Data Processing Agreement

1. Roles of the parties

For personal data in the Customer's workspace — whether synced from the Customer's Microsoft 365 tenant, imported or entered manually — the Customer is the controller and we are the processor. Where the Customer is a managed service provider ("MSP") acting for its own clients, the Customer may itself be a processor for those clients; we are then a sub-processor, and the Customer warrants that each client has authorised it to connect that client's Microsoft 365 tenant and to engage us under this DPA.

We are a controller, not a processor, for the account data of the people who sign in to AssetSort (their sign-in email, name, photo and security settings). That processing is described in our Privacy Policy.

2. Details of the processing

Subject matter and purpose: providing the AssetSort IT asset-management service — inventorying hardware, licences and certificates, assigning them to people, tracking renewals and lifecycle, raising alerts, producing reports and surfacing Microsoft 365 security posture.

Duration: the term of the Customer's use of the service, plus the retrieval and deletion periods in §10.

Nature of the processing: collecting data from Microsoft Graph on a schedule and on demand; storing, organising and displaying it; computing alerts, metrics and reports from it; sending it by email to the Customer's authorised users and to any shared mailbox the Customer names for alerts; exporting and deleting it on instruction; and, when an authorised user chooses to while offboarding someone, sending Intune's retire command for that person's devices to the Customer's tenant.

Categories of personal data:

• identity and contact: name, email address, user principal name, phone number, job title;
• Microsoft 365 account data: directory object ID, whether the account is enabled, assigned licences, last sign-in time, and when the person left or is leaving;
• security posture: multi-factor authentication registration status and methods, Entra ID Protection risk level and state, and membership of administrator roles as shown in security assessments;
• devices and assignments: device name, serial number, model, primary user, compliance and encryption state, last check-in, and which hardware, licence seats and certificates are assigned to whom;
• Microsoft 365 usage reports, such as Copilot activity per user — retrieved from Microsoft when a report is viewed and not stored by us;
• content the Customer adds: notes, custom fields and uploaded documents, which may contain any data the Customer chooses to include;
• the activity log and alert history: which authorised user made which change, or acted on which alert, and when.

The service is not designed for special categories of personal data (Article 9) or criminal-offence data (Article 10), and the Customer will not put such data into notes, fields or documents.

Data subjects: the Customer's staff, contractors and authorised users and, for MSP Customers, those of the MSP's clients.

3. Processing on instructions

We process Customer personal data only on the Customer's documented instructions — the Terms of Service, this DPA, and the Customer's use and configuration of the service — including with regard to transfers to a third country, unless UK, EU or Member State law requires otherwise; in that case we will inform the Customer before processing unless that law prohibits it. We will tell the Customer immediately if, in our opinion, an instruction infringes data protection law.

The Customer is responsible for having a lawful basis for the processing, for informing its staff and other data subjects about it (Articles 13 and 14), and for any data protection impact assessment its use of the service requires — for example, if it uses sign-in, risk or usage data to monitor its staff.

4. Confidentiality

Everyone we authorise to process Customer personal data is bound by contractual or statutory obligations of confidentiality, and accesses it only as needed to run, secure and support the service.

5. Security

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, we implement the technical and organisational measures in the Annex below (Article 32).

6. Sub-processors

The Customer gives a general written authorisation for the sub-processors listed at assetsort.com/legal/subprocessors. We will email the owner of each Customer organisation at least 30 days before adding or replacing a sub-processor. Within that time the Customer may object on reasonable data-protection grounds; if we cannot resolve the objection, the Customer may end the affected subscription and receive a refund of fees prepaid for the period after the change. We impose on each sub-processor, by contract, data-protection obligations equivalent to those in this DPA, and remain fully liable to the Customer for their performance.

7. Assistance with data subject rights

The service lets the Customer meet most requests itself: its administrators can view, correct and delete people's records, and its owner can export them and set former people to be deleted automatically a chosen number of months after they left, once they hold nothing and are no longer in Microsoft 365. Where that is not enough, we will help the Customer respond to requests for access, rectification, erasure, restriction, portability and objection. If a data subject contacts us directly about Customer data, we will pass the request to the Customer and not answer it ourselves unless the Customer asks us to.

