Privacy Policy

1. General information

The protection of your personal data is important to us. This privacy policy informs you about how personal data are processed in the course of using the web application “TEAMS DASHBOARD”.

Personal data are all data by which you can be personally identified.

This privacy policy applies exclusively to the service “TEAMS DASHBOARD” and not generally to a company website.

The web app is directed at business customers (B2B).

2. Controller

SSIG-IT GmbH
Zum weißen Jura 3
89143 Blaubeuren
Germany

Phone: +49 7335 163310
Email:

3. Data protection officer

An external data protection officer has been appointed for SSIG-IT GmbH.

You can reach the data protection officer via:

Datenschutz & Informationssicherheit Alb e.K.
Email:
Website: https://www.di-alb.de

4. Description of the service “TEAMS DASHBOARD”

TEAMS DASHBOARD is a web-based application for evaluating, visualizing, and managing information and services related to Microsoft Teams.

The application accesses Microsoft cloud services, in particular Microsoft 365 / Microsoft Teams, to provide its functions.

It is used exclusively by employees, administrators, or other authorized users of customer companies (B2B).

In doing so, TEAMS DASHBOARD processes employee data on behalf of the respective business customer. The business customer is the controller within the meaning of Art. 4(7) GDPR. SSIG-IT GmbH acts as processor pursuant to Art. 28 GDPR on the basis of a data processing agreement.

Dual role: For the display of presence, profile, and photo data from Microsoft Graph, SSIG-IT GmbH acts as processor (Art. 28 GDPR); these data are processed exclusively transiently in the user’s browser and are not stored on servers of SSIG-IT GmbH. For its own contract performance, billing, operational security, and communication (including administrator contact details, invoicing and payment data, sales inquiries, server log files), SSIG-IT GmbH is an independent controller within the meaning of Art. 4(7) GDPR.

5. Processing of personal data

5.1 Which data are processed?

In the course of using TEAMS DASHBOARD, two kinds of personal data are processed:

a) Data from Microsoft Graph (processing on behalf)
These data come from the respective customer’s Microsoft 365 tenant (Entra ID / Microsoft Teams). They are processed exclusively in the signed-in user’s browser (for caching see section 9) and are not stored on servers of SSIG-IT GmbH. They include in particular:

• Name, email address, and user ID
• Job title, department, location/office, and phone numbers
• Presence status and availability information
• Profile photo

b) Data for operation, contract, and customer portal (own responsibility)
These data are provided by the user or arise from use:

• Administrator and contract contact details
• Login and access data (e.g., object ID, name, and email address from the Microsoft sign-in, times)
• Contract, license, and billing data
• Error and log data to ensure technical operation
• Device and connection data (e.g., IP address, browser type, operating system)

5.2 Purpose of the data processing

Processing takes place for the following purposes:

• Provision and operation of the TEAMS DASHBOARD web app
• Authentication and authorization of users
• Ensuring stability, security, and performance
• Error analysis and abuse prevention
• Support and administration purposes

5.3 Legal bases

Personal data are processed on the basis of:

• Art. 6(1)(b) GDPR – performance of a contract: processing is necessary for the provision and use of the service within the existing contractual relationship with the business customer
• Art. 6(1)(f) GDPR – legitimate interest: processing serves the secure, stable, and economical operation of the web app as well as error detection and abuse prevention

Insofar as personal data are processed on behalf of the business customer, this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

5.4 Record of the data processing agreement (DPA)

If the person of a customer company who declares to be authorized concludes the data processing agreement (Art. 28 GDPR) electronically in the customer portal, we record this conclusion as evidence. The data processed are the object ID (oid), the name, and the email address of the accepting person, the Microsoft 365 tenant identifier, the legal name and address of the company as provided by this person, the contract version and the checksum (SHA-256) of the accepted wording, the time of acceptance, and the IP address and browser identifier (user agent) of the access.

The purpose is to evidence the data processing agreement validly concluded in text form (Art. 28(9) GDPR). The legal basis is Art. 6(1)(c) GDPR (compliance with the legal obligation under Art. 28 GDPR) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in a robust, integrity-protected record of the contract). The record is stored integrity-protected and retained until the end of the sixth full calendar year after the definitive end of the contract (retention analogous to Section 257 of the German Commercial Code (HGB) / Section 147 of the German Fiscal Code (AO)); it is then automatically and technically deleted, unless a legal hold (e.g., pending litigation) prevents this.

