EasyLife 365 Collaboration - Privacy Policy

1. Scope

We, EasyLife 365 AG (Zugerstrasse 32, 6340 Baar, Switzerland), are the owner and operator of the software EasyLife 365 Collaboration (hereinafter referred to as the "Software"). For the data processing activities listed in this privacy policy we act as processor on behalf of our customers, who are the controllers. Our own processing as controller (for example contract, invoicing and support data) is described in the General Privacy Policy.

This product specific Privacy Policy supplements and extends the General Privacy Policy of EasyLife 365 AG. These documents create a comprehensive agreement for the use of EasyLife 365 Collaboration (“Product”), detailing specific terms that apply exclusively to EasyLife 365 Collaboration and take precedence in cases where provisions differ from those in the General Privacy Policy.

2. Data processing when using our Product

The proper use of our Software requires processing the data subjects’ data listed in The General Privacy Policy section “Users and other data subjects”. The data processed in this context includes the following categories. When processing this data, we act as a processor on behalf of our customers, the controllers.

2.1 Data directly related to our Software

• 1. data related to the implementation of the Software, e.g.:
  • (a) Granting / restriction of permissions
  • (b) Update of the Software
• 2. data related to the use of the Software, e.g.:
  • (a) Configuration data, e.g.:
    • Creation, design, and modification of templates (including metadata such as title or description)
    • Creation, design, and modification of policies (including metadata such as title or description)
    • Settings, any options that the customer configures in the software’s admin center
    • EasyLife 365 Approval requests and feedback
    • Guest experiences and access catalogs
    • Access review and export history
  • (b) User profile and contact data, e.g.:
    • Email address
    • Preferred language
    • Display Name
  • (c) Data related to the implementation and monitoring of the assets, e.g.:
    • Policy state of an individual asset
    • Metadata of an individual asset
  • (d) Backup of configuration data under section 2.a.

This data is generated automatically when you use the Software and is technically necessary for the operation. Any further processing is carried out to provide the desired functionalities of the Software. The types of processing of this data (e.g., sending notifications, deletion of groups, etc.) are determined by the functionalities of the Software as described in the respective documentation, in particular, available at https://docs.easylife365.cloud/.

The data under point 2.a will be stored by us for as long as the customer does not delete the configuration, and the data under points 2.b and 2.c for 90 days in the application Logs to provide support, in particular, to fix errors. In general, Data under 2.c is saved in the customer’s Entra ID and will be deleted when the customer deletes the asset. The data under point 2.d will be stored by us for 180 days.

We process this data only on the documented instructions of our customer under the Data Processing Agreement. The customer, as controller, determines the legal basis.

2.2 Data related to your Microsoft 365 environment and tools

In order for our Software to fulfil its purpose and assist you in the governance of your Microsoft 365 tools, access and further processing of data contained in your Microsoft environment and Microsoft 365 tools is required. The data in question are related to the following areas:

• directory data (e.g., user profile data (e.g., name, address, phone number, job title), group memberships and permissions)
• all data with regard to Microsoft 365 groups (e.g., name, e-mail address, properties, memberships, site URLs)
• SharePoint sites (e.g., site properties, administrators, members and sharing links) and, when you provision a site from a template, the files and folders of that template
• all users’ full profiles (e.g., name, group membership, e-mail address, company name, phone number, department)
• sign-in events and last sign-in of guest accounts
• the preferred language of mailboxes (e.g., for notifications)

We only access and process this data to perform the actions you request and ultimately to provide the functionalities of our Software. We process this data only on the documented instructions of our customer under the Data Processing Agreement. The customer, as controller, determines the legal basis.

3. Transfer to and access by third parties

In addition to the General Privacy Policy, for EasyLife 365 Collaboration: we rely on an e-mail service provider when sending e-mail notifications from our Software. We share the recipient’s e-mail address and the notification content (e.g., name, language, group or site name and link) to send them. You can opt out of this service by disabling e-mail notifications in our Software’s admin center or by configuring a dedicated shared mailbox in your Microsoft 365 tenant.

4. Annexes

Integral parts of this Agreement are the following appendixes:

• Appendix 1: General Privacy Policy
• Appendix 2: Data Processing Agreement

Information on data subject rights and international transfers is in the General Privacy Policy, and information on subprocessors is in the Data Processing Agreement and on our subprocessor page. For data we process as processor, requests from data subjects are forwarded to the customer.

These Documents in its latest Version are available at: https://www.easylife365.cloud/legal/collaboration/privacy