Data Processing Overview

Our respective roles

The customer is normally the controller of personal data contained in Microsoft 365 assessment data. Vital Signals Ltd, operating the MailboxVitals service, normally acts as the processor for customer-provided assessment data and follows the customer’s documented instructions, agreed scope and applicable law.

Vital Signals Ltd may act as a separate controller for its own business administration, security, billing and customer-contact records, as explained in the Privacy Policy.

Nature and purpose of processing

Processing involves receiving or collecting approved read-only mailbox metadata, securely storing it where needed, analysing health and storage signals, and producing advisory reports, evidence packs and practical recommendations. The service does not make tenant changes or carry out remediation.

Categories of data

Assessment data may include mailbox identifiers, mailbox size, item counts, folder statistics, archive status and signals, quota and storage indicators, shared mailbox indicators, and related tenant or mailbox metadata. Administrative contact and engagement details may also be processed.

MailboxVitals does not intentionally collect email body content, download attachments or inspect message content.

Categories of data subjects

Data subjects may include customer users, mailbox holders and administrative or project contacts associated with the assessed Microsoft 365 environment.

Security measures

• Data minimisation focused on information needed for the assessment.
• Read-only collection and no automatic changes to customer tenants.
• Access limited to authorised people and systems with a business need.
• No intentional collection of email bodies, attachment files or message content.
• Appropriate secure transfer and storage controls.
• Retention and deletion controls aligned with agreed scope and operational needs.

Sub-processors

Relevant sub-processors may include Microsoft 365 and email hosting providers, Cloudflare services, website or application hosting infrastructure, secure file-transfer or storage providers, and business systems needed to deliver and administer the service. Specific providers and safeguards can be confirmed for an engagement where appropriate.

Retention and deletion

Assessment and report data is normally retained for up to 12 months unless otherwise agreed. It may be deleted earlier following completion or a valid customer instruction, subject to backups, legal obligations, dispute handling and reasonable technical deletion cycles.

Formal terms

Formal data processing agreement terms, including any engagement-specific instructions, assistance obligations and sub-processor arrangements, can be agreed for paid or ongoing customer work.

Contact

Data-processing questions can be sent to [email protected].