Who we are
ITMMS Labs is a brand of ITM Marketing & Services Limited, a company registered in England and Wales (number 09057221), 81 Cumberland Street, Flat 2, London SW1V 4NB, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) under number ZA921847.
We are the controller of the personal data described here. For any question about it, or to use your rights, write to privacy@itmmslabs.com.
EU representative (Article 27 GDPR): to be appointed before the services open to users in the EU.
What this notice covers
- this website, itmmslabs.com;
- messages you send to our addresses at itmmslabs.com;
- your ITMMS Labs account: signing in (login.itmmslabs.com), your account page (app.itmmslabs.com) and the sign-in screens of our apps.
Each ITMMS Labs service has its own notice for the data that service handles (for example the content of a business card). When a business gives you access to a service, that business decides how your data is used in it, and we act on its instructions.
What we collect, why, and on what legal basis
Visiting this website
This website sets no cookies and uses no analytics or advertising tools. To deliver the pages and protect them from attacks, our hosting provider processes your IP address and the details of each request (page, time, browser). We don't keep access logs. Legal basis: our legitimate interest in running a secure website.
Writing to us
When you write to an itmmslabs.com address, we receive your address, your name if you give it, and your message. Messages are kept, encrypted, on our servers for up to 30 days and forwarded to our mailbox, where we keep them as long as we need to answer you and to keep a record of requests about personal data. Legal basis: our legitimate interest in answering you, and our legal obligation when you exercise your rights.
Your ITMMS Labs account
- Account details: your e-mail address and, if you add them, your name and profile picture. Your password is handled by our sign-in provider and stored only in a form that can't be read back; we never see it.
- Sign in with Google or Apple: if you choose it, Google or Apple tells us your e-mail address, whether it is verified, your name if you share it, and a fixed identifier for your account with them. Nothing else.
- Security: whether you use an authenticator app, your active sessions (when and how you signed in), and records of security events such as sign-ins, changes to your account and administrator actions. These records don't contain the content of your data.
- Consents: which version of our terms and of this notice you accepted, when, and the first part of your IP address (the last part is never stored), and that you confirmed you are at least 16. We don't store your age or date of birth.
- Access to services: which services, licences and roles you have, and the organisation that gave them to you.
Legal bases: the contract between us (to provide your account and the services you use), our legal obligations (records, tax, requests about your data), and our legitimate interest in keeping accounts and services secure.
We don't sell your data, we don't use it for advertising and we don't make decisions about you by automated means that have legal or similarly significant effects.
Who processes your data for us
- Amazon Web Services hosts our services and stores our data in the EU (Ireland). Its content delivery network delivers pages from locations near you. AWS also provides our sign-in service and e-mail.
- Google and Apple, only if you choose to sign in with them. For their part of the sign-in they are separate controllers, under their own privacy notices.
- A payment provider, when a service starts taking payments; this notice will name it first.
We may also disclose data when the law requires it.
Where your data is stored
Your account data is stored in the EU (Ireland). The UK recognises the EU as providing adequate protection, and the EU recognises the UK. When a provider handles data outside the UK and the EU, it does so under the safeguards the law requires, such as the standard contractual clauses.
How long we keep it
- Your account: until you delete it. If you don't use it for 24 months we warn you, and after 36 months we delete it.
- When you delete your account, there is a 7-day cooling-off period, then the deletion is completed within one month of your request.
- Security records: 2 years. Where the law requires us to keep a record longer (for example invoices, 6 years), we keep it without the data that identifies you, where possible.
- Technical logs: 90 days. They are designed not to contain personal data.
- Copies of your data that you ask for: available to download for 7 days.
- Messages received at our addresses: 30 days on our servers.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to its use, and receive it in a machine-readable format. You can withdraw a consent at any time. How to use your rights.
You can also complain to the ICO (ico.org.uk) or, if you live in the EU, to the data protection authority of your country (in Italy, the Garante per la protezione dei dati personali). We'd appreciate the chance to sort it out first.
Age
Our services are for people aged 16 or over.
Security
We encrypt data in transit and at rest, keep keys in a dedicated key service, limit who and what can access each piece of data, and keep tamper-proof security records.
Changes
When we change this notice we publish the new version here with its date. If the change matters for your account, we ask you to read and accept it the next time you sign in.