Contact us

Privacy Policy

Last updated: July 2026

This policy explains how PMW Communications Ltd (“PMW”, “we”, “us”, “our”) collects, uses, shares and protects personal data belonging to our clients, prospective clients, suppliers and other business contacts, and to visitors to our website. Company number 03449850. Registered office: 1-7 Station Road, Crawley, RH10 1HT. 

This policy does not cover our employees, workers or job applicants – they have a separate Employee Privacy Notice, which is an internal document. 

We are the data controller for the personal data described in this policy. If you have any questions, contact our Data Protection Lead at [email protected], or call on 01403 783400. 

What data we collect 

We collect and use the following information: 

  • Contact and business details – name, job title, employer, email address, phone number and postal address. 
  • Information you give us when you enquire about our services, sign a schedule with us, or otherwise become a client, supplier or business contact. 
  • Campaign and project information you share with us as part of a brief, including any of your own customers’ personal data you ask us to use in a campaign (see “If you share other people’s data with us” below). 
  • Billing, payment details and contractual information, so we can provide our services, invoice you and manage our accounts. 
  • Details of competition or promotion entrants, where we administer competitions or promotions on behalf of a client. 
  • Business contact details compiled from publicly available sources, for legitimate B2B marketing activities. 
  • Marketing preferences and records of your consent to receive communications from us, where applicable. 
  • Website usage information, cookies and technical information, such as IP addresses, browser type and device information 
  • Information collected through events, webinars, surveys or feedback forms, where applicable 

How we use your data, and our legal basis 

We only use personal data where the law allows us to. Depending on the situation, we rely on: 

  • Performance of a contract – to deliver agreed services, manage your account, and invoice you. 
  • Legal obligation –to comply with our legal and regulatory duties, for example, tax and accounting records, or compliance with advertising standards. 
  • Legitimate interests – running and promoting our business, managing our relationship with you, maintaining B2B contact databases, improve our services, keeping our systems secure, and preventing fraud. Where we rely on this basis, we’ve considered that our interests don’t unfairly override your rights, are correct and proportionate. You can object at any time (see “Your rights”). 
  • Recognised legitimate interests – a small, defined set of purposes (such as safeguarding or crime prevention) introduced into the UK GDPR from February 2026. We would only rely on this in limited circumstances. 
  • Consent – where we specifically ask for your permission to use your data, for a specific purpose. For example, for certain marketing communications. You can withdraw consent at any time. 

If you share other people’s data with us 

If you provide us with personal data belonging to your own customers, employees or other contacts – for example, a mailing list for a campaign – you remain responsible for making sure you have a lawful basis to share it with us. We act in good faith that you have obtained any necessary permissions or the appropriate lawful basis for processing. We will only process data on your documented instructions and for the purposes set out in your agreed schedule and in line with our Terms & Conditions. 

Cookies and website tracking 

Our website uses cookies and similar technologies. These fall into a few categories: 

  • Necessary cookies, which keep the site working and secure. These cannot be disabled. 
  • Functionality cookies, which remember your preferences and settings. 
  • Analytics cookies (for example, Google Analytics), which help us understand how the site is used by visitors, so we can improve it. 
  • Advertising and remarketing cookies, which are used to show you relevant ads on other sites. 

Since February 2026, UK law no longer requires your consent for cookies used purely for statistics or to remember your preferences (provided you can still opt out) – where required, we will still ask for your consent before setting analytics or advertising cookies, via our cookie banner. You can change your cookie preferences at any time through our cookie settings. For more information about how we use cookies, website tracking data and how to manage your preferences, please read our separate Cookie Policy. [insert URL] 

Conversion APIs and server-side tracking 

As well as browser-based cookies, we (and clients we run advertising campaigns for) may use “Conversion APIs” – sometimes called CAPI or server-side tracking – offered by platforms such as Meta (Facebook, Instagram), LinkedIn and Google. These send campaign performance information (for example, that an enquiry or purchase happened, together with a hashed version of an identifier such as your email address or phone number) directly from our server, or a client’s server, to the advertising platform, rather than relying only on your browser. 

