Privacy Policy

Last updated: 2026-09-18

This Privacy Policy describes how CtrlConnect B.V. (“CtrlConnect”, “We”, “Us”, or “Our”) collects, uses, retains, discloses, and protects information about individuals when they use Our Service. By using the Service, You acknowledge that You have read and understood this Policy.

Interpretation and Definitions

Interpretation

Words whose initial letter is capitalized have the meanings defined below. The same definitions apply regardless of whether the words appear in the singular or in plural form.

References to “include” and “including” mean “include without limitation” and “including without limitation”, respectively. References to “days” mean calendar days unless expressly stated otherwise.

Definitions

For the purposes of this Privacy Policy:

  • Account means a unique workspace created for the Customer to access and use the Service.
  • Applicable Data Protection Law means all laws and regulations applicable to the processing of Personal Data under these Terms, including the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act, as amended or replaced.
  • Company (referred to as “the Company”, “We”, “Us” or “Our”) refers to CtrlConnect B.V., a private limited company incorporated under the laws of the Netherlands, with its registered office in Amsterdam, the Netherlands.
  • Cookies are small files placed on Your Device by a website, containing details of Your browsing history on that website among many other uses.
  • Customer means the organization that has entered into a subscription agreement with the Company for use of the Service.
  • Data Processing Addendum or DPA means the data processing addendum entered into between the Company and the Customer, which is incorporated into and forms part of the Terms.
  • Device means any device that can access the Service, such as a computer, mobile phone, or tablet.
  • Personal Data means any information relating to an identified or identifiable natural person, as defined under Applicable Data Protection Law.
  • Service refers to the CtrlConnect platform, including its web application, APIs, dashboards, and any related documentation provided by the Company.
  • Sub-Processor means any third party engaged by the Company to process Customer Personal Data on behalf of the Customer.
  • Tenant Data means Microsoft 365 directory, identity, security, compliance, license, mailbox, SharePoint, OneDrive, Teams, and audit log data made available to the Service through the Customer-initiated OAuth consent flow.
  • Usage Data means data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
  • Website refers to ctrlconnect.io and any subdomain operated by the Company.
  • You (and “Your”) means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Scope of this Policy

This Privacy Policy applies to information that the Company collects when You (a) visit the Website, (b) register for or use the Service, (c) communicate with Us by email, web form, or other channels, or (d) interact with Us as a customer, prospect, partner, vendor, or job candidate.

This Privacy Policy does not apply to information collected by third parties, including Microsoft or other Third-Party Services, even where such information is accessed through the Service. We encourage You to review the privacy policies of any third parties that You interact with.

Where the Company processes Personal Data on behalf of a Customer in the course of providing the Service, the terms of the Data Processing Addendum prevail over this Privacy Policy to the extent of any conflict.

Data Controller and Processor Roles

For most Tenant Data, the Company acts as a data processor on behalf of the Customer (the data controller). The Customer determines the purposes and means of processing that Tenant Data. When You use the Service on behalf of an organization, that organization is the data controller for any Personal Data contained in Tenant Data.

For account-level information about administrators (such as name, email, and login records) and for any Personal Data You submit directly to Us (for example, via a support request, marketing subscription, or job application), the Company acts as the data controller and determines the purposes and means of processing.

Where We act as data controller, We will comply with all obligations imposed on controllers under Applicable Data Protection Law. Where We act as data processor, We will process Personal Data only on documented instructions from the Customer, including with regard to transfers of Personal Data, and will assist the Customer in fulfilling its obligations as a controller.

Data Processing Addendum

The Data Processing Addendum forms an integral part of the Terms and applies whenever the Company processes Personal Data on behalf of a Customer. The DPA includes:

  • The subject matter, duration, nature, and purpose of the processing.
  • The categories of Personal Data and categories of data subjects.
  • The Company’s obligations as a data processor, including obligations to process Personal Data only on documented instructions, to ensure confidentiality, to implement appropriate technical and organizational measures, and to assist the Customer in ensuring compliance with its obligations under Applicable Data Protection Law.
  • Standard Contractual Clauses for the transfer of Personal Data to third countries, where required.
  • Notification procedures for security incidents affecting Personal Data.
  • Procedures for handling data subject requests.

The current version of the Data Processing Addendum is available on request at dpa@ctrlconnect.nl.

