1. Who we are
Tamam Technologies Ltd (trading as React-IMS) is a company registered in England and Wales under company number 16897253, with its registered office at 2 Claremont Crescent, Morecambe, LA4 4HH, United Kingdom. We are the data controller for personal data about our website visitors, prospects and account administrators. For data uploaded into the platform by our customers, we act as a data processor — see our Data Processing Agreement.
2. How to contact us
Privacy questions and data subject requests: privacy@react-ims.com. Security disclosures: security@react-ims.com.
3. The personal data we collect
- Account data — name, work email, organisation, role, password hash, authentication events.
- Profile and preference data — language, time zone, notification preferences, MFA configuration.
- Usage data — pages visited, features used, IP address, browser and device information, audit-log entries.
- Support data — messages you send us via the contact form, email or in-app support.
- Marketing data — if you opt in: company, role, communication history.
4. Why we use it (lawful bases)
- Contract — to provide the platform, manage your subscription and deliver support.
- Legitimate interests — to keep the platform secure, prevent abuse, measure and improve performance, and grow our business proportionately.
- Legal obligation — accounting, tax and responding to lawful requests from authorities.
- Consent — non-essential cookies and marketing emails. You may withdraw consent at any time.
5. Who we share data with
We use a limited number of sub-processors to operate the platform — hosting, database, transactional email and AI services. The current list, including their locations and the safeguards in place, is published at /subprocessors. We do not sell personal data.
6. International transfers
Customer data is hosted in European Union (Frankfurt / Dublin). Where a sub-processor is located outside the UK / EEA, we rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, and apply additional technical safeguards such as encryption in transit and at rest.
7. Retention
Account data is retained for the life of your subscription and for up to 12 months after termination, after which it is deleted or anonymised. Audit logs are retained for 7 years to meet compliance and certification expectations. Support tickets are retained for 3 years. You can request earlier deletion subject to legal limits.
8. Your rights
You have the right to access, rectify, erase, restrict, port and object to our processing of your personal data. To exercise these rights, email privacy@react-ims.com. You can also complain to the Information Commissioner's Office (ICO), United Kingdom, although we'd appreciate the chance to put things right first.
9. Security
We use encryption in transit (TLS 1.2+) and at rest, role-based access control, row-level security on tenant data, immutable audit logging, and least-privilege administrative access. See our security overview.
10. Changes to this policy
We will post material changes on this page and, where appropriate, notify account administrators by email at least 30 days before they take effect.