Privacy policy

1. Who we are

KamSoft Consultants Ltd (“we”, “us”) publishes the DocuSanad software and operates this website at https://docusanad.kamsoft.tech. For the purposes of data protection law we are the controller of the personal information described in section 3.

Registered address: 70 Water Lane, Ilford, IG3 9HT, United Kingdom.
Company number: 16636807.
Data protection contact: privacy@kamsoft.tech.

2. The important distinction: the software and the website

This policy covers two different things, and the difference matters.

2.1 The DocuSanad software

DocuSanad is a SharePoint Framework solution. It is installed into your organisation’s own Microsoft 365 tenant and runs in your users’ browsers, against Microsoft’s own APIs. Your documents, the metadata about them, the approval records and the audit log are all stored in your own SharePoint lists and libraries.

We do not receive, transmit, store, process or have any means of accessing that content. There is no KamSoft Consultants Ltd server in the request path, no database of ours holding your data, and no telemetry pipeline receiving it. In relation to the content you manage with DocuSanad, your organisation is the controller and we are not a processor, because no processing by us takes place.

Three narrow exceptions exist, and each is described in section 5.

2.2 This website

When you visit this website or contact us, we do collect a limited amount of personal information. That is described in section 3.

3. Information we collect

3.1 When you contact us

If you complete the contact form or email us, we collect your name, email address, organisation name if you give one, and the content of your message. We use this only to respond to you and to keep a record of the correspondence.

Our lawful basis is legitimate interests — responding to an enquiry you have chosen to send us — or, where your enquiry relates to a possible purchase, taking steps at your request before entering into a contract.

To prevent abuse of the contact form, our server temporarily records a one-way hash of your IP address together with a count of submissions. This is used solely for rate limiting, cannot be reversed to identify you, and is discarded within one hour.

3.2 When you visit the website

This is a static website. We do not use analytics cookies, advertising cookies, tracking pixels or third-party analytics services, and we do not build profiles of visitors. No cookie banner appears because there are no such cookies to consent to.

Our hosting provider maintains standard server logs, which may include IP addresses, for security and to keep the service running. Those logs are the provider’s and are retained under their own arrangements.

3.3 When you are a customer

If your organisation purchases DocuSanad through Microsoft Marketplace, Microsoft handles the transaction and shares limited information with us as the publisher — typically the purchasing organisation’s name, the plan purchased, the number of seats and an administrative contact. We use this to fulfil the subscription, to provide support, and to meet our own legal and accounting obligations.

Microsoft’s handling of your purchase is governed by Microsoft’s own privacy statement, not this one.

4. What we do not collect

To be explicit, we do not receive or have access to:

• The documents you store or manage with DocuSanad
• Their file names, metadata, classifications or retention settings
• Your approval decisions, comments or audit log
• The names or email addresses of your users, beyond an administrative contact
• Any credentials, keys or secrets you configure in the product

5. Where information leaves your tenant

We describe these precisely rather than making a blanket claim, because a promise like “nothing ever leaves” is only useful if the exceptions are named.

5.1 Licence verification

To determine which features a user is entitled to, DocuSanad asks Microsoft Graph whether the signed-in user holds a licence for the product. This request goes from the user’s browser to Microsoft, not to us, and contains tenant and user identifiers only. It does not contain document content, file names or metadata.

5.2 Notification email

Approval and disposition notifications are sent using Microsoft’s own mail service from within your tenant, to recipients within your tenant. These messages do not pass through any system of ours.

5.3 Optional AI classification

If your administrator enables AI classification, document text is sent to an endpoint that your organisation deploys and controls in your own cloud subscription, using your own credentials. We do not host that endpoint, do not receive the content, and are not party to the transfer. Your relationship for that processing is with your own cloud provider.

This feature is disabled by default and requires deliberate configuration.

6. Sharing and disclosure

We do not sell personal information, and we do not share it for advertising. We share the limited information described in section 3 only with:

• Our hosting and email providers, acting on our instructions
• Microsoft, in connection with marketplace transactions and support
• Professional advisers, or a regulator or law enforcement body where we are legally required to do so

A current list is maintained on our sub-processors page.

7. International transfers

Where information described in section 3 is transferred outside the country in which you are located, we rely on an appropriate safeguard recognised under applicable law, such as an adequacy decision or standard contractual clauses.

The content you manage with DocuSanad is not transferred by us at all — its location is determined entirely by your own Microsoft 365 tenant’s data residency.

8. Retention

Enquiry correspondence is kept for up to 24 months from our last exchange, unless we need it longer to deal with a dispute or to meet a legal obligation. Customer and billing records are kept for the period required by tax and company law. Rate-limit hashes are discarded within one hour.

9. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where we rely on it.

To exercise any of these, email privacy@kamsoft.tech. We will respond within one month.

If your request concerns documents held in your employer’s DocuSanad library, please direct it to that organisation. They control that data; we have no access to it and cannot act on it.

You also have the right to complain to your data protection authority. In the United Kingdom that is the Information Commissioner’s Office; in the European Union it is the supervisory authority for your country.

10. Security

We keep the information described in section 3 on services protected by access controls and encryption in transit. Because we do not hold your document content, the majority of the security surface for DocuSanad is your own Microsoft 365 tenant, governed by the controls you already apply there.

To report a suspected vulnerability, email support@kamsoft.tech.

11. Children

DocuSanad is business software sold to organisations. It is not directed at children and we do not knowingly collect information from anyone under 16.

12. Changes

If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle your information, we will take reasonable steps to tell you.

13. Contact

KamSoft Consultants Ltd
70 Water Lane, Ilford, IG3 9HT
United Kingdom
privacy@kamsoft.tech