Sub-Processors

The Company engages Sub-Processors to provide infrastructure, hosting, communications, payment, and other services that support the delivery of the Service. We engage Sub-Processors only after a diligence assessment and on terms that are no less protective than those set out in our Data Processing Addendum.

A current list of Sub-Processors, including their locations and the services they provide, is maintained at the URL below and is updated at least thirty (30) days before any new Sub-Processor is authorized to process Customer Personal Data. Customers may subscribe to change notifications by emailing privacy@ctrlconnect.nl.

Customers may object to a new Sub-Processor on reasonable grounds related to data protection by notifying Us within thirty (30) days of receiving notice. If the objection cannot be resolved, the Customer may terminate the affected subscription without penalty.

Information We Collect

Account and administrator data

When an administrator registers a workspace, We collect the administrator’s name, work email address, role, organization, and authentication credentials. We also retain OAuth tokens issued by Microsoft, which We store encrypted at rest and use solely to call the Microsoft Graph API on the Customer’s behalf and to refresh access.

Tenant Data

Once a Customer completes the OAuth consent flow, the Service retrieves Microsoft Entra ID, Azure AD activity, audit log, license, mailbox metadata, SharePoint, OneDrive, and Teams information needed to power each feature. The Service operates read-only by default: We never modify Customer data without an explicit, scoped administrative action.

Tenant Data may include the Personal Data of the Customer’s end users (for example, employee identifiers, sign-in events, and license assignments). The Customer is the controller of that Personal Data, and the Company processes it only on the Customer’s instructions.

Usage Data

We automatically collect limited diagnostic and telemetry data when You use the Service, including IP address, browser type and version, device type, operating system, referring URLs, pages visited, time spent on pages, and timestamps of API requests. We use this data to operate, secure, and improve the Service.

Support communications

When You contact Us for support or other inquiries, We collect the information You provide, including Your name, email address, organization, and the contents of Your message. We may also record the metadata of support interactions for quality and training purposes.

Marketing communications

If You subscribe to Our newsletter or marketing communications, We collect Your name, email address, organization, and any preferences You indicate. You may unsubscribe at any time by following the link in any marketing email or by contacting privacy@ctrlconnect.nl.

Payment data

When You make a payment, payment card data is collected and processed by Our third-party payment processor. We do not store full payment card numbers on Our systems. We retain only the information necessary to issue invoices, manage subscriptions, and comply with tax and accounting obligations.

Recruitment data

If You apply for a job with Us, We collect the information You provide as part of Your application, including Your CV, cover letter, references, and any work samples. We use this information solely for recruitment purposes and retain it only for as long as necessary or as required by law.

How We Use Your Information

We use Personal Data for the following purposes:

  • Providing the Service. To operate, maintain, secure, and improve the Service, to authenticate administrators, to retrieve Tenant Data via the Microsoft Graph API, and to present that data through dashboards, reports, and alerts.
  • Customer support. To respond to support requests, troubleshoot issues, and provide training and onboarding assistance.
  • Communications. To send administrative messages about the Service (such as security notices, billing updates, and changes to the Terms or this Policy) and, where You have opted in, marketing communications.
  • Security and fraud prevention. To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
  • Legal compliance. To comply with applicable laws, regulations, and valid legal process, and to enforce Our Terms.
  • Service improvement. To analyze usage trends, perform benchmarking, and develop new features. Where Personal Data is used for these purposes, it is either aggregated and anonymized or processed only on documented instructions from the Customer.

We do not use Tenant Data to train machine-learning models, to build advertising profiles, or to sell the Personal Data of end users to third parties.

Cookies and Similar Technologies

We use Cookies and similar technologies (such as local storage and pixels) to operate the Website and the Service. We classify the Cookies We use as follows:

  • Strictly necessary Cookies. Required for the Website or Service to function, for example to authenticate Your session and to remember security preferences. These Cookies do not require consent under Applicable Data Protection Law.
  • Functional Cookies. Allow the Website or Service to remember choices You have made (such as Your preferred language or theme) and to provide enhanced, more personalized features.
  • Analytics Cookies. Help Us understand how visitors interact with the Website by collecting information in an aggregated and anonymized form. We use this information to improve the Website and the Service.

We do not use advertising Cookies and We do not permit third parties to set advertising Cookies through the Website or the Service.

