Privacy
Privacy Statement
What personal information we collect, why, who sees it, and your choices.
Who we are
RPMCODE provides RPM. For the personal information described here — about visitors, people who sign up, our customers' administrators and Users, and anyone who writes to us — RPMCODE is responsible. Contact us at support@rpmcode.com.
Business data you put into RPM — about your customers, suppliers and staff — belongs to your business, which decides how it is used. We handle it only on your business's behalf, under the Data Processing Terms. If your information is held in RPM by a business you deal with, contact that business first.
What we collect
| Information | Where it comes from |
|---|---|
| Account details: name, username, email address, password (stored only as a one-way hash), the key of an authenticator app if you set one up (stored encrypted), the tenant name and code, and the countries your business works in | You, when you sign up or accept an invite; or the colleague who invited you |
| Your agreement to these pages: which version, and when | Recorded when you tick the box on sign-up or invite |
| What you do in the service: the records you create and change, and who changed what and when | Recorded by the service as you use it |
| Technical information: internet address, browser and device type, pages and requests, errors | Your browser, when it talks to our servers |
| Messages and feedback to the Platform Team, and emails to us | You |
| Billing details: who to invoice, and what was paid | You, and our own records |
We do not collect payment card details, and we do not use analytics, advertising or tracking tools, or buy information about you from others.
Why we use it
| Purpose | Legal basis (where the law asks for one) |
|---|---|
| Creating your account, signing you in, providing the service | Performing our contract with you |
| Sending codes, invites and notices about your account or the service | Performing our contract |
| Keeping the service secure: detecting and blocking attacks and abuse, investigating incidents | Our legitimate interest in a secure service, and legal obligations |
| Answering your messages and support requests | Contract, or our legitimate interest in helping you |
| Invoicing and keeping financial records | Contract, and legal (tax) obligations |
| Proving what you agreed to | Our legitimate interest in establishing and defending legal claims |
| Complying with the law, and lawful requests from authorities | Legal obligation |
We will only send marketing with your consent, and every marketing message will let you opt out. We do not make decisions about you by automated means that have legal or similarly significant effects. The one automated decision the service makes is security: an internet address that attacks the service is blocked for a time.
Who we share it with
- Your organisation. Administrators of the tenant you belong to can see your account and what you do in it.
- Our service providers, only as they need to provide their service: hosting, email delivery and attack-intelligence sharing. See the sub-processor list.
- YouTube (Google), only if you press Play on a video in one of our blog posts: the player then loads from YouTube, which sees your internet address. Nothing loads from YouTube before you press Play. See Cookies and Browser Storage.
- Professional advisers (lawyers, accountants, auditors) under confidentiality.
- Authorities, when the law requires it, or to protect people's safety or our rights.
- A buyer of our business, if RPMCODE or the service is sold, under the same protections.
We never sell personal information, and never share it for advertising.
Where it is kept
Information is stored on a server whose location is given in Company Details and Legal Notice. Our providers and advisers may be in other countries. Wherever it goes, we protect it as this statement describes and as the law of the country it comes from requires — see transfers between countries.
How long we keep it
Only as long as we need it: see Data Retention, Backup and Deletion.
How we protect it
See Cybersecurity Statement and Disclaimer. No system is completely secure, but we take the protection of your information seriously.
Your rights
Depending on where you live, you may have the right to know what we hold about you, get a copy, correct it, have it deleted, restrict or object to how we use it, take it elsewhere, withdraw consent, and complain to a regulator. Protection of Personal Information — Your Rights by Country sets these out country by country.
To exercise a right, write to support@rpmcode.com. We will confirm who you are before acting, and answer within the time your law allows — usually within 30 days. We do not charge, unless a request is clearly excessive and the law permits a fee. We will not treat you differently for exercising your rights.
Children
RPM is for businesses, and not for anyone under 18. We do not knowingly collect information about children. If you believe a child has given us information, contact us and we will delete it.
Complaints
If you are unhappy with how we have handled your information, write to support@rpmcode.com first: we will look into it and reply within 30 days. If you are still unhappy, you can complain to the privacy regulator in your country — see Protection of Personal Information — Your Rights by Country.
Changes
We will tell you about important changes to this statement by email or in RPM before they apply.