Data Processing Agreement

In this DPA, the following terms have the meanings set out below:

• "Controller" means the Customer - the organization that has accepted the Terms of Service and connected its Microsoft 365 tenant to Sentsai. The Controller determines the purposes and means of processing Personal Data.
• "Processor" means Sentsai, which processes Personal Data on behalf of the Controller to deliver the contracted service.
• "Personal Data" means any information relating to an identified or identifiable natural person that is contained within the Microsoft 365 tenant data processed by Sentsai under this Agreement, as further described in clause 4.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, retrieval, storage, consultation, use, transmission, restriction, and deletion.
• "GDPR" means the UK General Data Protection Regulation (as retained in UK law by the European Union (Withdrawal) Act 2018) and/or the EU General Data Protection Regulation (Regulation (EU) 2016/679), as applicable to the Controller's jurisdiction.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed under this Agreement.
• "Sub-Processor" means any third party engaged by Sentsai to process Personal Data on the Controller's behalf.
• "Agreement" means this DPA together with the Terms of Service.
• "Deletion" and "Erasure" are used in this DPA for four distinct operations, which differ in what they remove:
  • Retention expiry (clause 3): at the end of the retention period the scan findings, the generated report, the PDF and the identity of the user who ran the scan are irreversibly set to null. The scan date and three non-personal totals - the account count, the identified-savings figure and the compliance-gap count - survive, as Section 6 of the Privacy Policy describes.
  • Erasure (clause 9): on a request from an administrator, everything in retention expiry plus those three totals, the Controller's account details and the stored payment references are cleared, the Stripe customer record is deleted, and the Microsoft tenant identifier is replaced by a keyed digest so that the erasure cannot be silently reversed by re-registering the same tenant.
  • Individual deletion (clause 9): the scan records containing a named individual are deleted, which removes their findings, report and PDF together.
  • Account deletion (clause 11): the Controller's record is removed outright, scan personal data is wiped as in erasure, and audit entries are de-linked from the Controller.
  What survives all four is stated in clause 11 and Section 6 of the Privacy Policy: a de-identified financial record, de-identified audit entries, any copy held by a Sub-Processor until its own deletion cycle completes, and copies in automated backups until they expire in the ordinary course.

The parties acknowledge and agree that:

• The Customer is the Controller. The Customer determines which Microsoft 365 tenant to connect, when to initiate a scan, and what to do with the resulting report.
• Sentsai is the Processor. Sentsai processes Personal Data solely on the documented instructions of the Controller, being: to connect to the Microsoft 365 tenant via the Microsoft Graph API and run a licensing and security configuration analysis scan to produce a report.
• Sentsai shall not process Personal Data for any purpose other than those described in this DPA, unless required to do so by applicable law, in which case Sentsai shall inform the Controller before that processing (unless prohibited by law from doing so).

Controller responsibilities. The Controller is responsible for its own obligations as a controller under the data protection laws that apply to it, and Sentsai is not responsible for them. In particular, the Controller confirms and is responsible for the following: (a) Authority. The person who connects the tenant and accepts this DPA is permitted by the Controller to do so, and the Controller has the right to grant Sentsai the Microsoft Graph permissions listed in Section 3 of the Terms of Service. (b) Lawful basis. The Controller has a lawful basis, under every law that applies to it, for Sentsai to process the categories of Personal Data listed in clause 4 about the data subjects listed in clause 5 for the purposes in clause 3. Sentsai does not assess or verify that basis. (c) Notice to data subjects. Before the first scan, the Controller has given its employees, contractors and guest users any notice that applicable law requires about this processing, including notice under Articles 13 and 14 of the GDPR, the openness requirements of PIPEDA and Quebec's Law 25, and the notice-at-collection requirements of the CCPA/CPRA for employee and contractor personal information. (d) Data subject requests. The Controller receives, verifies and responds to requests from data subjects. Sentsai's role is limited to the assistance described in clause 9. (e) Access within the Controller's organization. Microsoft grants consent to Sentsai once per tenant. Any user the Controller allows to sign in can run scans and export the tenant's data set through the self-service tools. The Controller decides who may sign in, using the controls Microsoft provides in Entra (for example, "User assignment required"), and is responsible for that decision. (f) Use of reports. Decisions the Controller makes about individuals based on a report, including removing licenses or disabling accounts, are the Controller's decisions, made under its own policies and applicable employment law. A breach of this paragraph is a breach of the Terms of Service, and the indemnity in Section 11 of the Terms applies to it.

