1.PERSON RESPONSIBLE FOR DATA PROTECTION
The person responsible for data processing within the meaning of data protection laws is:
2.SUBJECT OF DATA PROTECTION
The subject of data protection is personal data.
Personal data is all information that relates to an identified or identifiable natural person. A natural person is considered identifiable if he or she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more special characteristics that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
When you access our websites, our web servers automatically record information of a general nature. This includes the type of web browser, the operating system used, the domain name of the Internet service provider, the IP address of the computer used, the website from which you visit us, the pages you visit on our site and the date and duration of the visit.
3.LEGAL BASIS FOR DATA PROCESSING
If we obtain consent from the data subject for processing personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for processing your personal data. If personal data is required to fulfill a contract to which the data subject is a party, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
If processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 (1) (c) GDPR serves as the legal basis.
If vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) (d) GDPR serves as the legal basis.
If processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 (1) (f) GDPR serves as the legal basis for processing.
4.DATA DELETION AND STORAGE PERIOD
The personal data of the person concerned will be deleted or blocked as soon as the purpose of storage no longer applies. The data will also be blocked or deleted if a storage period prescribed by the standards mentioned expires, unless there is a need to continue storing the data for the conclusion or fulfillment of a contract.
5.COLLECTION AND PROCESSING OF PERSONAL DATA
Personal data will only be collected if you provide it yourself.
Your data will only be used with your consent. Your data will only be used with your consent. The use of this data is limited to the purposes of market research and is only possible for PowerData Dynamics UG (haftungsbeschränkt). You can revoke your consent at any time with effect for the future.
Your data will not be shared in any way.
5.1.CONTACT
You can contact our company via e-mail and/or phone number. In this situation we will use your e-mail and/or phone number exclusively for further cooperation.
This information is provided on an expressly voluntary basis and with your consent. If this information relates to communication channels (e.g. email address, telephone number), you also consent to us contacting you via this communication channel if necessary to answer your request.
5.2.PROVISION OF THE WEBSITE AND CREATION OF LOG FILES
Every time our website is accessed, our system automatically records data and information from the computer system of the accessing computer. The following data is collected:
Information about the browser type and version used:
Websites from which the user’s system accesses our website
Websites accessed by the user’s system via our website
The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.
The legal basis for the temporary storage of the data and log files is Art. 6 Para. 1 lit. f GDPR. The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session.
The data is stored in log files to ensure the functionality of the website. In addition, the data helps us to optimize the website and to ensure the security of our information technology systems.
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.
If the data is stored in log files, this is the case after seven days at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or altered so that it is no longer possible to indentify the client.
6.COOKIES
In some areas of our website, so-called cookies are used. A cookie is a small text file that is stored on your hard disk by a website. Cookies do not cause any damage to your computer and do not contain any viruses. The cookies on our website do not collect any personal data. We use the information contained in cookies to make it easier for you to use our website and to tailor it to your needs.
They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies).
Our website uses both session cookies and permanent cookies. Session cookies are temporary cookies that are stored in the user’s Internet browser until the browser window is closed and the session cookies are deleted. Permanent cookies are used for repeated visits and are stored in the user’s browser for a certain period of time (usually a maximum of 2 years). These cookies are not deleted when the browser is closed. This type of cookie is used to reuse a user’s preferences when they return to the website.
Cookies that are required to provide certain functions that you have requested or to optimize the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimized provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, the processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG); the consent can be revoked at any time.
We use cookies on our website that enable us to analyze users’ surfing behavior. In this way, the following data can be transmitted:
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.
7.GOOGLE ANALYTICS
This website uses Google Analytics. The legal basis for this processing is your consent in accordance with Art. 6 Paragraph 1 Letter a of GDPR.
Google Analytics also uses “cookies”, text files that are stored on your device and that enable an analysis of the use of the website. It cannot be ruled out that the information generated by the cookie about your use of this website will be transferred to a Google server in the USA and stored there. Data will only be transferred to the USA if the requirements of Art. 44 ff. GDPR are met. The transfer of personal data to the USA has been declared permissible by the EU-US Data Privacy Framework. Google Inc. participates in this framework. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. User data will be deleted after 24 months at the latest.
