1. Who we are
Enterprise Contacts is developed and operated by an individual developer based in Denmark. For the limited server-side data described in this policy we act as the data controller. For contact records your device retrieves from Microsoft 365, we act as a data processor on behalf of your tenant administrator.
Data protection enquiries: privacy@enterprisecontacts.eu.
2. What stays on your device
All contact records pulled from your Microsoft 365 tenant are stored locally on the iPhone, encrypted with the device key, and removed when you log out or delete the app. We have no access to these records.
3. Tenant onboarding
When a Global Administrator grants consent, Microsoft redirects them to our website with a Tenant ID confirming the authorisation. We record the Tenant ID and the date of consent to verify that the tenant has approved Enterprise Contacts. The legal basis is our legitimate interest in operating a secure, authorisation-gated service (Article 6(1)(f) GDPR). This data is retained while the tenant remains active, and deleted within 30 days of a removal request or confirmed deactivation.
4. Anonymous telemetry
The app generates a random installation identifier that is not linked to your name, email address, Microsoft account, or device identity. This identifier is used for operational logging and crash diagnostics. No contact names, phone numbers, addresses, or other personal data from Microsoft 365 are ever included in telemetry events.
You can reset this identifier at any time by deleting and reinstalling the app. To opt out of telemetry entirely, email privacy@enterprisecontacts.eu.
Anonymous telemetry and crash diagnostics are processed on our behalf by Microsoft Azure Application Insights (Azure Monitor), hosted in the EU (Sweden Central). Microsoft acts as our data processor for this telemetry and provides the same level of protection for your data as described in this policy. This telemetry contains no contact content and no information that identifies you personally — only a random installation identifier and diagnostic events.
5. Third-party services
Enterprise Contacts uses the following third-party services:
- Microsoft (MSAL / Microsoft Graph) — authentication and contact data retrieval. Microsoft acts as a data processor under your organisation's Microsoft 365 agreement. See Microsoft's Privacy Statement.
- Microsoft Azure Application Insights (Azure Monitor) — anonymous telemetry and crash diagnostics, hosted in EU (Sweden Central). No personal data or contact content is included. Microsoft acts as our data processor for this service under the Microsoft Online Services Terms.
We do not use advertising networks, social media plug-ins, or analytics services that track you across websites or devices.
6. Cookies and tracking
This website does not use cookies, tracking pixels, or third-party analytics scripts. No data about your visit is shared with advertising networks or data brokers.
7. Support messages
If you contact us by email, the message and any personal data you include are used solely to respond to your enquiry. The legal basis is our legitimate interest in providing support (Article 6(1)(f) GDPR). Support correspondence is deleted within 12 months of the last reply unless a longer retention period is required by law.
8. Data retention
- Tenant ID and consent date — retained while the tenant is active; deleted within 30 days of a removal request.
- Support messages — deleted within 12 months of last correspondence.
- Anonymous telemetry — retained on a 90-day rolling basis.
- Contact records — on-device only; removed immediately on logout or app deletion.
9. Your rights
Under GDPR you have the following rights in relation to the limited personal data we hold:
- Access (Art. 15) — request a copy of data we hold about you.
- Rectification (Art. 16) — ask us to correct inaccurate data.
- Erasure (Art. 17) — ask us to delete your data where no legal basis for retention applies.
- Restriction (Art. 18) — ask us to limit processing while a dispute is resolved.
- Portability (Art. 20) — receive your data in a machine-readable format.
- Objection (Art. 21) — object to processing based on legitimate interest.
To exercise any of these rights, email privacy@enterprisecontacts.eu. We will respond within 30 days.
You also have the right to lodge a complaint with the Danish supervisory authority: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby — dt@datatilsynet.dk.
10. Children's privacy
Enterprise Contacts is designed for use in professional Microsoft 365 environments and is not directed at children under 13. We do not knowingly collect personal data from children.