How DMOS uses your personal data
Who we are. DMOS is City Composites' design-to-manufacture and quality system. City Composites is the controller of the personal data in it; your employer remains responsible for its own records about you.
What we hold. Your name, work email, Microsoft account identifiers, organisation, job title and project roles; what you do and write in DMOS (the audit trail of changes); sign-in records, including whether multi-factor authentication was used; and API tokens you create (stored only as a fingerprint). We don't ask for home addresses, dates of birth or other personal details. The DMOS database doesn't store IP addresses; Microsoft's sign-in logs and Azure's platform logs for City Composites do, for a limited time.
Why. To give you secure access to the projects you work on with us, to keep the engineering and quality records our customers and regulators require, and to keep DMOS secure. Our lawful bases are legitimate interests (running projects with your employer securely) and legal obligations (quality and product records).
Who sees it. People at City Composites and at the organisations on the same projects, as far as their role needs. Your sign-in records are seen only by your own organisation's DMOS administrators and City Composites' Data Protection Lead. DMOS runs in City Composites' Microsoft Azure account in the UK; Microsoft provides sign-in. Teams or Google Chat notifications carry a reference and a link, not your email address.
How long. Sign-in and token records are kept for 12 months; an outside account not used for 12 months is closed. When an account is closed, your name is replaced by "Former user" after 12 months (6 years for City Composites staff). Engineering and quality records keep who did what, because product safety and traceability depend on them.
Cookies. DMOS uses only the cookies it needs to work: dmos_session keeps you signed in (ends after 2 hours unused, 12 hours at most) and dmos_oidc lasts a few minutes while you sign in with Microsoft, and dmos_newtok lasts two minutes after you create an API token. Your browser also remembers a few display choices (light or dark theme, list or card view, a dismissed install prompt, opening Teams links automatically, the Info switch); you can change them at any time, or remove them all by clearing this site's data in your browser. No analytics or advertising cookies, so there is nothing to accept.
Your rights. You can ask for a copy of your data, to correct it, to delete it where we don't need to keep it, to restrict or object to its use, or to take it elsewhere. Use the form below; we answer within one month. Signed-in users can download their data straight away from My data and privacy.
This is a summary. City Composites' full privacy notice is being finalised by our Data Protection Lead and will replace it here.