Privacy Notice
Key Marketing Services Limited, trading as KPM Group (“KPM”, “we”), is the data controller for personal data handled through this website and in the course of our business. We are registered in England and Wales, company number 04287333, at Unit 1, Mill Place, Platt Business Estate, Maidstone Road, Sevenoaks, Kent TN15 8TB. Our ICO registration number is Z1316317.
We take privacy seriously — it is central to what we do as a direct marketing and print production business, and we hold ISO 27001 certification for information security alongside the QG GDPR Management Standard. This notice explains what personal data we collect, why, on what legal basis, who we share it with, how long we keep it, and your rights.
The information we collect
Information you give us. When you contact us — through the enquiry forms on this website, by email, post or telephone — we collect the details you provide: typically your name, business, email address, phone number and the content of your enquiry. If you become a client, we also hold the contact, account and billing information needed to deliver our services and invoice for them.
Information collected automatically. When you visit this website, and only with your consent where consent is required, we collect technical and usage information: IP address, browser and device type, pages visited, and how you reached us. This is collected through cookies and similar technologies — described fully, with your controls, in our Cookies Notice.
Information from our clients. As a direct mail and fulfilment provider we process personal data supplied by our clients in order to deliver their campaigns. In that work we act as a processor on the client’s instructions; the client remains the controller, and we require that lawful grounds, notices and consents are in place for any data we are asked to process. Our own use of that data is limited to performing the contracted service.
How we use it, and the legal basis for each use
| Purpose | Legal basis (UK GDPR, Article 6) |
|---|---|
| Responding to your enquiry and corresponding with you | Legitimate interests – answering the people who contact us |
| Providing our services to clients: direct mail, fulfilment, print management, distribution | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation |
| Sending marketing about our own services to business contacts | Legitimate interests, with a clear way to opt out in every message; consent where the law requires it |
| Website analytics and advertising cookies | Consent, via the cookie banner – you can change your mind at any time |
| Protecting our systems, preventing fraud and misuse | Legitimate interests / legal obligation |
You can opt out of marketing from us at any time using the link in any message or by contacting us directly — it does not affect any service we provide you.
Who we share personal data with
We do not sell personal data. We share it only where needed to run our business, with safeguards in place:
- Service providers (processors) acting on our instructions — including our website hosting provider (SiteGround), our email and marketing platform (ActiveCampaign), and our IT and email services (Microsoft 365). Each is bound by contract to keep personal data confidential and secure.
- Analytics and advertising partners — Google (Analytics and Tag Manager), Meta and LinkedIn — but only where you have consented to those cookies. See the Cookies Notice.
- Delivery partners — Royal Mail and other carriers, where needed to fulfil mailings.
- Professional advisers, and authorities where the law requires it.
We require any third party engaged as a processor to have a written contract committing to confidentiality, security and the return or destruction of data, and where appropriate we audit our suppliers against those commitments.
International transfers
Where personal data is transferred outside the UK — for example because a service provider operates elsewhere — we ensure an appropriate safeguard recognised under UK law is in place: the UK’s International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, an adequacy decision, or (for transfers to certified US organisations) the UK–US Data Bridge.
How long we keep it
| Category | Retention |
|---|---|
| Financial and transaction records | 7 years, as required by law |
| Client data during a contract | The life of the contract, then 18 months |
| Marketing data | 18 months from your last interaction with us |
| Enquiries that do not become clients | 18 months |
Data that reaches the end of its retention period is securely destroyed or returned. You may ask us to erase your data sooner — see your rights below.
Security
We operate an information security management system certified to ISO 27001, supported by our Business Management System, which also covers quality and environmental management in accordance with ISO 9001 and ISO 14001 principles. Technical and organisational measures protect personal data against loss, misuse and unauthorised access. Details of our security policy are available on request.
Your rights
Under the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) you have the right to:
- Access the personal data we hold about you;
- Correct data that is inaccurate or incomplete;
- Erase your data, in certain circumstances;
- Restrict or object to our processing, including an absolute right to object to direct marketing;
- Data portability — receive data you provided to us in a usable electronic form;
- Withdraw consent at any time, where consent is the basis we rely on — including cookie consent, via the settings described in our Cookies Notice.
To exercise any of these, contact us using the details below. We will respond within one month. There is no charge in normal circumstances.
Contact, and complaints
Data protection contact: Nigel Copp, CEO
KPM Group, Unit 1, Mill Place, Platt Business Estate, Maidstone Road, Sevenoaks, Kent TN15 8TB
Email: nigel.copp@kpmgroup.co.uk · Telephone: 01322 663328
If you are unhappy with how we have handled your personal data, please contact us first and we will do our best to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
We review this notice regularly and will post any updates on this page, with the version and date shown at the top.
