Data Processing Agreement

1. Purpose and parties

This agreement forms part of the Terms of Service between the customer (the organisation that created the account, the Customer) and PB Technologies Ltd, 4 Rothwell Avenue, Rosedale, Auckland 0632, New Zealand (PB Tech). PB Tech processes personal information for the Customer when providing PB Tech Licence Intelligence. For that processing the Customer is the party responsible for the information (the controller, or in New Zealand terms the agency that holds it, which engages PB Tech as its agent under section 11 of the Privacy Act 2020) and PB Tech is the processor. Where the Customer is in Australia, PB Tech acts as its service provider under the Privacy Act 1988. Where the General Data Protection Regulation or similar laws apply to the Customer, the terms here are intended to meet the requirements for a processing agreement.

2. What is processed

• Subject matter and purpose: reading the Customer's licence and user information from its Microsoft 365 tenants, analysing it, and showing, exporting and notifying about it to the Customer's members.
• Duration: while the Customer's account exists, and until deletion under section 8.
• People: the Customer's employees, contractors and other people who hold a Microsoft 365 licence in a connected tenant, and the Customer's own members who use the service.
• Information: name, user principal name, department, company name, usage location, account creation date, account status, assigned licences, last sign-in and activity dates, and, for the Customer's members, work email address, role and audit entries. See Annex A.
• No sensitive information is sought, and the connector has no permission to read the content of mail, files or chats.

3. PB Tech's commitments

1. Process the information only on the Customer's documented instructions, which are these terms, the Customer's use of the service's settings, and any reasonable written instruction that is consistent with the service. Tell the Customer if an instruction appears to break the law.
2. Make sure everyone with access is bound to confidentiality. PB Tech staff cannot see the information unless the Customer grants support access.
3. Apply the security measures in Annex B.
4. Use only the sub-processors in Annex C, and follow section 5 before adding or replacing one.
5. Not sell the information, use it for PB Tech's own purposes other than operating and securing the service, or use it to train any model.
6. Help the Customer, as far as reasonably possible and at no extra charge for reasonable requests, to respond to requests from people to access or correct their information, and with privacy impact assessments and regulator enquiries.

4. The Customer's commitments

The Customer confirms it has the authority to connect each tenant, that it has a lawful basis and has given any notice required to its people for this processing, and that its instructions comply with the law.

5. Sub-processors

The Customer authorises the sub-processors in Annex C. PB Tech will give the Customer at least 30 days notice by email to its owners before adding or replacing one. The Customer may object on reasonable grounds within that time, and if the matter is not resolved may close its organisation without penalty. PB Tech remains responsible for its sub-processors and binds them to terms no less protective than these.

6. International transfers

The information is held in Microsoft Azure in New Zealand North. Email is processed in Australia by Azure Communication Services. PB Tech's Ask feature runs on PB Tech's own hardware.PB Tech will not move the information to another country without telling the Customer and, where the law requires, putting suitable safeguards in place.

7. Breaches

PB Tech will tell the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach of security that has led to unauthorised access to, or loss or disclosure of, the information. The notice will say what happened, what information and how many people are involved, what PB Tech is doing, and a contact. PB Tech will help the Customer decide whether the breach is notifiable to the Office of the Privacy Commissioner (privacy breach notification under Part 6 of the Privacy Act 2020), the Office of the Australian Information Commissioner (Notifiable Data Breaches scheme) or other regulators, and the people affected. The Customer is responsible for deciding to notify as the party that holds the information, unless the law requires PB Tech to notify as well.

8. Return and deletion

The Customer can download its data at any time. PB Tech deletes a tenant's information 30 days after the tenant is disconnected and all of the organisation's information 30 days after it is closed, and deletes Ask conversations after 30 days. PB Tech keeps invoices and billing profiles for 7 years because the law requires tax records, and keeps audit log entries with their details removed. Backups roll off within 35 days of deletion. PB Tech will confirm deletion in writing if asked.

9. Audit

PB Tech will give the Customer the information it reasonably needs to check compliance with this agreement, including its answers to a security questionnaire and a summary of its latest independent security test. If that is not enough the Customer may, with 30 days notice, no more than once a year and subject to confidentiality, audit PB Tech's relevant records during business hours, at the Customer's cost.

10. Liability and law

The limits on liability in the Terms of Service apply to this agreement. New Zealand law governs it. If the Terms and this agreement conflict about the processing of personal information, this agreement prevails.

Annex A: details of processing

• Nature: collection by read-only Microsoft Graph calls, storage, analysis, display, export, notification and, if asked, an answer from Ask.
• Categories of information: identifiers (name, user principal name), employment information (department, company name), location (usage location country), account and licence status, activity dates, and for members, contact details and activity in the service.
• Frequency: daily reads per tenant, and on request.

Annex B: security measures

• Encryption at rest with a customer-managed key controlled by PB Tech, and TLS 1.2 or higher in transit.
• Separation of every organisation's data by database row-level security, with no shared administrative path from the application.
• Read-only application permissions on the Customer's tenant, authenticated with a certificate. No tokens or secrets from the tenant are stored.
• Microsoft work account sign-in, multi-factor checks, role-based access and session expiry.
• Audit logging of privileged actions and security failures, without credentials or personal content in logs.
• Support access only by the Customer's time-limited grant, read-only and logged.
• Rate limiting and input validation on every public route, secrets held in a managed key vault, and point-in-time database restore for 35 days.
• An independent penetration test and a restore drill before public launch.

Annex C: sub-processors

• Microsoft Azure (Microsoft Corporation and its New Zealand and Australian entities): hosting, database, key management, logging; Azure Communication Services for email delivery. Location: New Zealand North; email in Australia.
• Stripe, Inc.: card payments, only if card payments are switched on for the Customer. Not in use today.