Where consent is required (for example, in the European Economic Area, the United Kingdom, or Switzerland), We will request it before setting non-essential Cookies. You can change Your Cookie preferences at any time through Our Cookie banner or by contacting privacy@ctrlconnect.nl.

Legal Basis for Processing

Where the General Data Protection Regulation (GDPR) applies, We rely on the following legal bases for processing Personal Data:

  • Performance of a contract. We process Personal Data to provide the Service to the Customer and its administrators, to manage subscriptions and billing, and to respond to support requests. This includes processing of Tenant Data on the documented instructions of the Customer.
  • Legitimate interests. We process Usage Data and limited account information to secure and improve the Service, prevent abuse and fraud, perform analytics, and respond to support requests. We balance these interests against Your rights and freedoms, and You have the right to object as described below.
  • Consent. We process Personal Data for marketing communications and for setting non-essential Cookies where You have given consent. You may withdraw Your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
  • Legal obligation. We process Personal Data to comply with applicable laws and respond to lawful requests from competent authorities.
  • Vital interests. In rare circumstances, We may process Personal Data to protect the vital interests of an individual.

Where We rely on legitimate interests, You can request more information about the balancing test We performed by contacting privacy@ctrlconnect.nl.

Sharing and Disclosure

We do not sell Personal Data. We share Personal Data only in the following circumstances:

  • With the Customer. Tenant Data and related information are made available to the administrators of the Customer’s Account.
  • With service providers and Sub-Processors. Vetted vendors that help Us host the Service, send email, monitor reliability, process payments, and provide customer support. Each provider is bound by a data processing agreement.
  • With Microsoft. To call the Microsoft Graph API on the Customer’s behalf, solely to deliver the Service.
  • For legal reasons. When We believe in good faith that disclosure is necessary to comply with a law, regulation, court order, or valid legal process; to enforce Our Terms; or to protect the rights, property, or safety of the Company, Our customers, or others.
  • Corporate transactions. In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of Our business, in which case We will notify You before Your Personal Data is transferred and becomes subject to a different privacy policy.
  • With Your consent. In any other case where You have given Us Your consent to share Personal Data.

We require all third parties that receive Personal Data to respect its security and to process it in accordance with the law. We do not allow Our third-party service providers to use Personal Data for their own purposes.

International Data Transfers

Personal Data is primarily processed within the European Economic Area. Where Personal Data is transferred to, or processed in, a country outside the EEA, the United Kingdom, or Switzerland that has not been recognized by the European Commission (or applicable authority) as providing an adequate level of data protection, We rely on appropriate safeguards to protect Your Personal Data.

These safeguards may include:

  • The European Commission’s Standard Contractual Clauses (Decision 2021/914), including any UK Addendum where applicable.
  • The EU–U.S. Data Privacy Framework, the UK Extension, and the Swiss–U.S. Data Privacy Framework, where recipients are certified.
  • Binding corporate rules, codes of conduct, or certifications approved by the competent supervisory authority.
  • Derogations under Article 49 of the GDPR, including explicit consent or contractual necessity.

Where required, We conduct transfer impact assessments to verify that the recipient can provide a level of protection essentially equivalent to that guaranteed within the EEA. You can request a copy of the relevant safeguards by contacting privacy@ctrlconnect.nl.

Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes for which We collected it, including to satisfy any legal, accounting, or reporting requirements.

  • Tenant Data. Retained for the duration of the subscription. By default, audit log and activity records are retained for up to twelve (12) months. Customers may configure shorter retention windows in line with the available product settings.
  • Account and billing data. Retained for the duration of the subscription and for up to seven (7) years thereafter to comply with tax and accounting obligations.
  • Support communications. Retained for up to three (3) years after the last interaction, unless longer retention is required for legal reasons.
  • Marketing communications. Retained until You unsubscribe, after which We retain only the minimum information necessary to honor Your opt-out.
  • Recruitment data. Retained for the duration of the recruitment process and, if unsuccessful, for up to twelve (12) months thereafter unless You ask Us to delete it earlier.

When an Account is terminated, We delete or anonymize Personal Data within thirty (30) days, except where retention is required to comply with legal obligations or to resolve disputes. Anonymized information that can no longer be associated with an individual may be retained indefinitely.

