ENDPOINT RADAR / ASSESS1. Who is responsible
Endpoint Radar Assess is provided by Expliso, Marconiweg 5, 4207 HH Gorinchem, the Netherlands. Contact for account, service and privacy questions: support@endpointradar.com. The provider is the controller for account administration, service communications and its own security records. Your organisation normally remains the controller for personal data in its Microsoft tenant, with Assess processing that data on its documented instructions under the applicable processing agreement. This notice covers Assess; other Platform services may involve different processing.
2. Account and request information
We collect the organisation name, your name, work email address, country, password hash, email verification status and the version of the account terms and privacy notice acknowledged. We also record signup IP address and browser information. Assessment requests include the tenant identifier, requested scope, contacts, approver, proposed recipients, confirmations and any questions you enter. Required fields are necessary to create the account or handle the request; without them we cannot complete that step.
3. Information from Microsoft
After separate authorisation, we retrieve information available within the approved scope through Microsoft Graph. It can include device names and identifiers, operating systems, inventory and application versions; policy, script and application metadata and assignments; deployment and compliance status, errors, group memberships, user relationships, roles, filters and enrollment records. Names, email addresses and device identifiers may identify employees. The exact categories depend on scope and permissions. We do not need your Microsoft password. Do not put secrets or unrelated personal information in free-text fields.
4. Why we process information
We use account and request information to establish and provide the requested service, verify email addresses, communicate about the assessment and administer access. Where you personally contract with us this is necessary for the contract or requested pre-contract steps; for staff acting for an organisation it serves our legitimate interest in managing that business relationship. We use proportionate technical and audit records for our legitimate interests in preventing misuse, troubleshooting and protecting accounts and tenant isolation. We keep records where necessary to meet an applicable legal obligation. Tenant assessment data is processed on your organisation’s instructions; that organisation determines and communicates the relevant lawful basis to its staff.
5. Assessment results
We analyse the approved information to identify configuration concerns, explain coverage and recommend improvements. Reports can contain identifiable device, user and group information. They are reviewed before release. Scores prioritise technical work; Assess does not make solely automated decisions about individuals with legal or similarly significant effects. You do not consent to marketing by reading this notice or creating an account.
6. Recipients and external services
Authorised service administrators can access information as necessary to operate and support Assess. Approved report recipients can receive assessment results; you should choose them carefully. Microsoft provides the tenant API and the email delivery service used for account messages. Infrastructure and backup operators may process information to host and protect the service. Public vendor and software-catalogue sources are consulted for release evidence; catalogue requests identify software products and expose the service’s network address, but are not intended to send tenant names, device identifiers or Microsoft access tokens. We may disclose information where a binding legal requirement applies.
7. Locations and transfers
Expliso operates and administers Assess from the Netherlands. Microsoft services used for tenant access and email delivery operate under their applicable service and data-protection terms. Those services may involve international processing, including outside the European Economic Area; Dutch administration of Assess does not mean that every Microsoft operation takes place in the Netherlands. Microsoft publishes its transfer safeguards, including EU Standard Contractual Clauses for covered services, in its Products and Services Data Protection Addendum. Contact support@endpointradar.com for the processing locations and safeguards applicable to your service, or to request a copy. Microsoft’s published terms are available at https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.
8. How long we keep information
We keep account and request records for as long as needed to administer the account, handle the service, resolve disputes and meet applicable record-keeping obligations. The current email verification link expires after 14 days; expiration is not itself deletion of the signup record. Resumable collection evidence is retained for 30 days and report data for 90 days, counted from creation of the analysis job. The applicable retention is confirmed for your assessment. Personal data included in the completed report may remain for the report period. For repeat assessments, a compact comparison baseline is retained for up to 400 days after report approval. It contains tenant and report identifiers, requester and approved-recipient references, control outcomes and counts, and hashed configuration-object fingerprints; it does not contain the full device inventory, policy contents or script source. A documented legal hold can postpone deletion. Security/audit records and backups have separate retention; deletion from the active service is not immediate deletion from every backup. Ask the provider for the retention applicable to your assessment and for account deletion.
9. Security and browser storage
The service uses access controls, server-side tenant separation, password hashing and audit records. Its account flow uses browser storage and authentication cookies needed for session handling. Protect your account and downloaded reports, and only grant authorised people access. No security control provides an absolute guarantee. Tell the provider promptly about suspected exposure or unauthorised use.
10. Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Contact the provider using the details above; we may need proportionate information to verify your identity. We normally respond within one month, with an extension only where permitted and explained. For tenant information controlled by your employer or another organisation, contact that organisation; we assist it under our processing arrangement. You may complain to the Autoriteit Persoonsgegevens in the Netherlands or your competent data protection authority. See https://www.autoriteitpersoonsgegevens.nl/en for information about complaints.
11. Changes to this notice
This notice carries a version and publication date. We will explain material changes affecting existing processing. Acknowledgement records show which version was presented at registration. Acknowledging this notice is not a waiver of your rights and does not authorise a Microsoft tenant connection.