AzureScanWho we are
AzureScan is a service of BPOLLET.EU CommV, Molenstraat 58, 9890 Gavere, BE 0781.918.879, bart@bpollet.eu. Send privacy questions to that e-mail address.
Controller or processor
For the website, the forms and the portal accounts, we are the controller. For the data AzureScan reads from your Azure environment, you are the controller and we are a processor. If you work through a managed service provider (MSP), that MSP is your processor and we are a sub-processor. This is set out in a data processing agreement, which you can request from us.
Website
Our hosting provider Microsoft Azure processes technical data such as your IP address to deliver the pages and prevent abuse (legitimate interest). We count visits anonymously with Umami, which we host ourselves in Belgium, without cookies; see the cookie statement.
Contact and partner forms
What: your name, company, e-mail address and whatever else you fill in (phone, subject, Azure spend, message, and for partners country and number of tenants). Why: to answer your question and prepare a possible collaboration (art. 6(1)(b) GDPR), with your consent through the tick box. How: our own application in Microsoft Azure in Belgium receives the message, does not store it, and e-mails it to our mailbox at Microsoft 365, through Microsoft Azure in Europe.
How long: we keep your e-mail as long as needed to handle your question and at most 2 years after our last contact. If you become a customer, we keep what the agreement needs, and invoices for as long as accounting law requires.
Reviews from early adopters
What: your company name with your review or with 'no comment', as agreed in the conditions of the free license, and only with your consent (art. 6(1)(a) GDPR) also your own name and role. Why: to show on our website and on LinkedIn what customers think of AzureScan. How long: your own name and role until you withdraw your consent; the company name for as long as we show that list. LinkedIn processes what appears there under its own privacy policy.
Portal accounts
You sign in with your own work account through Microsoft Entra ID; we never receive a password. We process your name, e-mail address and organisation to give you access to your own organisation's data (performance of the contract). Only people on that organisation's user list can sign in: we, your MSP or an admin of your organisation adds your e-mail address to that list, which we keep for as long as you are on it. We keep a log of actions in the portal, such as who approved a recommendation: per customer for as long as that customer is active, for the platform administrators 12 months. Your preferences (language, release notes read) are deleted after 12 months without use.
Data from your Azure environment (as processor)
With read-only rights only (Reader, Cost Management Reader and optionally Reservations Reader), AzureScan reads the description of your resources (names, sizes, region, tags, state), your costs and performance figures such as CPU use. Personal data only appears there if it is part of names or tags, such as a VM named after a person. AzureScan never reads what is inside your resources: no files, databases, mailboxes or disks.
How long: as long as you are a customer. When the agreement ends, we delete findings, reports and the log at once. The first scan, which we keep as evidence for the savings guarantee, is deleted 30 days later, and not before the period for a guarantee claim (120 days after the first scan) has passed. Database backups disappear after 7 days.
Where and with whom
All data stays in the European Union: the portal and the database run in Microsoft Azure in Belgium (region Belgium Central), the backups in the same region, the e-mail through Microsoft Azure in Europe and Microsoft 365. Our only sub-processor is Microsoft Ireland Operations Ltd. Any access by Microsoft from outside the EU is covered by Microsoft's EU Data Boundary and the European Commission's standard contractual clauses in Microsoft's Data Protection Addendum. We do not sell data or use it for advertising.
Security
How we protect your data is described on the Security and privacy page. If we discover a breach that affects your data, we inform you without undue delay and at the latest within 48 hours, so that you and your MSP can meet the legal 72-hour deadline.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw your consent at any time. Send your request to bart@bpollet.eu; we answer within one month. For data from your Azure environment, we help you or your MSP as the controller. If you are not satisfied, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.
Changes
When we change this statement, the date at the top changes. If a change affects customers, such as a new sub-processor, we tell customers and MSPs in advance.