Can we use a few cookies?
They help us see which pages and ads are useful, so we can keep improving the site. We never sell your data, and you can change your mind any time in Cookie settings at the bottom of the page. Cookie Policy
Last updated: 27 October 2026
This notice explains how DLR Media Limited collects, uses and protects your personal data, on this website and wherever we act as a controller.
This notice applies to this website (dlrmedia.co.uk) and to personal data DLR Media Limited uses as a controller. Websites and applications we build for clients have their own privacy notices.
DLR Media Limited ("DLR Media", "we", "us") is the controller of the personal data described in this notice. DLR Media Limited is registered in Scotland under company number SC600110. Our registered address is Affinity House, Harrison Road, Dundee, DD2 3SN. We are registered with the Information Commissioner's Office (ICO) under registration number ZB641897.
DLR Media Limited is part of a group of companies that includes DLR Group (Scotland) Limited (registered in Scotland, company number SC659820, ICO registration ZB628857) and DLR Retail Limited (ICO registration ZB641902).
We apply the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025, as our baseline. This notice explains the types of data we collect from you or your business, and how that data is used and managed.
We are committed to protecting the privacy and security of your personal data. We monitor compliance through our policies and procedures and review them regularly.
We act as a controller for our own website, marketing, enquiries and client relationships. When we deliver services for clients, such as websites, advertising, email campaigns or CRM work, we usually act as a processor on the client's instructions, under our Data Processing Agreement. We use ICO guidance when deciding whether we are acting as a controller or a processor.
At DLR Media, we offer a comprehensive range of marketing and communications advice, strategy, and services for businesses and serve local, national, and international clients. We offer a full digital service to our clients to help their business grow.
As part of our services, we may design, develop, deploy and host websites, applications, automations and AI-assisted systems using third-party platforms, infrastructure providers and integrated services.
Depending on the project, these services may include any of the following platform features and tools:
Some applications or websites developed by us may be operated by our clients, who independently determine the data collected and the purposes for which it is processed.
In such cases, the client is responsible for ensuring compliance with applicable privacy and data protection laws.
Personal data is information about you and from which you can be identified. We will collect and process personal data about you depending on our relationship with you. Most of the personal information we process is provided to us directly by you. Data collection can be through a variety of channels, including by telephone, email, via our website or on site and via third parties.
Depending on our relationship with you, we may collect some or all of the following categories of personal data:
We do not ask for special category data, such as health information, and we ask you not to send it to us.
We will only process personal data where we have a lawful basis for doing so. Under the UK GDPR, there are six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. The purposes for which we use personal data, and the lawful basis for each, are set out below.
To carry out our contracts with clients, including delivering our services, support, reporting, account management and promoting our clients' businesses where agreed. Lawful basis: contract.
To respond to your enquiries, including enquiries made through our website tools, WhatsApp, email or phone, and to send you the recommendations or quotes you ask for. Lawful basis: legitimate interests, or steps taken at your request before entering into a contract.
To invoice, take payments and keep accounting and tax records. Lawful basis: contract and legal obligation.
To send you marketing emails about our services. Lawful basis: consent where you have opted in, or legitimate interests for business contacts and existing clients where PECR allows it.
To contact businesses we have researched about our services, as described in Business contacts we research below. Lawful basis: legitimate interests.
To analyse the information we hold about you, including information from public business sources, so that the marketing we send is relevant to you. Lawful basis: legitimate interests. You can object to this at any time.
To seek feedback, run surveys and improve our services, website and marketing, including measuring how our marketing campaigns perform. Lawful basis: legitimate interests.
To measure how our website is used with analytics and advertising cookies, only after you accept them. Lawful basis: consent.
To understand which organisations visit our website using Leadfeeder (Dealfront), only after you accept cookies. Lawful basis: consent for the cookies, and legitimate interests for the company-level insights.
To run and promote events, webinars and training, and to share attendance and feedback with an organisation that commissioned them. Lawful basis: contract or legitimate interests.
To publish case studies about our work, with the client's approval. Lawful basis: legitimate interests.
To consider job applications as part of our recruitment process. Lawful basis: steps taken before entering into a contract, and legitimate interests.
