Privacy Policy

This Privacy Policy explains how KamSoft Consultants Ltd handles personal data in connection with SynaMark (the SynaMark Outlook add-in and the SynaMark administration portal) and this website, https://synamark.kamsoft.tech.

Who we are

SynaMark is provided by KamSoft Consultants Ltd, a private limited company registered in England and Wales under company number 16636807, with its registered address at 70 Water Lane, Ilford, IG3 9HT, United Kingdom ("we", "us").

For privacy questions or to exercise your rights, contact privacy@kamsoft.tech.

The short version: your data stays in your tenant

SynaMark is tenant-resident. It runs inside your organisation's own Microsoft 365 environment:

• Your settings, signature templates, brand colours, logos, banner images and campaigns are created by your administrators and stored in a SharePoint site in your own Microsoft 365 tenant.
• Your users' directory details (name, job title, phone numbers and similar) are read live from your own Microsoft Entra ID at the moment a signature is inserted. They are not copied anywhere.
• The signature is assembled inside the user's Outlook and cached in the user's own mailbox (Outlook add-in roaming settings).
• Audit history is kept by SharePoint version history and your Microsoft 365 audit log.

The SynaMark add-in and portal talk only to Microsoft (graph.microsoft.com and login.microsoftonline.com), and enforce this with a browser Content Security Policy. None of this data is sent to us, and we cannot access it. KamSoft Consultants Ltd supplies the software and does not operate it on your data, so for this data we are neither a controller nor a processor. Your organisation remains the controller, and Microsoft processes it under your agreement with Microsoft.

How SynaMark uses Microsoft Graph

SynaMark uses delegated Microsoft Graph permissions only. It acts as the signed-in user, sees only what that user is allowed to see, and has no access when nobody is signed in:

Permission	Used for
User.Read	Signing in, and reading the signed-in user's own profile to build their signature
GroupMember.Read.All	Working out which of your signature rules apply, based on group membership
Sites.Selected	Reading (users) and editing (administrators) the SynaMark SharePoint site in your tenant, and no other site
User.Read.All	Administrators only: previewing a signature as another user and choosing users in rules

SynaMark requests no access to mailboxes, message content, calendars, files outside its own site, chats or Teams. The add-in inserts a signature into the message being written; it does not read the message. Data obtained through Microsoft Graph is used only to provide SynaMark inside your tenant: it is never sent to us, never sold, never used for advertising and never used to train artificial intelligence models.

Information we do process

As controller, we process only the following:

Category	Source	Purpose	Legal basis (UK/EU GDPR)
Subscription and billing records: purchaser name and email, organisation, Microsoft tenant identifier, plan, quantity, subscription identifiers	Microsoft Marketplace, when you buy or change a subscription	Activating and managing your subscription	Contract; legal obligation (tax and accounting records)
Support correspondence and anything you choose to include in it	You	Answering your request	Contract; legitimate interests
Enquiries sent to us by email	You	Responding to you	Legitimate interests; steps at your request before a contract
Website server logs (IP address, user agent, requested page, time), kept by our hosting provider	Your browser	Security and abuse prevention	Legitimate interests

Please don't send us exports of your directory or signature data in support requests. We will never ask for them.

Diagnostics. SynaMark sends no telemetry to us. If your administrators enable diagnostics, they are sent to an Application Insights resource in your organisation's own Azure subscription, which you control.

What we do not do

• We do not sell or rent personal data, or share it for cross-context behavioural advertising.
• We do not receive, store or access your signature configuration, images or users' directory data.
• We do not make decisions with legal or similarly significant effects based solely on automated processing.

Sharing and disclosure

We share the limited personal data we hold only with:

• Service providers that host our website, application code and marketplace endpoints, and our email. They are listed on our Sub-processors page.
• Microsoft, as operator of Microsoft Marketplace, for billing and subscription management under Microsoft's own privacy statement.
• Professional advisers and authorities, where required by law or to establish, exercise or defend legal claims.
• A successor in the event of a merger or acquisition, subject to equivalent protections.

International transfers

Our systems are hosted in United Kingdom (UK South). Where personal data we hold is transferred outside the UK or the European Economic Area, we rely on an adequacy decision or on the Standard Contractual Clauses together with the UK International Data Transfer Addendum.

Retention

Data	Retention
Billing and subscription records	As required by tax and company law (typically 6–7 years)
Support and enquiry correspondence	Up to 24 months after the last exchange
Marketplace endpoint logs	90 days
Web server logs	Up to 30 days

Data in your own tenant is retained, and deleted, according to your organisation's Microsoft 365 policies. To remove SynaMark, uninstall the add-in and delete the SynaMark SharePoint site.

Security

We protect the code we ship and the data we hold through a secure development process aligned with the OWASP Application Security Verification Standard and the NIST Secure Software Development Framework. This includes code review, static analysis, dependency and secret scanning, signed releases from an automated pipeline, encryption in transit and at rest, and multi-factor authentication for our staff. See Security.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive it in a portable format, and to withdraw consent. Residents of California and other US states have rights to know, delete and correct personal information and to opt out of its sale or sharing. We do not sell or share it.

To exercise a right over data we hold, email privacy@kamsoft.tech. We will respond within one month, or the period your local law requires. For data held in your organisation's tenant, contact your organisation, which controls it.

You may complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country of residence. We would appreciate the chance to resolve your concern first.

Children

SynaMark is a business service and is not directed at children under 16.

Changes

We will post changes here and update the date below. Where a change materially affects customers, we will notify subscription contacts by email at least 30 days in advance.

Contact

KamSoft Consultants Ltd, 70 Water Lane, Ilford, IG3 9HT, United Kingdom · privacy@kamsoft.tech

Last updated 6 October 2026.