Subject matter: Sentsai processes Personal Data to:

• Identify license assignment inefficiencies (unused, over-provisioned, or redundant licenses);
• Detect security configuration gaps, including missing MFA registration, inactive guest accounts, and over-privileged directory roles;
• Analyze usage patterns to distinguish active from inactive users;
• Generate a written audit report summarizing findings and recommended actions.

Duration: Processing occurs during each scan (typically a few minutes) and continues for the data retention period thereafter. By default, the Personal Data in each scan is retained for 90 days, after which it is automatically and permanently deleted; the scan date and three non-personal totals (account count, savings figure, compliance-gap count) are retained as described in Section 6 of the Privacy Policy. The Controller may configure the retention period between 30 and 365 days via account settings.

Sentsai processes the following categories of Personal Data about individuals in the Controller's Microsoft 365 tenant:

• User display names
• User principal names (UPNs / email addresses)
• Microsoft internal user object IDs (GUIDs)
• License assignment records (which Microsoft 365 SKUs and service plans are assigned to each user)
• Last sign-in date and time (interactive and non-interactive)
• Last-activity dates from the Microsoft 365 active-user usage report for Exchange, OneDrive, SharePoint, Teams, Skype for Business and Yammer (Viva Engage), covering the preceding 180 days, and mailbox last-activity from the mailbox usage report; no other per-application usage data is retrieved
• Account status (enabled or disabled)
• MFA registration details from the Entra authentication-methods registration report (whether the user has registered MFA, and the registered method types); only the registered or not-registered flag is used in findings and stored
• Mailbox storage usage in bytes
• The name and email address of the Controller’s own user who initiates each scan, recorded for accountability and displayed on the resulting report
• Guest account type flag (whether an account is an external guest)
• Account creation date (retrieved for every account, not only guests)
• Directory role assignments (e.g., Global Administrator, Exchange Administrator, Security Administrator)

This data is retrieved exclusively via the Microsoft Graph API using permissions delegated by the Controller. Sentsai does not access email content, calendar entries, files, or chat messages.

The Personal Data processed relates to the following categories of data subjects:

• Employees of the Controller who have Microsoft 365 user accounts in the connected tenant;
• Contractors, consultants, and temporary workers who have Microsoft 365 user accounts in the connected tenant;
• External guest users who have been invited to the Controller's Microsoft 365 tenant.

Sentsai shall, in its capacity as Processor:

• (a) Process only on instructions: process Personal Data only on documented instructions from the Controller (as set out in this DPA), and notify the Controller immediately if, in Sentsai's opinion, an instruction infringes the GDPR or other applicable data protection law;
• (b) Confidentiality: ensure that all persons authorized to process Personal Data on Sentsai's behalf are subject to enforceable confidentiality obligations and are informed of the sensitive nature of the data;
• (c) Security: implement and maintain the technical and organizational security measures described in clause 12;
• (d) Sub-processing: not engage any Sub-Processor without prior authorization from the Controller (granted under clause 7) and engage each Sub-Processor on terms that impose data protection obligations comparable to those in this DPA and require it to remain liable to Sentsai for its own sub-processors, as described in clause 7;
• (e) Assistance with rights: assist the Controller in fulfilling its obligations to respond to data subject rights requests, using the technical capabilities described in clause 9;
• (f) Deletion: upon termination of this Agreement or at the Controller's written request, delete all Personal Data processed under this Agreement in accordance with clause 11;
• (g) Compliance evidence: make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA, and cooperate with audits conducted under clause 13;
• (h) Breach notification: notify the Controller without undue delay (and in any event within 72 hours) upon becoming aware of a Data Breach affecting Personal Data processed under this Agreement, as set out in clause 10.