You can withdraw your consent at any time with effect for the future and prevent Google.
You can also prevent cookies from being saved by setting your browser software accordingly; however, we would like to point out that if you do this, you may not be able to use all of the functions of this website to their full extent. You can find more information about data protection at Google at https://policies.google.com/privacy.
8.DATA TRANSFER
Your data will not be transferred to third parties outside of our company unless we are legally obliged to do so, or the data transfer is necessary to carry out the contractual relationship or you have previously expressly consented to the transfer of your data. External service providers and partner companies will only receive your data if this is necessary to process your request. In these cases, however, the scope of the data transferred is limited to the minimum required. If our service providers come into contact with your personal data, we ensure that they comply with the provisions of the data protection laws in the same way.
9.DATA PROCESSING LOCATIONS
The data we collect may be processed primarily in Germany. However, in certain circumstances, data may be processed in other locations, provided that prior agreement is obtained from the customer. We ensure that any data processing outside of Germany will adhere to the necessary legal and security requirements.
10.RIGHTS OF THE DATA SUBJECT
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
Right to information under Article 15 GDPR
You can request confirmation from us as to whether we are processing personal data concerning you. If we have processed data from you, you have further rights to information as set out in Article 15 GDPR.
Right to rectification
If the data we have collected from you is incorrect or incomplete, you can request that we rectify it immediately in accordance with Article 16 GDPR.
Right to restriction of processing
Under the conditions of Article 18 GDPR, you may also request that the processing of personal data concerning you be restricted. After the restriction, your data may only be processed with your consent or for the purpose of asserting, exercising or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. We will inform you before the restriction is lifted.
Right to deletion
If one of the reasons in Article 17 Paragraph 1 GDPR applies, you can request that we delete the personal data concerning you immediately, unless there is an exception to the obligation to delete data in accordance with Article 17 Paragraph 3 GDPR.
Right to information
If you have asserted your right to rectification, deletion or restriction of processing against us, we are obliged under Article 19 GDPR to inform all recipients of your personal data of this, unless notification is impossible or involves disproportionate effort. You also have the right to be informed of the recipients. You have the right to be informed of these recipients by the person responsible.
Right to data portability
In addition, according to Article 20 GDPR, you have the right to receive the personal data concerning you from us in a machine-readable format and to transmit the data to another responsible party without hindrance, provided that the requirements of Article 20 Paragraph 1 Letter a of GDPR are met, or to have your personal data transmitted directly from us to another responsible party, provided that this is technically feasible and does not affect the freedoms and rights of other persons. This right does not apply to the processing of personal data that is necessary to perform a task in the public interest or to exercise official authority.
Right of objection
You have the right to object to the processing of personal data concerning you by PowerData Dynamics UG (haftungsbeschränkt) at any time in accordance with Article 6 Paragraph 1 Letter f of GDPR. We will no longer process your personal data unless legitimate reasons for the processing outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
Right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time by notifying PowerData Dynamics UG (haftungsbeschränkt). The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.
Right to lodge a complaint with the supervisory authority: You can also lodge a complaint with the responsible supervisory authority if you believe that the processing of your data violates applicable law. You can contact the data protection authority responsible for your place of residence or your country or the data protection authority responsible for us.
The rights of users
Users have the right to do the following:
11.HOSTING PROVIDER
We host the content of our website with the following provider is GoDaddy (GoDaddy.com, LLC, 2155 E GoDaddy Way,Tempe, Arizona 85284,United States).
GoDaddy handles the technical aspects of hosting and ensures your data is securely processed according to our guidelines.
12.MEETCONVERT – PRODUCT DATA PROCESSING AND MICROSOFT ENTRA APPLICATIONS
This section applies to organisations that install and use our MeetConvert product. Visitors to this website are covered by sections 1 to 11 and are not affected by this section.