8. Assistance with security, impact assessments and consultation

Taking into account the nature of the processing and the information available to us, we will assist the Customer in meeting its obligations under Articles 32 to 36 — security, breach notification, data protection impact assessments and prior consultation with a supervisory authority — including by providing the information in this DPA and its Annex, and answering reasonable questions about the service.

9. Personal data breaches

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, by email to the organisation's owner and administrators. The notice will describe, as far as we then know, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, and will give a contact point. Where we cannot give all of this at once, we will provide it in phases without further undue delay.

10. Return and deletion of data

Return. The Customer can export its data at any time, as described on our data portability page.

Deletion. When the Customer closes an organisation, it is archived for 30 days — read-only and still exportable — and then permanently deleted, or sooner if the Customer chooses. If the Terms end for another reason, we keep the organisation retrievable for the transitional and retrieval periods in §12 of the Terms and then delete it. Deletion removes the organisation's database records and stored files, unless UK, EU or Member State law requires us to keep them.

Backups and copies that expire on their own. Deleted data remains in database point-in-time backups for 7 days; deleted files remain in versioned and soft-deleted storage for up to 120 days; application logs, which can contain user IDs and email addresses, are kept for 90 days, storage access logs for up to 13 months, and error reports for up to 90 days; and our email provider keeps delivery records of sent emails for its own retention period. Each is permanently erased when its period ends.

What we keep. A deletion record — the organisation's name, who deleted it, when, and how many records were removed — is kept as evidence that the deletion happened.

11. Information and audits

We make available all information necessary to demonstrate compliance with Article 28 and, no more than once per year and on at least 30 days' written notice (or sooner after a personal data breach or where a supervisory authority requires it), allow for and contribute to audits and inspections by the Customer or an auditor it mandates, at the Customer's expense and subject to reasonable confidentiality and scope constraints.

12. International transfers

We are established in Poland, and the service's application, files, database and logs are hosted in London, United Kingdom. Transfers of EEA data to the UK are covered by the European Commission's adequacy decision for the United Kingdom, and the UK recognises the EEA as adequate for UK data reaching us in Poland. Some sub-processors process data outside the UK and EEA — in particular, email delivery by Resend in the United States — and each such transfer is protected by the EU–US Data Privacy Framework and its UK Extension, as listed on the sub-processor page. We will not otherwise transfer Customer personal data outside the UK or EEA without a safeguard that data protection law recognises.

13. Precedence and liability

If this DPA and the Terms of Service conflict on the processing of personal data, this DPA prevails. Each party's liability under this DPA is subject to the limitations of liability in §15 of the Terms of Service, to the extent data protection law permits.

Annex — technical and organisational measures

• Encryption: TLS for all traffic to the service and to its database; data encrypted at rest by our hosting and database providers.
• Tenant isolation: every request for organisation data is authenticated and authorised on the server for the organisation it targets; MSP technicians and read-only staff see only the clients they are assigned to.
• Access control: role-based permissions inside each organisation, including read-only seats; optional two-step verification for password sign-in (Microsoft sign-in follows the customer's own Microsoft multi-factor policy); open sessions are signed out after an hour of inactivity.
• Microsoft 365 access: application credentials are held in Google Secret Manager, never in the database; we never receive users' Microsoft passwords.
• File storage: public access is blocked at the bucket level; files are reached only through short-lived signed links; versioning and soft delete protect against accidental or malicious deletion.
• Abuse protection: rate limiting on sign-in, public forms and the API.
• Logging: an activity log of changes in each organisation; cloud audit logs of administrative and storage access, kept for 13 months.
• Resilience: managed infrastructure with database point-in-time recovery.
• Deletion: automated jobs carry out scheduled organisation, account and former-person deletions, and record each one.
• People: access to production systems is limited to authorised staff who need it, all bound by confidentiality.

Contact Us

Questions about this DPA, or requests for a signed copy: support@assetsort.com.