NMS Group – Internal Data Audit Report

Conducted by: NMS Compliance Unit

Lead Auditor: Captain Caius "Maverick" Volt

Audit Date: May 17, 2025

Reporting Period: January 1 – April 30, 2025

Audit Cycle: Quarterly Internal Compliance Audit

Legal Frameworks: GDPR (EU) | CCPA/CPRA (California) | UAE Cyber Law

1. Executive Summary

This comprehensive audit assessed NMS Group's data lifecycle practices across all major systems and workflows. The review focused on compliance with global privacy regulations and internal data governance policies, covering:

Data collection methods and consent mechanisms
Storage locations and security protocols
Third-party data sharing practices
Retention schedules and deletion processes

Scope included NineteenMarketingServices.com, NineteenBerry.com, and all internal Dream Team operational systems.

2. Data Inventory Overview

System/Tool	Data Type Collected	Legal Basis	Location	Retention Period
HubSpot CRM	Names, Emails, IP, Lead Tags	Consent	Cloud (US/EU)	24 Months
Website Forms (NMS)	Name, Email, Phone	Consent	Server - Germany	18 Months
Google Analytics	IP, Geo-location, Behavior	Legitimate Interest	Google Cloud (US)	14 Months
Meta Pixel	Ad tracking, device info	Consent	Meta Ads Manager	12 Months
Freelancer NDAs	Legal Names, Passport Copies	Legal Obligation	Secure Drive (Pakistan)	5 Years
Shopify (NineteenBerry)	Customer name, email, shipping address	Contract	Shopify Cloud (Canada)	36 Months

3. Key Findings & Compliance Status

✅

Cookie Banner: Fully compliant with GDPR and CCPA requirements

⚠️

Consent Logs: Inconsistent recording of consent timestamps across platforms

⚠️

Data Sharing with Vendors: 3 of 7 vendor contracts need updated DPAs

✅

Data Retention: All systems comply with documented schedules

⚠️

Employee Data Protection: Need stricter access controls for HR files

4. Corrective Action Plan

Task	Responsible	Deadline
Create centralized consent log	Digital Ops Team (Vera Way)	May 30, 2025
Re-circulate Vendor Compliance Policy	B2B Coordinator (Nova Linq)	May 25, 2025
Staff Training on Data Access SOPs	HR + Captain Volt	June 5, 2025
Auto-delete rule on old CRM leads	CRM Admin	June 1, 2025

5. Audit Methodology

The audit team performed the following due diligence activities:

Comprehensive system walkthroughs of all CRM, analytics, and ad platforms
Technical review of website backend and cookie implementation
Contract analysis for 12 vendor/service provider agreements
Interviews with 8 key data handlers across marketing and operations
Verification of server locations and cloud provider certifications
Sample testing of data subject request fulfillment processes

6. Certification

This report represents a good faith examination of NMS Group's data practices. While several improvement opportunities were identified, no material compliance violations were found. All remedial actions will be completed by June 2025, with verification audits scheduled for Q3.

Approved by:

Captain Caius "Maverick" Volt

Team Captain | NMS Dream Team

info@nineteenmarketingservices.com

May 17, 2025