Privacy policy

1. Information we collect

We collect the following, depending on how a JMA website or product is used:

• Account information: name, work email address, role and a password stored only as a salted hash. With single sign-on, the identifiers returned by the identity provider.
• Organization information: the company name, industry, size, country, time zone and the plan.
• Customer data: files, presentations, connector data and records that members upload or connect to a product, such as programs, activities, owners, dates, blockers, dependencies and risks in ORM, and the results calculated from them. These may name employees and external parties.
• Usage and security information: sign-in times, session identifiers, an audit log of actions, IP address, browser type and error reports.
• Messages: what is sent to us through the website contact form or by email.

2. How the information is used

We use personal information to:

• provide, operate and support our products and services, including calculating health, forecasts and briefings in ORM
• authenticate members, keep sessions secure and detect misuse
• send messages a product needs, such as invitations, password resets and security notices
• reply to enquiries made through the website
• diagnose faults, measure performance and improve our products
• meet legal obligations and enforce our terms

3. Legal basis

Where data protection law requires a basis, we rely on performance of the contract with the company, our legitimate interest in operating and securing our products and answering enquiries, compliance with legal obligations and, where needed, consent. For customer data, the company is the controller and JMA acts as its processor.

4. Automated analysis

Some features send content to a language model provider to read documents or write summaries. Only the content needed for the request is sent, and the provider returns a result. The company can choose not to use these features. Output can be wrong and is intended to support, not replace, human judgment.

5. Who receives information

We do not sell personal information. We share it only with:

• service providers that help us run our websites and products, namely cloud hosting and storage, email delivery and the language model provider named above, each bound to protect the information and use it only for our purposes
• members of the same company account, according to the roles the administrators assign
• authorities or advisers where the law requires it or to protect rights, with notice to the company where we are allowed to give it
• a successor to our business, if it is sold or reorganized, under the same commitments

6. Where information is processed

ORM is hosted on Amazon Web Services in the EU (Frankfurt) region in Germany. The hosting location of any other product is stated in its terms or order. Information may also be processed in the regions where our providers operate, and an Enterprise customer may agree with us to host its workspace in another region. Where information is transferred across borders, we rely on appropriate safeguards, such as standard contractual clauses, where the law requires them.

7. Security

We protect information with encryption in transit, hashed passwords, role-based access, separation of each company's data, session limits, audit logging and regular dependency and security scanning. No system is completely secure. We will tell the affected company without undue delay if we confirm a breach that affects its information.

8. Retention

We keep customer data while the account is active. What ORM finds in a document that a person uploads for review is held for up to one hour, until the review is finished or the hour ends, and is then cleared. The document itself is not kept. When a trial ends and no plan is chosen, we keep the workspace closed and its data for 90 days, write to the administrators during that time, and then delete it. After termination of a paid subscription, administrators can ask us for an export of their data for thirty days, after which we delete it from active systems and from backups as they expire. Audit and security logs are kept for as long as needed for security and legal purposes. Account information and website messages are deleted or anonymized when no longer needed.

9. Cookies and local storage

Our products use cookies and browser storage that are necessary to keep a member signed in, to remember the workspace and to remember simple preferences such as a chosen view. Our websites and products do not use advertising or cross-site tracking cookies.

10. Rights and choices

Subject to the law that applies, individuals may ask to access, correct, delete, export or restrict the use of their personal information, and to object to some uses. For information in a company's account, please contact the company first, because it controls that information. We will help the company respond. You may also contact us directly at contact@jma-consultancy.com, and you may complain to your data protection authority.

11. Children

JMA's products and services are for business use and are not intended for anyone under 16. We do not knowingly collect their information.

12. Changes to this policy

We may update this policy, including to add a new product. For a material change we will notify administrators before it takes effect. The effective date above shows the current version.

13. Contact

JMA Consultancy, contact@jma-consultancy.com.