We use this to measure how well marketing campaigns are performing and to reduce gaps in measurement caused by browser cookie restrictions. Hashing – turning your data into a scrambled code before sending it – doesn’t make it anonymous; the advertising platform can still match it back to you, so we treat it as personal data and apply the same protections described throughout this policy. 

Where a Conversion API is used alongside a cookie or similar technology on the site – which is the case for most of the campaigns we run – the cookie consent rules above still apply, and we won’t send data this way unless you’ve consented to the relevant advertising cookies. Where the advertising platform is based outside the UK, the safeguards described in “Sending data outside the UK” apply.  

Your consent is collected through the website Consent Management Platform (cookie banner) when you opt-in to marketing/advertising/analytics cookies and data tracking. If you decline consent or choose to opt-out at a later time, our server-side tracking is automatically deactivated, and no data will be shared via CAPI. 

You can withdraw your consent at any time by updating your preferences in the website Cookie Settings or by managing your ad preferences directly within your Meta/LinkedIn/Google account settings. 

Other electronic marketing (PECR) 

Separately from cookies, the Privacy and Electronic Communications Regulations (PECR) set specific rules for marketing by email, text message, or similar electronic means: 

  • We’ll only send you marketing communications by email or text if you’ve consented, or if you’re an existing customer and we’re marketing similar products or services to ones you’ve previously bought from us (the “soft opt-in”), and you were given a clear chance to opt out at the time your details were collected. 
  • Every marketing email or text message gives you an easy way to opt out or unsubscribe, and we’ll act on this promptly – normally within a few working days. 
  • Marketing emails may include tracking pixels or links that tell us whether you’ve opened or clicked them. These work in a similar way to cookies and are covered by the same consent principles described above. 
  • Where we run email or SMS marketing campaigns on behalf of a client, using their subscriber and marketing lists, the client remains responsible for ensuring they have the appropriate and lawful consent or soft opt-in basis to use that list – see “If you share other people’s data with us” above. We will only act on the client’s documented instructions when using their subscriber and marketing lists. 

Who we share your data with 

We may share personal data with: 

  • Our staff and authorised contractors, on a need-to-know basis. 
  • IT, software, cloud hosting and other technology providers who support our systems. 
  • Third-party suppliers and service providers we book on your behalf (such as media owners, printers, production companies and event suppliers), as agreed in your schedule. 
  • Third-party AI platforms, which we may use to help generate, review or refine content. Where your brief includes personal data, this may be processed by these platforms in accordance with our instructions and appropriate safeguards. We maintain a list of the approved AI platforms and tools we use, and details about how we use these responsibly. 
  • Our professional advisers, such as accountants, auditors, lawyers and insurers. 
  • Regulators, courts, law enforcement agencies, or other public authorities, where we’re legally required or permitted to do so by law. 
  • A prospective purchaser or successor organisation, in the event of a sale, merger, restructure or transfer of all or part of the business. 
  • Analytics, advertising and marketing platform providers, such as Google, Meta and LinkedIn, where we manage digital marketing campaigns or measure their effectiveness. 

We do not sell personal data to third parties. 

Sending data outside the UK 

Where we transfer personal data outside the UK, including to the EEA, and to any non-UK infrastructure used by our IT, hosting or AI platform suppliers, we will only do so using a recognised legal mechanism (such as the UK’s International Data Transfer Agreement or an adequacy decision), and we will take reasonable steps to ensure that the protection given to your data isn’t materially lower than it would receive in the UK, in line with the UK GDPR’s international transfer rules.  

How long we keep your data 

We only keep your personal data for as long as we need it for the purposes it was collected, including to meet our legal, regulatory and/ or business requirements. Client data, including correspondence, project work and design work, is generally kept for up to five years in accordance with our Terms & Conditions, after which we securely delete it. Different types of data have different rules and retention periods depending on the purpose it was collected and any applicable legal or regulatory requirements. We maintain a data retention schedule and review it regularly. If you want to know more or wish to ask for your data to be deleted, please contact us. 

