Data Protection & Privacy

Data protection, privacy, and regulatory compliance at FMIS

Data Protection & Privacy

FMIS provides systems used to manage financial and operational data. Data protection is therefore a core part of how our solutions are delivered and supported.

This page explains how FMIS handles data in practice, including roles, responsibilities, and the controls applied to protect client information.

Regulatory alignment

FMIS aligns its data protection practices with recognised regulatory frameworks and maintains registration with the UK Information Commissioner’s Office (ICO).

UK GDPR & UK DPA
EU GDPR
ICO registered data processor

Our approach is designed to support organisations operating across multiple regions, with consistent data handling and security controls regardless of location.

View ICO Certificate

Data handling in practice

Data is managed within a controlled environment, with consistent standards applied across all systems.

Access is restricted based on user roles
Data is protected through encryption in transit and at rest
Activity within the system is recorded to support audit and traceability
Environments are segregated to reduce risk

These controls are applied as part of day-to-day system operation, not as separate or optional measures.

Roles and responsibilities

FMIS acts as a controller for its own business activities, including enquiries, customer and supplier relationships, marketing, recruitment, employment and security administration.

When FMIS handles personal data through its software and services under a Data Processing Agreement, the customer is normally the controller and FMIS acts as processor on the customer’s documented instructions.

In practice, this means:

Customers determine how and why their data is used
FMIS provides and supports the system used to store and process that data
Access to data is controlled based on client-defined roles and permissions
FMIS does not use customer-controlled data for its own marketing or other unrelated purposes.

This separation ensures that control remains with the organisation that owns the data.

multicompany, multicountry and multicurrency fixed assets

Data residency & subprocessors

FMIS cloud solutions are hosted in the UK unless otherwise specified, with data stored and managed within this environment. Systems are accessed by organisations internationally, but the same controls and standards are applied across all deployments.

Where third-party services are required, they are selected and managed in line with our information security and data protection policies. This includes appropriate due diligence and ongoing review.