To prevent fraud, to protect our rights and the safety of our clients, contractors and others, and to establish, exercise or defend legal claims, including sharing information with our insurers and advisers. Lawful basis: legitimate interests.
To comply with any legal or regulatory obligation. Lawful basis: legal obligation.
We may obtain business contact details from public sources such as LinkedIn and company websites, from Dealfront (Leadfeeder) and from B2B data providers, to contact businesses about our services under our legitimate interests. You can object at any time.
Some of our services may involve the use of artificial intelligence, automated systems or machine-assisted development tools.
Such systems may process prompts, instructions, content, configuration data or usage information in order to generate functionality, content, workflows or application features.
We take reasonable steps to ensure that AI-assisted services are implemented responsibly, however customers remain responsible for reviewing and approving outputs and ensuring that any data entered into such systems is appropriate and lawful.
Our team uses AI assistants, namely Claude (Anthropic), ChatGPT (OpenAI) and Microsoft 365 Copilot (Microsoft), to research, draft content, prepare proposals and reports, and handle enquiries and client work. We only use business accounts on which the providers do not use our data to train their AI models. We do not enter special category data into AI assistants, and a member of our team reviews what they produce before it is used. Where we use these tools to work on a client's data, we do so as that client's processor under our Data Processing Agreement, with the client's permission.
We know how much data security matters to all our clients, and we take appropriate technical and organisational measures to protect personal data. Our website uses HTTPS, access to personal data is limited to the people who need it and protected by passwords and multi-factor authentication where the platform supports it, and payments are handled by our payment providers, Stripe and GoCardless. We have processes in place to detect, investigate, risk assess and record incidents and breaches, and we continue to look for new ways to protect data.
If a data breach is likely to put people at risk, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and tell affected individuals where the risk is high.
DLR Media collects personal data from web forms submitted by customers requesting information in the form of general enquiries or to register for the events and services provided by DLR Media. This comprises the name, email address, phone number, company name, subject and message of the person making the enquiry. When you submit a form, we receive a notification by email and in our internal team messaging tool so we can reply quickly. If you tick the marketing box, we also add you to our email marketing list.
When you submit a form, we also record your IP address, the approximate location it points to (country and city) and your browser and device type. We use this only to detect and stop spam, fake and fraudulent enquiries, never for marketing, and we keep it for 90 days. We use the ipwho.is and GeoJS services to look up the approximate location. Lawful basis: legitimate interests.
Some tools on our website, such as our instant website price tool and free website analysis, use artificial intelligence to review the business details you enter (for example your business name, industry and website address) and generate a score, recommendations or a mockup. We use the results to prepare a relevant reply to your enquiry. We do not use these tools to make decisions that have legal or similarly significant effects on you, and a member of our team reviews every enquiry.
Our website includes a WhatsApp button. If you message us on WhatsApp, your phone number, name and messages are processed by WhatsApp (Meta) under its own terms and privacy policy, and by us to reply to you. Please do not send sensitive personal information by WhatsApp.
Where we build AI chatbots or AI agents for clients, the client is the controller of the conversations on its own website and its privacy notice applies. We process that data as the client's processor under our Data Processing Agreement.
Some applications or websites developed by us may include login systems, user accounts, authentication providers or restricted-access areas.
Where applicable, personal information such as names, email addresses, account identifiers, login activity and user-generated content may be processed in connection with these features.
DLR Media can be found on social media platforms such as Facebook, X, Instagram and LinkedIn. Social media is an important part of our awareness effort, so if you have accepted advertising cookies you may see our adverts on social media after visiting our website. We may target ads at audiences that we believe match the profile of our target audience and would therefore be interested in our services. We will also regularly tag or mention you where we are carrying out business promotion on your behalf or to raise your professional profile.
These platforms are run by commercial companies and DLR Media is not the Data Controller or Data Processor of your social media profile. You should contact these social media platforms directly if you have concerns over how your personal data is being used and stored by them.
We collect and process your name, email address, organisation, job title, dietary or access needs you choose to tell us, attendance and feedback, to run the event and, where an organisation commissioned it, to share attendance and feedback with that organisation.
Our websites and the information we share around events may contain links to other websites run by other organisations. This privacy notice applies only to our website, so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website. In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party site and recommend that you check the policy of that site.
