Privacy Policy — UPnGO Risk Assessment

This Privacy Policy explains how UPnGO Ltd ("UPnGO", "we", "us") collects, uses and safeguards personal data in connection with the UPnGO Risk Assessment platform ("Service"). It applies to visitors of our website, users of the MSP console and Microsoft 365 tenants connected to the Service.

1. Data controller

UPnGO Ltd, registered in England and Wales, is the data controller for personal data processed about visitors and console users. When we process Microsoft 365 tenant data on behalf of a Customer, UPnGO acts as a data processor and the Customer is the controller.

2. Data we collect

Account data: name, business email, organisation, role and authentication identifiers issued through Microsoft Entra ID or our identity provider.
Tenant metadata: configuration and posture signals retrieved via Microsoft Graph, Entra ID, Purview and Defender — including user counts, group and sharing settings, Secure Score, licence assignments and sensitivity labels.
Usage data: pages viewed, features used, timestamps, IP address and coarse device information, used for security, analytics and product improvement.
Support data: messages, tickets and attachments you send us.

The Service is designed not to ingest the content of user files, emails or chat messages. It reads governance metadata only.

3. How we use data

to deliver, secure and improve the Service;
to generate risk assessments, remediation recommendations and readiness reports;
to detect and prevent abuse, fraud and security incidents;
to communicate about the Service, including outages and release notes;
to comply with our legal and regulatory obligations.

4. Legal bases (UK/EU GDPR)

We rely on contract performance, our legitimate interest in operating and securing the Service, the Customer's instructions (for processor-role activities), and legal obligation, as applicable.

5. Sharing

We share data with sub-processors that support the Service, including Microsoft Azure (hosting), Microsoft Graph and Azure OpenAI (integration and inference), and monitoring providers. We do not sell personal data. A current list of sub-processors is available on request.

6. International transfers

Customer Data is hosted in the Azure region selected for the Customer's tenant, by default within the UK or EU. Where data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses and the UK International Data Transfer Addendum.

7. Retention

Tenant metadata is retained for the duration of the subscription and for up to 30 days after termination, after which it is deleted or irreversibly anonymised. Aggregated, non-identifying benchmarks may be retained indefinitely.

8. Security

We apply administrative, technical and physical safeguards including encryption in transit and at rest, least-privilege access, audit logging, secret rotation and regular vulnerability scanning. Our incident response process is described in the Service Management Reference.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and object to certain processing. Requests concerning tenant data should be directed to the Customer administering that tenant.

10. Cookies

We use strictly necessary cookies to keep you signed in and secure the console, and optional analytics cookies to understand aggregate usage. You can control optional cookies in your browser settings.

11. Contact

Privacy questions and data-subject requests should be sent to info@upngo.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office.