Additional instructions, assistance and costs. The documented instructions are those the Controller gives through the Service: connecting a tenant, starting a scan, setting the retention period, exporting data and erasing data. Any other instruction must be sent in writing to privacy@sentsai.com. Sentsai will follow an additional instruction where it is required by applicable data protection law or can be carried out with the Service as it exists. Where an instruction would require Sentsai to build or operate something the Service does not do, or would infringe applicable law (in which case clause 6(a) applies), Sentsai may decline it and will say so in writing. The self-service tools, the forwarding of requests and individual-level deletion under clause 9, breach notification under clause 10 and the transfer information described in clause 8 are provided at no additional charge. For other assistance, such as completing security questionnaires, supporting a transfer impact assessment beyond the information in clause 8, preparing material for an audit under clause 13, or assisting with a data subject request in a way the self-service tools do not cover, Sentsai may charge a reasonable fee for the time involved. Sentsai will quote that fee in writing before starting the work and will not withhold assistance that applicable law requires it to provide.

The Controller grants Sentsai general written authorization to engage Sub-Processors, subject to the following conditions:

• The current list of authorized Sub-Processors is set out in the Privacy Policy (clause 7 of that document). This list is incorporated into this DPA by reference.
• Sentsai shall provide the Controller with at least 30 days' written notice of any intended addition or replacement of a Sub-Processor. Sentsai will provide the name, country, and purpose of the new Sub-Processor.
• Notice is given by email to the administrator address on the Controller's account (the address of the most recent administrator to sign in), and the Sub-Processor list in the Privacy Policy is updated at the same time. The Controller keeps that address current by having an administrator sign in.
• The Controller may object to the change within 30 days of the notice, in writing to privacy@sentsai.com, stating the data protection grounds for the objection. Sentsai will discuss the objection in good faith and may propose a change that addresses it. If Sentsai does not withdraw the change or agree an alternative with the Controller, the Controller may terminate the Agreement by written notice given within 30 days after the change takes effect. In that case Sentsai refunds the unused portion of any prepaid subscription fee, calculated as described in Section 13 of the Terms of Service, and deletes the Controller's Personal Data under clause 11. Termination and that refund are the Controller's sole and exclusive remedy for the making of a Sub-Processor change to which it objects. Nothing in this bullet limits Sentsai's responsibility under this clause 7 for the acts and omissions of a Sub-Processor once engaged. If the Controller does not object within 30 days of the notice, the change is deemed accepted.
• Urgent changes. Where a change of Sub-Processor is necessary to protect the security or availability of Personal Data, or to comply with a legal obligation, and the 30 days' notice above cannot be given without defeating that purpose, Sentsai may make the change immediately and shall then give the notice described above without undue delay, stating why the change could not wait. The circumstances this covers are a security incident at a Sub-Processor, a Sub-Processor ceasing to provide the service, and a change compelled by law. This paragraph changes the timing of the notice and nothing else: the Controller keeps the same right to object on data protection grounds, with the 30 days running from the date the notice is actually given, and the same remedy of termination and a pro-rata refund set out above. Sentsai will not rely on this paragraph for a change made for commercial convenience.
• Sentsai engages each Sub-Processor under that Sub-Processor's published data processing terms, which require it to impose comparable data protection obligations on its own sub-processors and to remain liable to Sentsai for their performance. Sentsai remains fully liable to the Controller for the acts and omissions of Sub-Processors as if they were Sentsai's own, subject to the limitations in clause 14. Where a Sub-Processor's own terms set a different period than this DPA states, for deletion or for notice of a change to its own sub-processors, Sentsai will state the applicable period on request.
• Microsoft Corporation appears on the Sub-Processor list because Sentsai retrieves Personal Data from the Microsoft Graph API. Microsoft operates the Controller's Microsoft 365 tenant under the Controller's own agreement with Microsoft, not on Sentsai's behalf. Sentsai's responsibility under this clause for the acts and omissions of Sub-Processors covers processing that a Sub-Processor performs for Sentsai, such as hosting and email delivery, and does not extend to Microsoft's operation of the Controller's tenant or to the accuracy, completeness or availability of data returned by the Microsoft Graph API, which are addressed in Sections 10(c) and 12 of the Terms of Service.