12.1.ROLES UNDER THE GDPR
MeetConvert runs inside the customer’s own Microsoft Dynamics 365 (Dataverse) environment and the customer’s own Microsoft 365 tenant. Meeting campaigns, participant records, invitations and attendance data are created and stored there, under the customer’s control.
The customer is the controller for that data. PowerData Dynamics UG (haftungsbeschränkt) does not determine the purposes of that processing and does not receive that data. Where we process personal data in connection with licensing, support or account administration, we act as processor on the customer’s instructions.
12.2.THE TWO MICROSOFT ENTRA APPLICATIONS
MeetConvert uses two applications in the customer’s Microsoft Entra directory. Both are published by PowerData Dynamics UG (haftungsbeschränkt) as a verified publisher, and neither can do anything until a tenant administrator has granted consent.
PDD Dataverse SPN for MeetConvert – Application ID 788c2eb9-5b49-4755-8327-5f21acbb59c0
Used solely to create and operate the Dataverse application user through which MeetConvert’s server-side components read and write MeetConvert’s own tables. Its permissions are:
This application holds no tenant-wide Microsoft Graph permissions. It cannot read mailboxes, calendars, meetings or directory data.
PDD Meeting Creator SPN for MeetConvert – Application ID 5c37d99b-b377-4a56-a56b-2dcff1d13530
This is the application that interacts with Microsoft 365. It runs on a schedule with no signed-in user, which is why its permissions are application permissions rather than delegated ones:
MeetConvert does not request and does not need Mail.Send, Mail.ReadWrite, User.ReadWrite.All, Directory.ReadWrite.All, or any Files or Sites permission. Invitations are sent as calendar events, never through mail APIs.
12.3.RESTRICTING THE SCOPE OF CALENDAR ACCESS
Microsoft’s consent model grants Calendars.ReadWrite tenant-wide, which means it is technically capable of reaching every mailbox in the tenant. MeetConvert only ever addresses the mailboxes of the users designated as campaign owners.
We therefore recommend, as a standard onboarding step, that customers apply a Microsoft Exchange Online application access policy restricting the Meeting Creator application to a named security group of campaign owners. This reduces the permission’s actual reach to those mailboxes with no loss of functionality. Instructions are provided in the MeetConvert onboarding documentation, and the product’s built-in health check reports when calendar access to a campaign owner’s mailbox has been denied.
12.4.WHAT REACHES POWERDATA DYNAMICS, AND WHAT DOES NOT
The following never leaves the customer’s tenant: participant names, e-mail addresses and contact data; campaign content; invitation text and attachments; calendar events; attendance reports and records. These are created and stored in the customer’s own Dataverse environment and Microsoft 365 tenant.
The following is transmitted to our licensing service at licence.powerdatadynamics.com, for the sole purpose of verifying an active subscription:
These are technical identifiers of an organisation and its environment. No participant data, no meeting content and no attendance data is transmitted.
The access token with which MeetConvert calls Microsoft Graph is issued by our licensing service to an environment that presents a valid licence credential for an active subscription. The token is short-lived and is limited to the permissions listed in section 12.2.
12.5.HOSTING AND SUB-PROCESSORS FOR THE LICENSING SERVICE
The licensing service is operated by PowerData Dynamics UG (haftungsbeschränkt) on Microsoft Azure in the West Europe region (European Union), with Microsoft Ireland Operations Limited acting as sub-processor for that hosting. No transfer to a third country takes place for this service.
12.6.RETENTION
Licence registrations and subscription records are retained for the duration of the customer’s subscription, and thereafter for as long as statutory retention obligations require. Licence-check audit records are retained in accordance with the MeetConvert retention schedule, which is available on request.
12.7.DATA SUBJECT RIGHTS IN RELATION TO MEETCONVERT
Because campaign and participant data is held in the customer’s own environment, requests from data subjects concerning that data should be addressed to the customer as controller. MeetConvert provides the customer with a built-in function that locates and erases all records relating to a given e-mail address across its tables, so that the customer is able to satisfy such requests. For data that we process as controller, described in sections 1 to 11, please contact us at contact@powerdatadynamics.com.