5.5 Access to the customer portal

An organization’s customer portal is managed by its admins. For this access control we store, for every person who becomes an admin in the customer portal or requests access, the object ID (oid), the name and email address from the Microsoft sign-in, the Microsoft 365 tenant identifier, the status (admin, requested, declined), the times of the request and the decision, and who decided. The other signed-in people of the same organization see the admins’ names and email addresses so they know whom to contact. Admins receive an email for a new request, the requester an email about the decision.

The purpose is to control securely who may manage the organization’s settings, contract, and billing. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure access control). A person’s data are deleted when an admin removes them in the customer portal, and at the latest when the organization is deleted 90 days after the end of the contract (section 12).

5.6 Usage statistics

So that we can see how many people actually use an organization’s dashboard, we derive a pseudonymous value (SHA-256 hash) from the Microsoft 365 tenant identifier and the object ID (oid) of the signed-in person at every license check and store it with the day of last use. Name, email address, and presence data are not stored for this. From this we derive figures per organization and day: dashboard starts, how many of them in Microsoft Teams, and the number of people using it. These daily figures contain no personal data.

The purpose is to evaluate usage for licensing, operation, and further development of the service. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in correct licensing and needs-based development). A person’s pseudonymous value is deleted automatically 31 days after their last use.

6. Recipients of the data

Recipients of personal data are:

• Internal departments of SSIG-IT GmbH (e.g., IT operations, administration, support), insofar as this is necessary to fulfil the stated purposes

Microsoft processes the customer’s data within the contractual relationship between the customer and Microsoft. SSIG-IT GmbH accesses Microsoft services solely on the basis of the permissions granted by the customer.

For technical operation, payment processing, and communication we also use carefully selected service providers as processors pursuant to Art. 28 GDPR, which process personal data exclusively on our instructions:

• Vercel Inc. – hosting and delivery of the web app as well as server log files. Application compute and database: Frankfurt am Main; CDN and static delivery via the global Vercel network. Provider based in the USA (DPF/SCC).
• Supabase Inc. – database hosting (including customer, contact, and inquiry data). Server location Frankfurt am Main (region eu-central-1).
• Stripe Payments Europe, Ltd. (Ireland) – processing of payments in the self-service purchase (including name, email address, billing address); card data are processed exclusively by Stripe
• Resend, Inc. – sending of transactional emails (e.g., onboarding, confirmation, and reminder messages). Provider based in the USA; email delivery takes place via EU infrastructure, but account, log, and metadata may be processed in the USA. The transfer is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or EU standard contractual clauses (Art. 46 GDPR).
• Cloudflare, Inc. – protection of the public forms against automated access (bot protection “Turnstile”). In the process, the requester’s IP address is transmitted to Cloudflare; the IP address is not stored in our database.
• Functional Software, Inc. (Sentry) – error monitoring of the web app, the customer portal, and the servers. Technical error data are transmitted (error message, code location, browser and operating system version, page visited without parameters). Email addresses, IP addresses, and identifiers are removed from the error texts before sending; Sentry does not store the IP address of the connection. Data region EU (Germany). Provider based in the USA; the transfer is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or EU standard contractual clauses (Art. 46 GDPR).

In the public demo mode (/demo), the dashboard shows fictitious people with sample photos from the service randomuser.me. Your browser loads these images directly from there; in the process the provider receives your IP address and browser identifier. Your organization’s dashboard does not load any content from randomuser.me.

Data processing agreements pursuant to Art. 28 GDPR are in place with these service providers. Data are not passed on to other third parties unless there is a legal obligation to do so or you have consented under section 9.3.

Insofar as individual service providers transfer personal data to third countries (in particular the USA), this takes place on the basis of an adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR) or appropriate safeguards pursuant to Art. 46 GDPR, in particular EU standard contractual clauses.

7. Use of Microsoft cloud services

TEAMS DASHBOARD uses cloud services of Microsoft Corporation, in particular:

• Microsoft 365
• Microsoft Teams
• Microsoft Azure

Personal data are processed on Microsoft servers in the process.

The Microsoft services are used by the respective customer on the basis of its own contractual relationship with Microsoft.

Microsoft Corporation is certified under the EU-US Data Privacy Framework (DPF). Personal data are transferred to the USA on the basis of the European Commission’s adequacy decision pursuant to Art. 45 GDPR.

Insofar as individual processing operations are not covered by the Data Privacy Framework, Microsoft additionally relies on appropriate safeguards pursuant to Art. 46 GDPR, in particular EU standard contractual clauses.

8. Server log files

When operating the web app, information is automatically recorded in server log files:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

Storage takes place for security and stability reasons and is based on Art. 6(1)(f) GDPR.

Retention period: according to the periods of our hosting provider, but no longer than six weeks.

