Privacy notice.

Who is responsible?

QMS+ - Quality Management and Systems Plus (Darren Chappell) is a sole trader and the controller responsible for your enquiry information. You can contact Darren at djc@qmsp.uk or write to The Cottage, Blackmill Lane, Chichester, PO18 0JP.

This notice covers the QMS+ website and enquiries. It does not cover separate photograph-upload or staff evidence services, which require their own information.

What information do we use?

The enquiry form asks for your name, email address, area of interest and message. We also use information you choose to send in follow-up correspondence. Please do not include passwords, payment-card details, sensitive personal information or confidential customer records in an initial enquiry.

When the website handles a request, it processes connection information such as your IP address, request time and browser request details. The enquiry service uses a security session identifier and keyed representations of network addresses for abuse prevention. These controls do not require an account.

Providing enquiry details is voluntary, not a statutory requirement. We need the required fields to understand and answer a form enquiry; you can instead email us directly. No payment or attachment is collected through this form.

Why do we use it?

• Answering business enquiries: our legitimate interest in responding to questions, discussing services and maintaining relevant correspondence.
• Steps towards a contract with you: where you ask us to take steps before a contract with you personally, processing necessary for those steps or for performing that contract.
• Keeping the service secure: our legitimate interest in preventing spam, misuse and unauthorised submissions.
• Legal obligations: where applicable, keeping or disclosing information required by law.

These purposes use the corresponding UK GDPR bases of legitimate interests, contract and legal obligation. We will not treat an enquiry as consent to marketing, add you automatically to a mailing list, or use the form for automated decisions producing legal or similarly significant effects.

Who receives it?

QMS+ uses Google Workspace to send and receive enquiry email at djc@qmsp.uk. Website processing and email services handle the information needed to deliver and secure your enquiry. Access to business correspondence is limited to those authorised to handle it.

The website application does not maintain a separate enquiry-message database. Enquiry content is processed to validate and forward it, then retained in business email and any relevant correspondence records. This does not mean that email, hosting logs or backups are free of personal information.

The Satoshi typeface on this NAS website is served from the same host as the page. Displaying it does not require a font request to Fontshare or its delivery network. Ordinary requests for these locally hosted files may still appear in hosting logs.

We do not sell enquiry information. We may disclose relevant information to professional advisers or authorities where necessary for legal obligations or establishing, exercising or defending legal rights.

Processing outside the UK

Google Workspace is provided to QMS+ by Google Cloud EMEA Limited in Ireland. Our Workspace agreement incorporates Google’s Cloud Data Processing Addendum, which sets out its processing, security and subprocessor obligations. Google’s email services may process information outside the UK; we do not promise UK-only storage or processing.

For transfers to and onwards from the United States, Google identifies its certification to the UK Extension to the EU–US Data Privacy Framework as an adopted transfer solution in its transfer notice. For other restricted transfers, the addendum provides the applicable contractual safeguards, including standard contractual clauses with UK supplementary terms where required. The US framework is not a blanket safeguard for every country. You can read these arrangements through the linked documents or request a copy and further information from djc@qmsp.uk.

How long do we keep it?

Routine enquiries: enquiries that do not become customer work will normally be deleted within 12 months of the last meaningful contact, unless there is a specific continuing need or legal reason to retain them. QMS+ applies this through review of the relevant correspondence; there is no blanket automatic deletion of the business mailbox.

If an enquiry becomes customer work or a licence purchase, we keep the information needed to provide that service, administer licence entitlements, meet legal obligations and handle disputes for as long as those purposes require. A lifetime licence may require a minimal entitlement record to be kept for the lifetime of that entitlement; it does not justify keeping every original message indefinitely. Relevant records should be reviewed at least annually.

Form security: anti-abuse counters have a 15-minute window and form-security tokens are valid for up to 30 minutes. Expired counters are pruned during requests and hourly maintenance; inactive session files become eligible for cleanup after 30 minutes. Expiry prevents use of an old token or counter, but physical records may remain until a later cleanup run. Busy session files are not removed while locked.

Application logs: QMS+-specific application-error logs have daily rotation and hourly expiry against a 30-day retention target. Shared NAS web-server and PHP-platform logs are separate: they use size-based rotation, retaining a limited set of rotated files rather than a guaranteed number of days. We have not applied a blanket 30-day limit to those shared platform logs.

Website backups: the website code and private application configuration are backed up to an encrypted USB copy, normally daily. Up to 35 copies are retained within a 2 GiB storage budget, so capacity limits can result in fewer copies. This is a copy-count and storage-budget policy, not a guarantee of deletion exactly 35 days after creation. Runtime counters, sessions and application logs are excluded. This mechanism does not back up the Google Workspace mailbox.

Email and retained copies: archiving is not deletion. Reviewing a routine enquiry includes relevant received, sent and deleted-item copies and any applicable retention exception. Google’s systems follow the applicable service and deletion terms; removing a visible email does not establish immediate erasure of every provider copy. We do not promise that all copies disappear at the same instant.

Cookies and website features

The enabled enquiry form uses a cookie named qmsp_enquiry to connect a requested submission to its security token. It is limited to the enquiry API, uses secure and HTTP-only settings, and has a browser-session lifetime. Browser session-restoration features may retain session cookies longer than a simple window close.

This cookie is for form security, not advertising or visitor profiling. No analytics or advertising scripts are included in this NAS website. The font is served locally. These statements describe the QMS+ website itself, not any separate platform used to display a design preview.

Your rights and choices

Depending on the circumstances, you may have rights to access your information, correct it, request deletion or restriction, and receive certain information in a portable form. These rights are not absolute and depend on the information, purpose and lawful basis involved. Send requests to djc@qmsp.uk; we may need to confirm your identity before responding.

Your right to object: you may object to processing based on legitimate interests for reasons relating to your particular situation. Contact QMS+ using the details above so that we can consider and respond to your objection.

Questions or complaints

Please contact QMS+ if you have a concern about how your information is handled. You can also raise a concern with the UK's Information Commissioner's Office through its official website; you do not need to wait for QMS+ to approve a complaint.

This notice was updated on 3 November 2026.