in information we handle on client projects.

    When we work on a client's systems on their instructions, the client decides how that information is used and we act as its processor. The client's own privacy notice then applies. See "Client project data" below.

  • We share personal information only where needed, and we never sell it. Recipients include:

    •      Service providers that host or support our systems, such as email, cloud storage, video conferencing, accounting and banking providers, under contracts that protect the information.

    •      Subcontractors and specialists engaged on a job, where the client has agreed and they are bound by equivalent confidentiality and security terms.

    •      Distributors, manufacturers and other partners, where you have asked us to introduce you or the job requires it.

    •      Professional advisers such as accountants, solicitors and insurers.

    •      Regulators, courts, the police and other authorities, where the law requires it.

    If our business were ever sold or restructured, information may pass to the new owner with the same protections.

  • Some of our providers may handle information outside the UK. Where they do, we make sure the transfer is protected, for example through a UK adequacy regulation or approved contractual safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum.

How long we keep it

We keep personal information only as long as needed for the purpose it was collected, then delete or anonymise it.

Information

Enquiries and business contacts

Client and supplier contracts, invoices and accounting records

Client project data held for a job

Reports and working papers

Marketing preferences

Website logs

Kept for

Up to [3 years] after our last contact, unless a working relationship continues

6 years after the end of the financial year or contract, in line with tax and company law

Until the work ends, normally returned or deleted within 30 days

[6 years] as professional records, with personal data removed wherever practicable

Until you unsubscribe, plus a minimal record that you did

[12 months]

  • We protect personal information with measures suited to the risk. These include access limited to people who need it, multi-factor authentication where available, encryption in transit and on portable devices where practicable, supported and updated devices, and secure transfer and storage of working files. Client material is kept separate from our own records. Anyone who handles personal information for us is bound by confidentiality, and we review our measures regularly.

  • Our website, cmc.partners, [uses only essential cookies / uses cookies for analytics and similar technologies]. Where we use non-essential cookies, we ask for your consent first, and you can change your choice at any time. Our website may link to other sites, which have their own privacy policies.

  • Under UK data protection law you can ask us to:

    •      give you a copy of the personal information we hold about you

    •      correct information that is wrong or incomplete

    •      delete your information in certain circumstances

    •      restrict how we use it

    •      move it to another organisation in a usable format

    •      stop using it where we rely on legitimate interests, or stop sending you marketing

    •      stop relying on your consent, where that is our basis

    To use any of these rights, contact [privacy email address]. We will respond within one month and may need to confirm your identity first. There is normally no charge.

  • If you have a question or complaint about how we handle your information, contact [privacy email address] first. We will acknowledge it within 30 days and respond without undue delay.

    You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

  • We may update this policy from time to time. The current version is always on our website, with the date it was last updated. This version was last updated on 2 October 2026.