GDPR guidelines | Datalegale

1. Roles — read this first

Activity	Who is who
You read a guide or take a self-assessment about your Microsoft 365 tenant	You (your organisation) are controller of that tenant. Microsoft is your processor or a separate controller under your Microsoft contract. Datalegale is not in that chain.
You unlock a report and send us a work email	Datalegale is controller of that contact request. You are the data subject (and you represent your organisation).

We cannot see your SharePoint, your DPIA file, or your admin center. The scanner never connects to Microsoft Graph. That is deliberate.

2. Principles we apply (Article 5)

Lawfulness, fairness, transparency — this page, the privacy notice, and a preview score before any email
Purpose limitation — contact details are for delivering the report, following up on a request you made, and updates only if you opt in
Data minimisation — name, work email, company are required to unlock; everything else on the form is optional; answers stay in the browser unless you unlock
Accuracy — you supply the answers; we do not enrich them with third-party data brokers
Storage limitation — mailbox 24 months, browser storage until you clear it, host logs short
Integrity and confidentiality — HTTPS, field checks, no public lead database
Accountability — this document, a published scoring method, and a named mailbox for rights requests

3. Processing activities (summary record)

Activity	Categories	Basis	Recipients	Period
Self-assessment in the browser	Answers, derived score	Art. 6(1)(b)	Your device	Until cleared
Unlock / lead notification	Identity and work contact, company, score, flags	Art. 6(1)(b), 6(1)(a), 6(1)(f)	Datalegale, Web3Forms	24 months
Optional updates	Work email, name, company	Art. 6(1)(a)	Datalegale mailbox	Until withdrawn
Site operation and security	Technical logs	Art. 6(1)(f)	Host	Typically < 90 days

We do not process special-category data (Art. 9) as part of the service. Do not send it to us.

4. How to exercise your rights

Email hello@datalegale.com from the work address you used, or state that address in the message.
Say what you want: access, correction, erasure, restriction, objection, portability, or withdrawal of consent for updates.
We confirm receipt and respond within one month (Art. 12(3)).
We may ask for information needed to identify the request. We will not require a process that undermines the right.

To erase data only on your device, clear this site’s data in the browser as well — we cannot reach your local storage from the server.

5. Complaints (Article 77)

You may lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or of the alleged infringement. The European Data Protection Board publishes the list of members: edpb.europa.eu.

Please write to us first so we can fix a straightforward request quickly. That does not limit your right to complain.

6. Transfers outside the EEA (Chapter V)

Unlock emails are handed to Web3Forms so they can be delivered to us. The site is hosted on Vercel. Those providers may process in the United States. That is a third-country transfer.

Safeguard in product design: do not unlock if you do not accept that transfer. Preview and knowledge remain available. We do not send the full answer set off-device.

7. What these assessments are not, under the GDPR

Not your Article 30 record of processing — they can feed it, they do not replace it
Not your Article 35 DPIA — they list rows Microsoft’s template will not fill; you still write the file
Not prior consultation (Art. 36)
Not a processor agreement between you and Datalegale for tenant data — we do not process that data
Not legal advice

If Copilot in your tenant is the live question, start with the GDPR assessment or the DPIA guide. Those pages are about your processing as controller, not ours.

8. Security of processing (Article 32)

Measures appropriate to a small contact form and an in-browser assessment: TLS in transit, field-length limits, bot honeypot, no Graph connection, no public lead table, report PDFs marked for internal use. Residual risk remains (mailbox compromise, device access, provider incident). That is why the form must stay free of secrets.

9. Updates

These guidelines move when the processing or the law we rely on moves. Last updated 1 September 2026. Related: privacy notice, terms of use, how we score.