We use Google Analytics to understand how visitors use our website so that we can improve it. Google Analytics uses an identifier stored in a cookie and your IP address, which can be personal data. We only use it if you accept analytics cookies. For more information about Google Analytics, visit https://www.google.com/analytics/terms/. To opt out of being tracked by Google Analytics across all websites, visit https://tools.google.com/dlpage/gaoptout.
When you accept analytics cookies, Google Analytics gives us information such as the following:
Whether we are acting as a data controller or processor we continue to apply the UK GDPR principles to all personal and sensitive data that we hold or process, and these principles lie at the heart of our approach to processing personal data.
1) Processed lawfully, fairly and in a transparent manner in relation to individuals.
2) Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be incompatible with the initial purposes.
3) Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
4) Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased, or rectified without delay.
5) Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the UK GDPR in order to safeguard the rights and freedoms of individuals.
6) Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.
We use third parties who provide elements of our services for us. We have contracts in place with these providers, who act as our processors, which means they cannot do anything with your personal information unless we have instructed them to. They must hold it securely, keep it only for the period we instruct, use it only for the purposes in our contract with them, and delete it or make it anonymous when we stop using their services. We only give them the information they need to perform their services.
We will not sell or rent your information to third parties, and we will not share your information with any third parties for the purposes of their own direct marketing.
Some of our providers host, process or store data in the United States. See International Data Transfers below for the safeguards we use.
We may be required to transfer your information to a third party as part of a sale, merger or restructuring of some or all of our business.
We may also disclose or share your personal data to comply with any legal obligation, to enforce or apply our terms, or to protect the rights, property or safety of DLR Media, our clients, contractors and others. We will take steps with the aim of ensuring that your privacy rights continue to be protected.
Examples of the kind of third parties we work with are IT companies who support our website and other business systems, other suppliers, and photographers or independent consultants.
We may share names, email addresses, pictures, job roles and organisational information as part of business-to-business networking events and with organisations and contractors commissioned to assist and co-ordinate these events.
Pre and post event or webinar management may include grouped online communications such as meeting invites, meeting chats and document sharing. Others attending may see your name and email address and may see conversation responses and questions you ask.
Where we have been commissioned by an organisation to host a webinar or event, your registration and attendance information and any feedback you provide will be shared with this organisation.
We work closely with organisations to ensure that your privacy is respected and protected at all times.
We use trusted providers to run our website and business. The main ones are: Base44 (website and application hosting, database and AI features); BWF Hosting (hosting for WordPress websites, in UK data centres); domain registrars and registries such as Nominet (registering and renewing client domain names); Resend (sending enquiry and service emails); ipwho.is and GeoJS (approximate location look-up for spam and fraud checks on our forms); Klaviyo (email marketing, only where you have opted in); Slack (internal enquiry notifications); Microsoft (email, documents and Microsoft 365 Copilot); Anthropic (Claude AI assistant); OpenAI (ChatGPT AI assistant); Google (Analytics, Ads and business software); Meta (WhatsApp and advertising); Dealfront (Leadfeeder company-level website analytics, only with your cookie consent); Stripe and GoCardless (payments); Xero (accounting); Signable (electronic signatures); and Capsule (customer relationship management). Some of these providers process data in the United States, under the safeguards described in International Data Transfers. We also use specialist subcontractors to deliver some client services. They act under written contracts that protect your data, and we will give details on request.
We do not anticipate providing services directly to children, however we do understand that if this changes, we will make provisions to verify age. We will also make further provisions to gain parental or guardian consent for data processing activity where required.
We apply UK data protection law as our baseline. Some of the providers we use, such as cloud hosting, analytics, email and customer relationship platforms, host, process or store personal data in the United States or other countries outside the UK. Where we transfer personal data outside the UK or the European Economic Area, we use appropriate safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses.
We will not transfer special category data outside the UK without explicit consent. If you use our services while you are outside the UK, your information may be transferred outside the UK in order to provide you with those services.
Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.
Your right of access - You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the right to object to processing we carry out on the basis of our legitimate interests, and you can always object to direct marketing, including profiling for direct marketing.
Your right to data portability - This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or a contract, and the processing is automated.
