Privacy & GDPR
What we collect, why, how long we keep it - and how to ask us to change or delete it.
Last updated: 9 October 2026
Who we are
Domma CMS - this website, the Domma CMS sites we host, and the service that sells and runs them - is operated by DCBW Consulting Ltd, based in the UK, company number 15858044. We are the data controller for the personal data described here.
For anything about your data, email support@domma-cms.com.
What we collect, and why
| When | What | Why | Lawful basis |
|---|---|---|---|
| You buy a site (or claim one with a gift code) | Your name, email address, site name and domain. Payment is taken by Stripe: we never see or store your card number - we keep Stripe's customer and subscription references and what you bought. | To set up, host and bill your site, and to send you the link to set your password | Contract |
| You use your site's admin | Your name, email address and a password, which is stored only as a one-way hash (bcrypt) - we cannot read it | To let you sign in and run your site | Contract |
| You ask for help (Support, in your admin) | Your name, the email of your account, the message you write, your site's name and its software version | To answer you - in your admin and by email | Contract |
| You send us feedback (Feedback, in your admin) | Your name and email, and what you write | To fix and improve Domma CMS, and to reply | Legitimate interests |
| You contact us by email or a form | Your name, email address and your message | To reply | Legitimate interests |
| We send you email | Your email address | Service email only: your welcome and password link, "Manage my site" links, payment notices, replies to your requests. Product news only if you opt in | Contract (service email); consent (news) |
| You visit our websites | Server logs (IP address, browser, the page asked for); cookies - see Cookies | To keep the service working and secure, and to count visits | Legitimate interests; consent (analytics) |
We do not sell your data, use it for advertising, or make automated decisions about you that have legal or similar effects.
Who we share it with
We use as few other companies as we can:
- Stripe - takes payments and manages subscriptions. Stripe is a controller for some payment data in its own right; see stripe.com/privacy.
- Hosting in London, UK - our managed sites and their data are hosted on our servers in London.
- Email - sent through our own mail server.
We share data with anyone else only where the law requires it.
Sites our customers run
Many Domma CMS sites belong to our customers. For the personal data on their site - people who fill in its forms, sign up to it, or visit it - the customer who owns the site is the controller and we are their processor: we host and back up that data on their behalf, under their instructions, and do not use it for anything else.
If you have a question about a site that is not ours, please contact that site's owner first. We will help them answer it.
Self-hosted Domma CMS sites run on their owners' own servers: we have no access to their data at all.
How long we keep it
| Data | Kept for |
|---|---|
| Your account and site | While your site is active, then 30 days after it closes |
| Billing records | As long as UK tax law requires (currently six years) |
| Support requests and Feedback | Two years after the last message |
| Backups | Up to 30 days, then permanently deleted |
| Server logs | Up to 30 days |
| Visit counts (analytics) | 12 months |
Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong
- delete it (we keep only what the law makes us keep, such as billing records)
- restrict or object to how we use it
- send it to you in a portable format (JSON or CSV)
- stop anything you consented to, such as product news or analytics cookies, at any time
Email support@domma-cms.com with the subject "GDPR request". We may need to confirm who you are. There is no charge, and we reply within one month - usually much sooner.
Security
Passwords are stored only as hashes; everything travels over HTTPS; access to account data is limited to the people who need it; and our software and servers are kept up to date.
Cookies
| Category | What it is for | Default |
|---|---|---|
| Strictly necessary | Keeping you signed in, security, and remembering your cookie choices | Always on |
| Functional | Your preferences, such as theme or reduced motion | Only with your consent |
| Analytics | Counting page views, on our own servers - nothing goes to Google or any other third party | Only with your consent |
We use no advertising or tracking cookies. You can change your choice at any time with the cookie settings link at the bottom of the page.
Sites our customers run may use other cookies, depending on what they switch on - their own cookie notice says which.
Changes
If we change this notice in a way that matters, we will tell account holders by email. The date at the top shows the latest version.
Complaints
If you are unhappy with how we have handled your data, please tell us first at support@domma-cms.com - we would like the chance to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.