Keeping your data secure 

We use appropriate technical and organisational measures to protect personal data, including: 

  • Password-protected and encrypted systems. 
  • Access controls to ensure data is limited to only those who need to carry out their role. 
  • Regular staff training on data protection, information security and incident reporting. 
  • Written contracts and agreements with any supplier or service provider who processes data on our behalf, requiring them to keep it, protect it and process it securely and confidentially. 
  • Audits on data processing activities, and suppliers, tools and platforms we use, to ensure on-going best practice and compliance. 

Your rights 

Under UK data protection law, you have the right to: 

  • Access a copy of the personal data we hold about you. 
  • Have inaccurate or incomplete data corrected. 
  • Ask us to delete your data, in certain circumstances. 
  • Restrict or object to our processing of your data – including an absolute right to object to direct marketing. 
  • Receive certain data in a portable format. 
  • Withdraw consent at any time, (where consent was the lawful basis for processing). This will not affect the lawfulness of any processing carried out before you withdrew your consent, and we may still continue to process some of your data, for example where the lawful basis is for the performance of a contract, legitimate interest, or a legal requirement.  

To exercise any of these rights, please contact us using the details at the end of this Policy. We’ll normally respond within one month, although this may be extended where permitted by law. 

Automated decision-making 

We may use automated tools to help decide which adverts and content people are shown, and to group contacts by likely interest or engagement. This is called profiling. It helps us to deliver more relevant marketing and measure the effectiveness of our campaigns, but it does not produce decisions that affect your legal rights or similarly significant effects on you. 

We don’t make decisions about individuals using purely automated means. If that ever changes, we’ll tell you beforehand, explain how it works, and give you a way to ask for a human to review or challenge the decision. 

You have the right to object to profiling for direct marketing at any time, and we’ll stop processing your data for these purposes. 

 

Children and young people 

Our website and marketing services aren’t aimed at children, and we don’t market to anyone under the age of 18 on our own behalf. 

We do hear from young people (typically aged 14 to 17) who contact us about work experience, and we host placements at our office. If you’re under 18 and you get in touch or come to us on placement, we’ll only use your information to arrange and run the placement and keep you safe while you’re with us, including meeting our safeguarding, health and safety and legal responsibilities. We’ll explain in a clear and appropriate way for your age, collect only the information we need and keep it for only as long as is necessary. Where appropriate, we will involve your parent, guardian or school. 

Where a client asks us to run a campaign involving people under the age of 18, we will handle that data on the client’s documented instructions and only where they’ve confirmed the right legal and safeguarding protections are in place. 

If you’re under 18 – or you’re a parent or guardian of someone under 18 – and you want to know what we hold or ask us to delete it, please email [email protected]. 

 

How to complain 

If you’re unhappy with how we’ve handled your personal data, we’d appreciate the opportunity to put things right before you contact the regulator. You can contact us: 

  • by phone: 01403 783400 
  • by post: Data Protection Lead, PMW, Stane Court, Stane Street, Billingshurst, RH14 9HP. 

We’ll acknowledge your complaint within 30 days, investigate it without undue delay, and let you know the outcome. You can find details about our data protection complaints procedure here [insert URL please]. 

If you’re not satisfied by our response, or you believe we have processed your personal data unlawfully, you have the right to complain to the UK’s independent data protection regulator, the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint or via their Helpline: 0303 123 1113. The ICO will usually ask you to contact us in the first instance to try and resolve the matter, before they will investigate. 

Changes to this policy 

We may update this policy from time to time to reflect changes in our business, the law or the way we process personal data. The latest version will always be available on our website, with the review date shown at the top of the document. 

Contact us 

PMW Communications Ltd, Stane Court, Stane Street, Billingshurst, RH14 9HP. 

Telephone: 01403 783400 

Email: [email protected]