Security Measures

The security of Your data is important to Us. We have implemented appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage, including where appropriate:

  • Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest using industry-standard algorithms.
  • Strong access controls, including least-privilege role-based access, mandatory multi-factor authentication for production access, and just-in-time access requests.
  • Network segmentation, intrusion detection, and continuous monitoring of production systems.
  • Comprehensive logging and auditing of access to Customer Content.
  • Regular vulnerability scanning and independent third-party penetration testing.
  • Background checks on personnel with access to production systems.
  • Documented incident response plans and tested recovery procedures.
  • Security awareness training for all personnel.

Where We engage Sub-Processors, We require them to implement comparable technical and organizational measures.

No method of transmission over the Internet, however, is 100% secure, and We cannot guarantee absolute security. Where Personal Data is processed on behalf of the Customer, the Company will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting that Personal Data, and will provide reasonable cooperation and assistance in connection with the Customer’s investigation and remediation efforts.

Automated Decision-Making and Profiling

The Service is read-only. It does not make automated decisions that produce legal or similarly significant effects on individuals. Where the Service surfaces signals or recommendations (such as “inactive mailboxes” or “license waste”), these are presented to administrators for review; the Service does not act on them automatically.

We do not use Personal Data for profiling in the sense of Article 22 of the GDPR. If We ever introduce features that involve automated decision-making or profiling with legal or similarly significant effects, We will update this Policy and, where required, provide additional information and obtain consent.

Your Rights and Choices

Subject to Applicable Data Protection Law, You have the following rights in relation to Personal Data We process about You:

  • Right of access. The right to request a copy of the Personal Data We hold about You.
  • Right to rectification. The right to have inaccurate or incomplete Personal Data corrected.
  • Right to erasure (right to be forgotten). The right to have Your Personal Data deleted in certain circumstances.
  • Right to restriction of processing. The right to limit how We process Your Personal Data in certain circumstances.
  • Right to data portability. The right to receive Personal Data You have provided to Us in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
  • Right to object. The right to object to processing based on legitimate interests, including profiling, and to object to processing for direct marketing purposes.
  • Right to withdraw consent. Where We rely on Your consent, the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
  • Right to lodge a complaint. The right to lodge a complaint with a supervisory authority, in particular in the Member State of Your habitual residence, place of work, or place of the alleged infringement.

For Tenant Data and any other Personal Data that the Customer controls, the easiest way to exercise these rights is to contact the administrator of Your organization. The Customer is responsible for responding to requests from its end users and may direct those requests to Us for fulfillment.

For Personal Data that the Company controls directly (for example, Your administrator account information or marketing subscription), please contact Us at privacy@ctrlconnect.nl. We will respond to Your request without undue delay, and in any event within one (1) month of receipt of the request, in accordance with Applicable Data Protection Law. That period may be extended by two further months where necessary, taking into account the complexity and number of requests.

Do Not Track Signals

Some web browsers offer a “Do Not Track” (DNT) feature. Because no industry standard for DNT has been adopted, the Company does not currently respond to DNT signals. We do, however, honor cookie preferences set through Our Cookie banner and Your browser settings, which allow You to opt out of non-essential Cookies.

Third-Party Links and Services

The Website and the Service may contain links to third-party websites or services that are not owned or controlled by the Company. This Privacy Policy does not apply to such third-party websites or services. We encourage You to read the privacy policies of every website and service that collects Your Personal Data.

Children's Privacy

The Service is intended for use by businesses and is not directed to anyone under the age of 16 (or such higher age as may be required under applicable law). We do not knowingly collect Personal Data from anyone under that age. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us so that We may take steps to delete such information.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in Our practices, the Service, or applicable law. We will post the revised policy on this page and update the “Last updated” date at the top.

For material changes, We will notify administrators of active Accounts by email or through an in-product notice at least thirty (30) days before the change takes effect. Where the change affects processing activities for which We rely on consent, We will re-request consent where required.

Your continued use of the Service after the effective date of the revised Privacy Policy constitutes Your acceptance of the changes. If You do not agree to the changes, You may stop using the Service and request deletion of Your Personal Data.

Contact

If You have any questions about this Privacy Policy or about how We handle Your Personal Data, please contact Our Data Protection Officer:

If You are dissatisfied with Our response, You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in the jurisdiction where You live or work.