Where Personal Data is processed. Sentsai is established in Ontario, Canada. The Service runs on Microsoft Azure infrastructure located in the United States, and the Sub-Processors listed in the Privacy Policy are all established in the United States. Sentsai personnel located in Canada access Personal Data from Canada in the course of operating and supporting the Service. Accordingly, Personal Data processed under this Agreement is stored in the United States and may be accessed from Canada.

Transfers from Canada. Where the Controller is subject to PIPEDA, Sentsai processes Personal Data outside Canada as described above. Sentsai remains accountable for that Personal Data while it is in the hands of a Sub-Processor, and uses contractual means to provide a comparable level of protection to that required under PIPEDA. The Controller acknowledges that Personal Data stored in the United States is subject to the laws of that jurisdiction, including lawful access by United States authorities.

Transfers from the European Economic Area, the United Kingdom and Switzerland. Where the Controller transfers Personal Data subject to the GDPR, the UK GDPR or the Swiss FADP to Sentsai, the following applies:

• Canada benefits from a European Commission adequacy decision covering commercial organizations subject to PIPEDA, so a transfer to Sentsai in Canada does not itself require an additional safeguard. That adequacy decision does not extend to the onward storage of Personal Data in the United States, which is addressed below.
• Standard Contractual Clauses. To the extent Personal Data is transferred to a country that is not the subject of an adequacy decision, the parties incorporate into this DPA by reference the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor). By entering into this DPA, the parties are deemed to have signed those Clauses. Where the transfer is subject to the UK GDPR, the parties further incorporate the UK International Data Transfer Addendum (version B1.0) issued under section 119A of the Data Protection Act 2018. Where the transfer is subject to the Swiss FADP, references in the Clauses to the GDPR and to supervisory authorities are read as references to the FADP and to the Swiss Federal Data Protection and Information Commissioner.
• Completion of the Clauses. For the purposes of the Standard Contractual Clauses: the Controller is the data exporter and Sentsai is the data importer; the optional docking clause in Clause 7 does not apply; the option in Clause 9(a) is Option 2, general written authorization, with the notice period set out in clause 7 of this DPA; the option in Clause 11(a) relating to an independent dispute resolution body does not apply; the governing law under Clause 17 is the law of the Republic of Ireland; and the forum under Clause 18(b) is the courts of Ireland. Annex I (parties, description of the transfer, and competent supervisory authority) is completed by clauses 2, 3, 4 and 5 of this DPA together with the Controller account record; Annex II (technical and organizational measures) is completed by clause 12 of this DPA; and Annex III (sub-processors) is completed by clause 7 of this DPA.
• Precedence. If there is any conflict between the Standard Contractual Clauses and the remainder of this DPA or the Terms of Service, the Standard Contractual Clauses prevail in respect of the transfer they govern. Clause 15 (Governing Law) of this DPA does not displace Clause 17 of the Standard Contractual Clauses.

Onward transfers. Sentsai shall not transfer Personal Data to a Sub-Processor located outside the country of the Controller unless that Sub-Processor is bound by obligations comparable to those in this DPA and by a lawful transfer mechanism where one is required, such as the Standard Contractual Clauses or a Data Privacy Framework certification. The current Sub-Processors and their locations are listed in the Privacy Policy.

Transfer impact assessment and government access. On the Controller's reasonable written request, Sentsai shall provide the information in its possession that the Controller needs in order to carry out a transfer impact assessment, including the categories of Personal Data transferred, the locations of processing, and the Sub-Processors involved. Sentsai has not, as at the date of this DPA, received any legally binding request from a public authority for disclosure of Personal Data processed under this Agreement. If Sentsai receives such a request it shall, unless legally prohibited, notify the Controller without undue delay, challenge any request it considers unlawful, and disclose only the minimum data lawfully required.

