GDPR Compliance

1. Our commitment

DSM Advisory processes personal data in line with the UK General Data Protection Regulation, the UK Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679). This page summarises our compliance programme for institutional clients, vendors and website users. It does not replace our Privacy Policy.

2. Roles

For this website and the administration of portal accounts, DSM Advisory acts as controller. For personal data contained in client deal files that we process only on documented instructions, we act as processor. The engagement letter and, where required, a data processing agreement (DPA) record the role, instructions, sub-processors and deletion timetable.

3. Accountability measures

We maintain records of processing, staff confidentiality undertakings, access controls on a need-to-know basis, and vendor due diligence on processors. High-risk processing connected to M&A work is assessed before it starts. Where a data protection impact assessment (DPIA) is required, it is completed before the relevant processing begins.

4. Lawful processing

We do not process personal data without a lawful basis. Typical bases for our work are contract (engagement performance), legitimate interests (network security, professional communications with B2B counterparties), and legal obligation (regulatory, tax and limitation-period record keeping). We do not rely on consent for core advisory or security processing.

5. Processors and sub-processors

Hosting, identity, logging and communications providers are appointed under written contracts that impose GDPR Article 28 terms, including confidentiality, security, deletion, audit cooperation and restriction on sub-processing. We do not permit processors to use client personal data for their own purposes.

6. International transfers

Personal data may be accessed from our offices in the United Kingdom and the EEA (Germany, Poland and Austria). Transfers from the EEA to the UK rely on the EU adequacy decision for the UK, for so long as it remains valid. Transfers to any other third country are made under Standard Contractual Clauses and a transfer impact assessment, or another mechanism recognised by Chapter V GDPR.

7. Data subject rights

We have a process for access, rectification, erasure, restriction, objection and portability requests. Requests are handled without undue delay and in any event within one month, extendable by two months for complex or numerous requests as permitted by law. Where we are processor, we will notify the relevant client controller and act on its instructions.

Submit requests to privacy@dsmadvisory.com.

8. Security and breach notification

We apply encryption in transit (256-bit TLS), access logging, network restriction and monitoring of unauthorised attempts. Personal data breaches are assessed against ICO and EDPB guidance. Where a breach is likely to result in a risk to individuals, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. High-risk breaches are communicated to affected individuals unless an exemption applies.

9. Supervisory authorities

Our lead contact for UK-related processing is the Information Commissioner's Office (ico.org.uk). For processing in the EEA, data subjects may also contact the competent authority in Germany (BfDI / relevant Landesbeauftragte), Poland (UODO) or Austria (Datenschutzbehörde), depending on the establishment and the data subject.

10. Contact

Data protection enquiries: privacy@dsmadvisory.com. Legal enquiries: legal@dsmadvisory.com. Offices: London, Frankfurt, Warsaw and Vienna.