Your right to withdraw consent - You can withdraw consent at any time. This does not affect any processing we carried out before you withdrew it.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. If your request is complex or you send several, we may extend the one-month period by up to two further months and will tell you why.
The Privacy and Electronic Communications Regulations (PECR) sit alongside the Data Protection Act 2018 and the UK GDPR and give individuals specific rights around electronic communications. For us, PECR applies to direct marketing by phone, email and text, and to the cookies and similar technologies on our website.
We only send you marketing emails or messages where you have opted in, for example by ticking the marketing box on one of our forms, or where the law otherwise allows it. Our forms never pre-tick this box.
You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request unless an exemption applies. There are various ways you can stop direct marketing communications from us.
Click the "unsubscribe" link in any direct marketing email communication that we send you. We will then stop any further direct marketing emails.
You can also email, call, or write to us to ask us to add you to our suppression list.
If you unsubscribe from our marketing mailing lists, you will still receive service and support communications from us where you are an existing customer, supplier or have a relationship with us that requires us to process your information as part of a contract or where the law requires us to do so.
We ask for your consent before setting analytics or advertising cookies. You can change your choice at any time using Cookie settings in our website footer. Full details are in our Cookie Policy.
We work with clients in the UK and globally, including Ireland, the United States, Canada, Australia, New Zealand, Singapore, India, the United Arab Emirates and South Africa. We apply UK GDPR as our baseline wherever you are, and we also respect the privacy rights available to you under the law where you live. To use any of the rights below, contact us using the details in Contact Us. We will respond within the time limits set by the law that applies to you.
Ireland and the European Union: We process personal data in line with the EU General Data Protection Regulation (EU GDPR). You have the rights described in Your Data Protection Rights, and you can complain to the Data Protection Commission in Ireland or to the supervisory authority in your country.
United States: If you live in a US state with a consumer privacy law, such as California, you may have the right to know what personal information we collect and why, to access, correct or delete it, and to opt out of its sale or sharing for targeted advertising. We do not sell your personal information. You can opt out of advertising and analytics cookies at any time using Cookie settings in our website footer. We will not treat you differently for using your rights.
Canada: We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). We only send commercial electronic messages where you have given consent or another basis applies under Canada's Anti-Spam Legislation (CASL), and every message includes a way to unsubscribe.
Australia and New Zealand: We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and with the New Zealand Privacy Act 2020. Marketing messages follow the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ). You can complain to the Office of the Australian Information Commissioner or to the New Zealand Office of the Privacy Commissioner.
Singapore: We handle personal data in line with the Personal Data Protection Act 2012 (PDPA). You can contact our data protection contact at sales@dlrmedia.co.uk.
India: We process digital personal data in line with the Digital Personal Data Protection Act 2023. You can withdraw your consent, and ask us to access, correct or erase your personal data, by contacting us.
United Arab Emirates: We process personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
South Africa: We process personal information in line with the Protection of Personal Information Act 2013 (POPIA). You can contact our information officer at sales@dlrmedia.co.uk, and you may lodge a complaint with the Information Regulator of South Africa.
We keep personal data only for as long as we need it for the purpose it was collected, and then delete or anonymise it:
Enquiries that do not become clients: 2 years from our last contact with you.
Client records, contracts and invoices: 6 years after the end of the contract, to meet tax, accounting and legal requirements.
Email marketing: until you unsubscribe. We keep your email address on a suppression list after that so we never email you again by mistake.
WhatsApp, email and other messages with us: 2 years from our last contact with you, unless you become a client.
Event and training registrations: 2 years after the event, unless you are also a client.
Job applications: 6 months after the recruitment decision, unless you agree to us keeping them longer.
Website analytics: in line with the retention settings in our analytics tools, and no more than 14 months.
Form security data (the IP address, approximate city and browser details recorded when you submit a form): 90 days.
Where we act as a processor for a client, the client decides how long its data is kept.
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You can complain using the form on our Contact page (dlrmedia.co.uk/contact) or by emailing sales@dlrmedia.co.uk with "Data protection complaint" in the subject line, or by writing to us at the address below. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk/make-a-complaint or by calling 0303 123 1113. Its address is below.
Further information around your rights can be found at https://ico.org.uk/your-data-matters