Change of processing location. Sentsai shall give the Controller at least 30 days' written notice before moving the primary storage location of Personal Data to a different country. The Controller may object on reasonable data protection grounds under the same process set out in clause 7 for Sub-Processor changes.

Sentsai shall provide reasonable technical assistance to help the Controller fulfill its obligations under Chapter III of the GDPR (data subject rights). Specifically:

• Requests addressed to Sentsai directly: if a data subject contacts Sentsai directly to exercise a right (access, erasure, portability, restriction, objection), Sentsai will forward the request to the Controller without undue delay and will not respond to the data subject on the Controller's behalf without the Controller's authorization.
• Self-service tools: Sentsai provides API endpoints that allow the Controller to: export all Personal Data associated with their tenant (GET /gdpr/export), delete all Personal Data (DELETE /gdpr/erase), perform full account deletion (DELETE /account/delete), and configure the retention period (PUT /gdpr/retention). The export is available to any user of the Controller's tenant who is signed in to Sentsai and returns the data held for the whole tenant, including every scan. Erasure, consent withdrawal, changes to the retention period and account deletion require a signed-in user who holds a Microsoft 365 administrator role that Sentsai recognizes for that purpose; the Service tells the user when a role is required.
• Individual-level deletion: the Controller may request deletion of data relating to a specific individual by contacting privacy@sentsai.com with the user's UPN or Microsoft object ID. Sentsai completes this within 30 days by deleting the scan records that contain that individual, which removes the findings, the generated report and the PDF together. A scan is a point-in-time snapshot the Controller can re-run at any time, so this is a complete remedy rather than a partial one. Sentsai confirms completion in writing.

In the event of a Data Breach affecting Personal Data processed under this Agreement, Sentsai shall:

• Notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach;
• Provide in the notification (or as soon as the information becomes available): (i) a description of the nature of the breach; (ii) the categories and approximate number of data subjects affected; (iii) the categories and approximate number of Personal Data records affected; (iv) the likely consequences of the breach; and (v) the measures taken or proposed to address the breach and mitigate its possible adverse effects;
• Cooperate with the Controller and provide further information as reasonably required to allow the Controller to fulfill its own notification obligations to supervisory authorities and data subjects.

Breach notifications are sent to the Controller's account email address as defined in the Notices paragraph of the Terms of Service (Section 16). If the Controller wants breach notices sent to an additional address, it may email security@sentsai.com from its account email address; Sentsai will record the additional address manually and use it for breach notices. This is a manual arrangement, not a self-service setting.

Upon termination of the Agreement (for any reason) or upon receipt of a written deletion request from the Controller, Sentsai shall:

• Delete all Personal Data processed under this Agreement within 30 days, unless applicable law requires retention for a longer period (in which case Sentsai shall inform the Controller of the legal obligation and isolate the retained data from further processing);
• Ensure that Personal Data held by a Sub-Processor on Sentsai's behalf is deleted within the same period or, where the Sub-Processor's own deletion cycle is longer, within that cycle, which Sentsai will state on request. Copies held in the automated backups of Sentsai's managed database expire in the ordinary course within 14 days and are used only for disaster recovery; if a backup is restored, Sentsai re-applies every deletion of which it holds a record outside the restored database. Personal Data that Sentsai retrieved from the Microsoft Graph API remains in the Controller's own Microsoft 365 tenant, which is outside this DPA;
• Confirm completion. Where the Controller deletes through the self-service tools (DELETE /gdpr/erase or DELETE /account/delete), the response the Service returns at the time of the request is the confirmation of completion, and Sentsai retains no contact address for the Controller afterward. Where the Controller requests deletion in writing, Sentsai confirms completion in writing within 35 days of the request.

The expiry of a paid subscription term without renewal is not a termination of the Agreement; the Controller's account, and the retention period it has configured, continue until the account is deleted or the Agreement is terminated.

The Controller may trigger immediate deletion of all scan data at any time by calling DELETE /gdpr/erase with administrator credentials. This is permanent and irreversible.

