Privacy Policy

1. Information we collect

We collect information you provide directly, including:

• Contact and access-request form submissions (name, company, email, role, message)
• Account credentials (username, password — stored as a salted Argon2 hash)
• Cargo records and operational data entered by platform users
• File attachments uploaded through the platform (e.g. pre-alert documents)

We also collect standard server logs (IP address, browser type, pages visited, timestamps) for security monitoring and performance purposes.

2. How we use your information

• To respond to access requests and onboard new customers
• To provide and maintain the RRMS platform
• To send service notifications (e.g. ULD overdue alerts, cleaning check emails)
• To ensure platform security and prevent fraud
• To comply with legal and regulatory obligations

We do not sell your personal data to third parties.

3. Data storage and security

Platform data is stored in a managed PostgreSQL database hosted on Render (render.com) in the EU (Frankfurt, Germany); uploaded files, encrypted backups and the audit archive are stored in Amazon S3 in the EU (Stockholm, Sweden). We use HTTPS (TLS 1.2 or higher) for all data in transit. Passwords are never stored in plain text — they are hashed using Argon2. Authentication tokens are short-lived JWTs (15-minute access tokens, 1-day refresh tokens stored only as keyed hashes).

For more information about our security practices, see our Security page.

4. Data retention

We retain account and operational data for the duration of the customer's contract plus a 90-day post-termination window (after a free trial or pilot: until its 45-day export window ends), then delete or anonymise it. Audit and security logs are kept for 60 months for security, integrity and the defence of legal claims, with a daily copy held in immutable storage for five years. You may request deletion of your data at any time by contacting us at admin@rrmsgroup.com.

5. Third-party services

• Render — cloud hosting and managed database (EU, Frankfurt)
• Amazon Web Services (Amazon S3) — files, encrypted backups and the audit archive (EU, Stockholm)
• Google Workspace (Gmail) — system email such as invitations and sign-in codes
• Sentry — error monitoring (EU data region)
• Cloudflare — web-application firewall and network edge
• VirusTotal — optional malware check of uploaded files using file fingerprints (hashes) only; file contents are never sent
• Vercel — marketing website hosting

The platform's providers are bound by data-processing agreements; several are headquartered in the United States, and any transfer outside the EEA relies on an appropriate GDPR Chapter V safeguard (the EU-US Data Privacy Framework and/or the Standard Contractual Clauses).

6. Your rights

If you are located in the European Economic Area (EEA), you have rights under the EU GDPR. For a full explanation of your rights and how to exercise them, see our GDPR page.

7. Cookies

The marketing website (rrmsgroup.com) does not use tracking or advertising cookies. The platform application uses session cookies solely to maintain authenticated sessions.

8. Contact

For any privacy-related queries, contact us at admin@rrmsgroup.com.