Data Processing Agreement
Processor commitments for personal data submitted through the portal.
Billed via Microsoft Marketplace
Last updated: 2026-10-16
This Data Processing Agreement (DPA) supplements the order or service agreement between you (the customer / data controller) and Modern Support Consult (the data processor). It applies to personal data submitted through the customer portal.
Quick links
1. Roles and scope
The customer is the controller of any personal data it submits or instructs us to process. Modern Support Consult acts as processor and processes such personal data only on documented instructions from the customer, including with regard to transfers to a third country.
Where the subscription is purchased through the Microsoft Commercial Marketplace, Microsoft acts independently as the merchant of recordfor the transaction (billing, taxes, invoicing, refunds) under its own terms with the customer. Microsoft is not a subprocessor of MSC/LuiT for that transactional data.
2. Categories of data and data subjects
- Identification and contact data of the customer's administrators using the portal (name, work email, sign-in claims).
- Organisational metadata: tenant ID, tenant domain, role claims.
- Scenario inputs and notes provided by the customer.
- Generated assessment files and any evidence MSC processes for a requested run.
- Operational metadata: request identifiers, timestamps, status, audit trail entries.
Where a scenario supports a customer-managed evidence destination, evidence files can upload there from the browser. MSC separately processes assessment inputs, generated files, and operational records. A connected destination does not by itself mean generated files have been delivered there.
3. Purpose and duration
Personal data is processed solely to operate the portal, run the requested assessments, generate the resulting artifacts, and meet legal obligations. Processing continues for the duration of the engagement and the documented retention windows below.
4. Security measures
- Encryption in transit (TLS 1.2 minimum, TLS 1.3 preferred). Protected Jump Drive results are encrypted per stage with AES-256-GCM; each data key is wrapped by Azure Key Vault (RSA-OAEP-256).
- Microsoft Entra ID OAuth 2.0 / OpenID Connect with delegated permissions only.
- Least-privilege role-based access; production secrets stored in Azure Key Vault.
- Logging and an audit trail for security and support operations. MSC does not claim 24/7 monitoring or tamper-evident audit logging.
- Secure development practices, including code review and dependency updates.
5. Subprocessors
We engage the subprocessors listed on the subprocessors page. We will give the customer prior notice of any intended additions or replacements and provide the opportunity to object on reasonable grounds.
6. International transfers
Primary processing takes place in the European Union (Azure West Europe, Netherlands). No transfer to third countries is required to operate the portal in this lane; Marketplace billing is handled independently by Microsoft under its own terms.
7. Data subject rights
We assist the customer in responding to requests from data subjects exercising their rights under applicable law. See the data subject request page for the operational process.
8. Personal data breach notification
We will notify the customer without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting customer personal data, and provide the information reasonably required to enable the customer to meet its own notification obligations.
9. Retention and deletion
- Standard request metadata: 365 days for traceability, transaction and billing support; assessment answers and report contents are not request metadata. Where an Amplify gain-share is explicitly accepted and the matching entitlement is recorded, paid Journey configuration stays restorable and is kept until you delete the Journey or for up to two years after your last active subscription ends, whichever comes first, subject to the deletion review below.
- Audit trail: 730 days.
- Standard generated output files: up to 365 days. For a protected Jump Drive stage, MSC deletes its temporary stage-result copies after delivery and access from your destination are verified; the outputs remain in your customer-controlled destination unless you delete them there.
- Jump Drive delivery receipts: 730 days from receipt creation, unless a legal hold or other mandatory retention duty requires longer preservation.
- Requests for earlier removal or account-level data deletion review are handled through the written support process referenced by the engagement.
Paid Journey configuration stays restorable. Once it is saved and verified in your Jump Drive, that snapshot is the operational copy, and MSC removes its server copy after the save is verified, except while an active run needs it. Where no Jump Drive snapshot exists, MSC keeps the configuration until you delete the Journey or for up to two years after your last active subscription ends, whichever comes first, except for records we must legally preserve. Deletion is handled through an identity-verified support review.
Removing a stage's temporary result copy is not the same as deleting its saved Journey or the records needed for delivery, transactions and security. Scheduled expiry is not operating for every category, so listed periods do not prove automatic deletion. Journey deletion requests require review of retained configuration, saved run/output data, shared workspace content, protected receipts and any legal holds; settled payment records and records subject to separate legal or audit duties may remain. Our retention periods do not govern copies in your customer-controlled Jump Drive; you administer those copies separately, and MSC remains responsible for data it holds or processes. E-mail Security Snapshot, E-mail Security Fix-up, Optimize Outlook, Messaging Assessment Generator, Exchange Server Design, Exchange Server Migration and Exchange Ops results may be delivered to your Jump Drive or hosted by MSC, as described above. Results of other scenarios are hosted by MSC until Jump Drive delivery is enabled for them.
10. Audits
On reasonable request and subject to confidentiality, we make available the information necessary to demonstrate compliance with this DPA, including third-party assessment reports where available.
11. Contact
Use the support contact referenced by your engagement to request the signed counterpart of this DPA or to raise any data protection question.