Privacy Policy

1. Who we are

PB Tech Licence Intelligence (the service) is provided by PB Technologies Ltd, 4 Rothwell Avenue, Rosedale, Auckland 0632, New Zealand (PB Tech, we, us). We are an agency under the New Zealand Privacy Act 2020 and handle personal information of customers in Australia in line with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).

Our Privacy Officer can be reached at licensing@pbtech.co.nz.

2. Two roles

For information about your people held in your Microsoft 365 tenant (the tenant data, section 3b) we act on your behalf: you decide to connect the tenant and we use the information only to provide the service to you. The data processing agreement governs that. For information about the people who use the service and about our customers (section 3a, 3c, 3d) we decide how it is used, and this policy explains it.

3. What we collect

a. Account information

When you sign in with Microsoft we receive your name, work email address (your user principal name) and the identifiers of your Microsoft account and organisation's tenant, and whether you signed in with multi-factor authentication and hold an administrator role. We do not receive your password. We record when you last signed in.

b. Tenant data

After an administrator of your tenant approves the read-only connector, we read, for licensed users only: name, sign-in name, department, company name, usage location, account creation date, whether the account is enabled, the licences assigned, and last sign-in and activity dates, plus your subscriptions, licence counts and Microsoft's usage reports. We do not read email, files, calendars or chats.

c. Organisation, billing and usage information

Your organisation's name and country, your team members and their roles, the prices you enter, billing contact names and email addresses, purchase order numbers and GST numbers, invoices, notification settings (including any Microsoft Teams webhook address, stored encrypted), and an audit log of actions taken in the service.

d. Communications

Messages you send through the contact form or by email, the questions you put to Ask and its answers (kept for 30 days), and a record of emails we send you. Email addresses of people your team nominates to receive notifications are used only after that person confirms.

e. Technical information

Our servers process your IP address to apply rate limits and to protect the service. Rate-limit counters hold a one-way hash of it. We use one essential cookie to keep you signed in, and a short-lived one during sign-in. We do not use advertising or analytics cookies and load no third-party scripts.

4. Why we use it

• To provide the service: showing licence usage and savings, notifications, exports, statements, Ask and support (IPP 1, 10; APP 3, 6).
• To bill you and keep the tax and financial records the law requires.
• To keep the service secure, prevent abuse and investigate incidents.
• To tell you about the service: security, connection, billing and renewal messages you cannot turn off, optional alerts and digests you can, and product emails you can unsubscribe from.
• To understand, in aggregate and without personal information, how the service is used so we can improve it.

We do not sell personal information, use tenant data for advertising, or use it to train any model.

5. Who we share it with

• Microsoft Azure, which hosts the service and delivers our email (Azure Communication Services).
• Stripe, only if card payments are switched on. They are not today.
• PB Tech staff who need it to run, support and bill the service. Staff cannot see tenant data about your people unless you grant support access.
• Your own organisation: other members of your organisation can see what their role allows, and PB Tech may share information with the Microsoft Cloud Solution Provider team if you buy licences through us, so we can apply the CSP price.
• Anyone we are required by law to tell, such as a court order or a regulator.

6. Where it is held

The service and its database are in Microsoft Azure in New Zealand North. Email is processed by Azure Communication Services in Australia. Ask runs on PB Tech's own model on PB Tech hardware. Where information is sent overseas we take reasonable steps to make sure it is protected by safeguards comparable to New Zealand law (IPP 12) and, for Australian information, that the recipient does not breach the APPs (APP 8).

7. How long we keep it

• Tenant data: deleted 30 days after you disconnect the tenant or close your organisation.
• Invoices and billing profiles: 7 years, because of tax record obligations.
• Ask conversations: 30 days.
• Audit log: kept while your organisation exists. After deletion, the entries are kept with their detail removed.
• Free organisations with no sign-in for 365 days are closed after 30 days notice.

8. Keeping it safe

Encryption at rest with a key under PB Tech's control and in transit, database-level separation between organisations, multi-factor sign-in on by default, audit logging, least-privilege roles and read-only access to your tenant. The Security page has detail. If we have a privacy breach that is likely to cause serious harm we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act 2020 requires, and for Australian customers we will follow the Notifiable Data Breaches scheme.

9. Your rights

You can ask for the personal information we hold about you and ask us to correct it (IPPs 6 and 7; APPs 12 and 13). Email licensing@pbtech.co.nz. If your information is in a customer organisation's tenant data, we may refer your request to that organisation, who decides how it is used. We reply within 20 working days.

If you are not happy with our response you can complain to the Office of the Privacy Commissioner (privacy.org.nz) in New Zealand or the Office of the Australian Information Commissioner (oaic.gov.au) in Australia.

10. Changes

We will post any change here with a new version, and email owners of organisations if it is material. The version above is the one you accepted when you created an organisation.