Sentsai implements and maintains the following technical and organizational security measures:

The Controller has the right to audit Sentsai's compliance with this DPA, subject to the following conditions:

• The Controller must give at least 30 days' written notice to legal@sentsai.com before conducting an audit, stating its scope and the reason for it;
• Audits may be conducted no more than once per calendar year, unless there has been a confirmed Data Breach affecting the Controller's Personal Data or the Controller has a documented and reasonable concern about Sentsai's compliance;
• Audits are remote first. Sentsai will respond in writing to a reasonable questionnaire and provide the documentation, configuration evidence and audit-log extracts relevant to the Controller's Personal Data. An on-site visit takes place only if the written process leaves a specific, documented concern unresolved, is limited to Sentsai's own premises and systems, and is scheduled during business hours;
• Sentsai does not currently hold any third-party certification (such as ISO 27001 or SOC 2) and has not commissioned a penetration test. If Sentsai obtains such a certification or an independent audit report in the future, Sentsai may provide it in lieu of, or in addition to, a direct audit to the extent it covers the relevant controls;
• Audits do not extend to the systems of Sentsai's Sub-Processors (audit rights against them are exercised through Sentsai under its agreements with them), to data of other customers, or to information whose disclosure would compromise the security of the Service;
• The Controller bears its own costs. Where an audit requires more than one business day of Sentsai's time in a calendar year, or an on-site visit, the Controller reimburses Sentsai's reasonable time and expenses at a rate quoted in advance;
• Any auditor acting for the Controller must be independent, must not be a competitor of Sentsai, and must be bound in writing to confidentiality no less protective than clause 6(b);
• All audit findings and any Sentsai confidential information accessed during an audit are confidential, may be used only to verify compliance with this DPA, and a copy of the findings is provided to Sentsai.

(a) The limitations and exclusions of liability in Section 10 of the Terms of Service apply to this DPA. Sentsai's total aggregate liability under this DPA, the Terms of Service and the CCPA Service Provider Addendum together, for all claims combined, is a single cap equal to the amount set out in Section 10(a) of the Terms. This DPA does not add a second cap or increase that amount. Nothing in this DPA limits the Controller's payment obligations under Section 6 of the Terms or its indemnification obligations under Section 11 of the Terms.

(b) Regulatory fines and penalties. Each party is responsible for any fine or penalty that a supervisory authority or other regulator imposes on that party for that party's own infringement of applicable data protection law. Consistent with Section 10(d) of the Terms, Sentsai is not liable to the Controller for, and does not indemnify the Controller against, any fine, penalty or enforcement cost imposed on the Controller, or any claim against the Controller, that arises from the Controller's own obligations as a controller (including those in clause 2), from the Controller's instructions, from the Controller's use of reports, or from the acts of the Controller's users. The Controller is not liable for fines or penalties imposed on Sentsai for Sentsai's own breach of this DPA. Where applicable law (for example Article 82(5) of the GDPR) gives a party that has paid compensation to a data subject a right to recover part of it from the other party, that right extends only to the part that corresponds to the other party's responsibility for the damage, and, to the extent applicable law allows, any such recovery from Sentsai counts toward, and is limited by, the cap in paragraph (a).

(c) Nothing in this clause limits or excludes any right that a data subject has directly against either party under applicable law, including under Clause 12 of the Standard Contractual Clauses where those Clauses apply, or any liability that cannot be limited by agreement between the parties.

(d) If this DPA conflicts with the Terms of Service on a matter concerning the processing of Personal Data, this DPA prevails; on every other matter, including liability, the Terms of Service prevail. The precedence given to the Standard Contractual Clauses in clause 8 is unaffected.

This DPA is governed by the laws of the Province of Ontario, Canada, and is subject to the exclusive jurisdiction of the courts of Ontario. For US-based Controllers, this DPA also serves as a CCPA Service Provider Agreement; see the CCPA Addendum for California-specific terms.

Where the GDPR of a particular jurisdiction imposes additional mandatory requirements on data processing agreements, those requirements are incorporated into this DPA to the extent necessary to ensure compliance.

Questions regarding this DPA should be directed to legal@sentsai.com.