9. Cookies, local storage, and reach measurement

9.1 Technically necessary storage

For the operation of the web app, technically necessary storage mechanisms are used (e.g., sign-in status, language and display settings, your choice in the consent notice). These do not require consent (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

The Microsoft sign-in (MSAL) keeps the sign-in tokens exclusively in the browser, not on our servers: in the customer portal in session storage (deleted when the tab is closed), in the dashboard outside Microsoft Teams in local storage. The refresh token (offline_access) is valid there for at most 24 hours and is discarded when the contract ends. Within Microsoft Teams, the Teams client manages the sign-in.

In addition, the application uses technically necessary local caching in the browser (IndexedDB) to cache profile photos and user data. These data are stored exclusively locally in the user’s browser, serve to improve loading times, and are automatically refreshed at the end of the session or upon re-login. These cached data are not transmitted to third parties.

9.2 Reach measurement with Umami (without cookies)

On our web pages including the customer portal (not in the dashboard) we measure usage with Umami. Umami is self-hosted on a server operated by SSIG-IT GmbH in Germany; the data are not transmitted to third parties. Umami sets no cookies and stores no identifier in your browser. It records the page visited (without parameters), the referring page, browser, operating system, device type, screen size, language, and the country derived from the IP address. The IP address itself is not stored; only aggregated figures are evaluated, no profile of individual persons. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data-minimizing reach measurement to improve our offering). If “Do Not Track” is enabled in your browser, no measurement takes place; otherwise you can object to the processing at any time by email (section 13).

9.3 Web analytics and ad conversion measurement (only with consent)

On our public web pages (website, pricing, documentation, blog, trial, and welcome page; not in the customer portal and not in the dashboard) we use the following services only with your consent via the “Privacy settings” notice. As long as you have not consented, they are not loaded. The services store cookies with a pseudonymous identifier in your browser and process in particular your IP address, browser and device information, the pages visited, and your interactions (e.g., clicks). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

• HubSpot (HubSpot, Inc., USA) – analysis of website usage (pages visited, time on page, origin of the visit). The data are stored in HubSpot’s EU data center; access from the United States is possible. Cookie lifetime up to six months.
• Microsoft Clarity (Microsoft Corporation, USA) – analysis of page usage (including click and scroll behavior, heatmaps, and session recordings) to improve the website. Cookie lifetime up to one year.
• Google Ads conversion tracking (Google Ireland Limited, Ireland; parent company Google LLC, USA) – measuring whether a visit via one of our ads leads to a click on “Sign in with Microsoft & buy” or “Request an invoice”. We only see the number of such actions, not who triggered them. Personalized advertising (remarketing) is turned off. Cookie lifetime up to 90 days.

Where data are transferred to the United States, this is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or EU standard contractual clauses (Art. 46 GDPR).

You can withdraw your consent at any time with effect for the future: via “Privacy settings” in the footer you reopen the choice and select “Decline”. The page then removes the scripts and the accessible cookies of these services and reloads. The lawfulness of the processing carried out until withdrawal remains unaffected.

10. SSL/TLS encryption

TEAMS DASHBOARD is used exclusively via an SSL or TLS encrypted connection.

This protects transmitted data against access by third parties.

11. Contact

If you contact us by email or telephone, your details are processed for the purpose of handling your inquiry.

Processing is based on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

The data are deleted as soon as the purpose no longer applies and no statutory retention obligations exist.

12. Retention period

Personal data are generally stored only as long as necessary for the respective processing purposes.

Tenant and configuration data (customer record, settings, branding including logos, and the accesses to the customer portal) are initially kept for 90 days after the end of the contract so that the service can be resumed without setting it up again. After this period they are deleted automatically, unless statutory retention obligations prevent this. The end of the contract is the end of the last paid or agreed service period.

Specific, automatically enforced deletion periods apply to individual data sets: inquiries via the contact form are deleted or anonymized after 180 days at the latest, email logs after 90 days, payment processing event data after 90 days, pseudonymous usage identifiers (section 5.6) 31 days after last use, and the internal administration log after two years. The record of the conclusion of the data processing agreement (section 5.4) is retained until the end of the sixth full calendar year after the definitive end of the contract and is then automatically and technically deleted, unless a legal hold prevents this. The technical and organizational measures implemented are described in our TOM (Art. 32 GDPR).

13. Your rights as a data subject

You have the right at any time to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

Please direct requests to:

14. Withdrawal of consent

Consent given can be withdrawn informally by email at any time; consent under section 9.3 also via “Privacy settings” in the footer.

The lawfulness of the processing carried out until withdrawal remains unaffected.

15. Right to lodge a complaint

You have the right to lodge a complaint about the processing of your personal data with the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).