Privacy Policy

1. Who we are

This Privacy Policy is issued by DSM Advisory ("DSM Advisory", "we", "us" or "our"), a boutique IT procurement and M&A advisory firm operating from London, Frankfurt, Warsaw and Vienna. DSM Advisory is the data controller for personal data processed through this website and the secure client portal, except where we act as a processor on written instructions from a client.

For privacy enquiries, contact privacy@dsmadvisory.com. Correspondence may also be sent to DSM Advisory, Legal & Compliance, London.

2. Scope

This policy applies to visitors of this website, authorised users of the client portal, vendor personnel who submit RFP responses, and other business contacts. It does not apply to personal data processed solely on a client's systems under a separate data processing agreement.

3. Personal data we collect

We collect only what is required to operate a restricted B2B advisory practice:

• Identity and contact data - name, corporate email, employer, role, and Corporate ID where issued for portal access.
• Authentication data - access tokens, password hashes, multi-factor credentials, and session identifiers.
• Technical data - IP address, browser type, device identifiers, TLS session metadata, and access logs.
• Professional correspondence - emails, RFP materials, and documents you or your organisation send to us.
• Engagement data - matter references, NDA status, and authorised-network designations.

We do not seek special-category data through this website. Please do not submit it unless we have expressly requested it under contract.

4. How we use personal data

We use personal data to:

• authenticate users and enforce IP, VPN, and authorisation controls on the client portal;
• deliver technical due diligence, vendor sourcing, and post-merger integration services;
• communicate with designated procurement leads and deal teams;
• meet legal, regulatory, audit, and conflict-checking obligations;
• protect our systems against unauthorised access, fraud, and misuse;
• maintain records required for professional indemnity and client file retention.

We do not sell personal data. We do not use personal data for retail marketing or consumer profiling.

5. Lawful bases

Depending on the processing, we rely on one or more of the following bases under UK GDPR and EU GDPR:

• Contract - to perform an engagement letter, NDA, or portal access agreement.
• Legitimate interests - to secure our systems, run a professional B2B practice, and communicate with institutional counterparties, provided those interests are not overridden by your rights.
• Legal obligation - where we must retain records, respond to a competent authority, or meet anti-fraud and security duties.
• Consent - only where required, for example for optional cookies. Strictly necessary cookies do not require consent.

6. Sharing and international transfers

We may share personal data with:

• personnel in our London, Frankfurt, Warsaw and Vienna offices on a need-to-know basis;
• professional advisers (legal, insurance, audit) under confidentiality obligations;
• IT hosting, identity, and security providers acting as processors under contract;
• a client, co-advisor, or vendor where the engagement requires it;
• regulators, courts, or law enforcement where we are legally required to do so.

Where personal data is transferred outside the UK or EEA, we use an adequacy decision or the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, as applicable), together with a transfer risk assessment.

7. Retention

Portal authentication logs are retained for security monitoring, typically 12 months, unless a longer period is required to investigate an incident. Client matter files are retained for the period set in the engagement letter, and in any event for no less than the limitation period applicable to professional services in the relevant jurisdiction, after which they are securely deleted or anonymised.

8. Security

Communications and portal access attempts are protected by 256-bit TLS encryption. Access is restricted to pre-approved networks and authorised users. Unauthorised access is monitored and logged. No method of transmission or storage is completely secure; we maintain technical and organisational measures appropriate to a confidential M&A advisory environment.

9. Your rights

Subject to conditions and exemptions in UK and EU data protection law, you may have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent where processing is consent-based. You also have the right to lodge a complaint with a supervisory authority, including the UK Information Commissioner's Office (ICO) and, if you are in the EEA, your local authority.

To exercise a right, email privacy@dsmadvisory.com. We may need to verify your identity and, where you act for an organisation, your authority to make the request.

10. Updates

We may update this policy to reflect legal, technical or operational changes. The "Last updated" date at the top of this page will change when we do. Material changes affecting client portal users may also be notified through the portal or by email to the designated procurement lead.