Privacy Policy

1. Introduction

Tenant Excellence is a Software-as-a-Service (SaaS) web application operated by NextStep Europe. It helps organizations assess their Microsoft 365 security posture, compliance readiness, licence utilization, user adoption, and operational risks using customer-authorized access to Microsoft Graph.

This Privacy Policy explains what personal information and Microsoft 365 tenant data the application may process, why it is processed, how it is protected, and the choices and rights available to users.

2. Scope

This policy applies when you access or use the Tenant Excellence SaaS web application, request a demonstration, create or administer an account, contact support, or authorize the application to assess a Microsoft 365 tenant. Third-party services, including Microsoft services, are governed by their own applicable terms and privacy notices.

3. Roles and responsibilities

For information submitted directly to NextStep Europe for account administration, sales, support, security, or service operation, NextStep Europe determines the relevant purposes and means of processing.

When Tenant Excellence processes Microsoft 365 tenant data on behalf of a customer and under that customer's instructions, the customer generally acts as the data controller and NextStep Europe acts as the data processor, subject to the applicable agreement and law.

4. Information we may process

4.1 Contact and account information

• Name, business email address, organization, job role, and contact details.
• Account, tenant, user, and session identifiers used for authentication and access control.
• Information submitted through demo, sales, onboarding, or support interactions.

4.2 Customer-authorized Microsoft 365 data

Depending on the assessment selected and the permissions approved by an authorized administrator, Tenant Excellence may process:

• Microsoft 365 tenant, domain, subscription, and service configuration metadata.
• Microsoft Entra ID user, group, role, authentication, and access-policy metadata.
• Security, compliance, governance, retention, and protection configuration metadata.
• Licence assignments, service usage reports, adoption indicators, and aggregated activity metrics.
• Assessment findings, risk indicators, control mappings, recommendations, and tenant-sourced evidence generated by the application.

4.3 Technical and security data

• IP address, browser and device information, timestamps, diagnostic events, and security logs where necessary to operate, secure, and troubleshoot the service.

4.4 Optional AI insights

Where a customer enables the optional AI insights feature, a summary of the assessment is sent from the user's browser to Microsoft's Work IQ service under that user's own Microsoft Entra ID identity, and processed within the customer's Microsoft 365 tenant trust boundary. The summary contains counts, statuses and compliance control identifiers only; it does not contain names, user principal names, email addresses, domain names, resource names or evidence text. The request does not pass through NextStep Europe servers, and no third-party model provider is involved.

5. Information the application is not designed to access

Tenant Excellence is designed to assess configuration, security, compliance, licensing, governance, and service usage. It is not designed to access the content of emails, Teams chats, SharePoint documents, OneDrive files, attachments, audio recordings, or video recordings.

If a future optional feature requires additional data access, the relevant permissions and purpose will be disclosed before authorization, and this policy will be updated where required.

6. Microsoft Graph access and authentication

Tenant Excellence accesses Microsoft Graph only within the permissions approved through Microsoft's consent framework by an authorized representative of the customer. The application's core assessment uses read-only access and does not create, edit, or delete Microsoft 365 users, content, settings, or tenant configurations.

Tenant Excellence does not request or store a user's Microsoft password. Authentication tokens are used solely to authorize the requested Microsoft Graph session. The permissions displayed during the Microsoft consent process are the authoritative list of access requested by the application.

7. Purposes of processing

We process information only as necessary to:

• Authenticate users and administer authorized access to the SaaS web application.
• Perform requested Microsoft 365 security, compliance, licensing, adoption, and risk assessments.
• Generate dashboards, findings, recommendations, reports, evidence, and customer-authorized auditor views.
• Provide demonstrations, onboarding, customer service, technical support, and service communications.
• Maintain availability and security, prevent misuse, investigate incidents, and diagnose technical issues.
• Comply with legal obligations and enforce applicable agreements.

We do not sell personal information or use Microsoft 365 tenant data for third-party advertising.

8. Legal bases

Where the GDPR or similar law applies, processing may be based on performance of a contract, steps requested before entering a contract, our legitimate interests in operating and protecting the service, compliance with legal obligations, or consent where required. When processing is performed on a customer's documented instructions, the customer's legal basis governs that processing.

9. Data storage and retention

Tenant Excellence follows data-minimization and privacy-by-design principles. Microsoft 365 data retrieved for a live assessment is processed only to provide the requested functionality and is not retained as a permanent server-side copy unless retention is expressly required for a customer-enabled feature.

The service may retain limited operational information, such as account and contact records, contractual records, consent records, audit events, customer-authorized assessment outputs, time-limited auditor-link records, and security or diagnostic logs. Such information is retained only for as long as necessary for service delivery, security, legal compliance, contractual obligations, or dispute resolution, and is then deleted or anonymized.

Tenant Excellence does not store Microsoft passwords. Any statement that tokens remain within the browser applies only where that behavior is implemented in the deployed application architecture.

10. Customer-hosted deployments

Where a customer deploys Tenant Excellence within infrastructure under its control, that customer controls the hosting location, access controls, configuration, and retention settings. NextStep Europe accesses such an environment only when authorized for support, maintenance, or other agreed services.

11. Disclosures and service providers

We may disclose information to authorized personnel and service providers that support hosting, authentication, communications, security, diagnostics, and customer support, but only where necessary to provide or protect the service and subject to appropriate safeguards.

Tenant Excellence relies on Microsoft services, including Microsoft Entra ID, Microsoft Graph, and Microsoft 365. We may also disclose information where required by applicable law or valid legal process, or where necessary to protect the rights, safety, and security of Tenant Excellence, our customers, users, or others.

We do not sell, rent, or monetize customer tenant data.

12. International data transfers

Where personal information is transferred across jurisdictions, we use safeguards required by applicable data-protection law. Depending on the circumstances, these safeguards may include contractual protections, approved transfer mechanisms, and technical and organizational security measures.

13. Security

We use administrative, technical, and organizational measures intended to protect information processed by Tenant Excellence. These measures include encrypted network communications, Microsoft Entra ID authentication, role-based access controls, least-privilege access, and security monitoring. No electronic system can be guaranteed to be completely secure.

14. Cookies and similar technologies

The SaaS web application may use cookies or similar technologies necessary for authentication, session management, security, and core functionality. If optional analytics or other non-essential technologies are used, appropriate information and choices will be provided where required by law. Tenant assessment data is not used for behavioral advertising.

15. Privacy rights

Subject to applicable law, individuals may have rights to access, correct, delete, or obtain a copy of their personal information; restrict or object to processing; withdraw consent where processing is based on consent; and complain to a competent data-protection authority.

Requests may be sent to support@nextstepeurope.fr. We may verify the requester's identity and authority before responding. Where a customer's organization controls the relevant information, we may refer the request to that organization.

16. Customer responsibilities

Customers are responsible for ensuring that they have lawful authority to connect their Microsoft 365 tenant, grant permissions, authorize users, and use assessment outputs. Customers are also responsible for providing any notices required for their users and configuring Tenant Excellence consistently with applicable law and internal policy.

17. Children's privacy

Tenant Excellence is a business-to-business SaaS application and is not directed to children. We do not knowingly collect children's personal information through the service.

18. Changes to this policy

We may update this Privacy Policy to reflect changes to the application, our practices, or legal requirements. The revised policy will be published at this location with an updated revision date. Additional notice will be provided where required by law.

19. Contact