13.SALESGUARD – SETUP AND THE SALESGUARD UPDATER
This section applies to organisations that install and use our SalesGuard product for Microsoft Dynamics 365. Visitors to this website are covered by sections 1 to 11 and are not affected by this section.
It describes the personal data that PowerData Dynamics UG (haftungsbeschränkt) (“PowerData”, “we”) processes when your organisation sets up and uses SalesGuard in a Microsoft Dynamics 365 (Dataverse) environment. PowerData is the controller for the processing described in this section.
13.1.YOUR BUSINESS DATA
Your business data in SalesGuard, such as opportunity names and values, account and contact names, amounts, SalesGuard rule definitions and scores, is held in your own Dataverse environment. None of the requests that SalesGuard or its Setup page send to PowerData’s service has a field for these data. Sending diagnostics reports to PowerData is not available in the current version of SalesGuard. Section 13.4 describes what the SalesGuard Updater, a service account in your environment, can technically access.
13.2.SETTING UP SALESGUARD
When an administrator runs SalesGuard Setup, the Setup page in the administrator’s browser sends the following to PowerData’s setup service:
Our service then directs the administrator’s browser to Microsoft to sign in and approve SalesGuard. When Microsoft returns the administrator to our service, we receive the result of the approval or a one-time authorisation code. If Microsoft reports an error, we keep the Microsoft error code but not the error text. We exchange authorisation codes with Microsoft for tokens and check them. From the tokens we use your tenant ID and the administrator’s Microsoft Entra object ID (a pseudonymous identifier of the administrator’s account) to make sure that the same administrator of the same tenant completes every step. The sign-in name that we read from a token is used only to prepare the next sign-in step and is not stored; the sign-in name that the Setup page sent is kept only in the encrypted form described in section 13.3. The tokens that Microsoft returns can contain further profile details, such as the administrator’s display name; we do not read them into any field, and we do not store or log them.
In the same request, and with the administrator’s permissions, our service completes the installation in your environment:
The records our service reads and writes in your environment are SalesGuard’s installation records, security roles and the two application users. It does not read opportunity, account or contact records.
Our service holds tokens and authorisation codes in memory for the duration of the request only. It does not store or log them, does not return them to the browser, and does not request a refresh token.
SalesGuard in your environment also retrieves our service status and our public signing keys, for example to verify the installation proof. These requests carry no content; only the technical connection data described in section 13.5 is transmitted.
13.3.WHAT WE STORE FROM SETUP
All of the following is stored in Microsoft Azure Table Storage, region West Europe.
a) Setup session
Storage period: a setup session expires after 15 minutes. An automatic clean-up deletes expired session records, unused sign-in step entries and counters at the earliest 24 hours after expiry; the clean-up runs when a new setup session is started. In any case, we delete these records at the latest 30 days after they were created.
b) Installation replay protection
Tenant ID, environment ID, installation job ID, correlation ID, technical references to the installation challenge (an ID and a hash), the result and timestamps. This prevents an installation approval from being used twice or for a different tenant or environment. Storage period: we delete these records at the latest 12 months after they were created.
c) Updater registration: see section 13.4.
13.4.SALESGUARD UPDATER
During setup, SalesGuard creates an application user named SalesGuard Updater in your environment. It is a service account intended for installing future SalesGuard updates. Once installation has completed, it holds Microsoft’s built-in System Customizer role and the SalesGuard Updater role, and it does not hold the System Administrator role. (Microsoft’s interface first creates an application user with the System Administrator role; our service removes that role in the same request, and if it cannot confirm the removal the installation does not complete. The same applies to the SalesGuard Engine.)
The SalesGuard Updater role allows it, among other things, to create, read and change SalesGuard’s own setup and status records, to read SalesGuard licence records, users, security roles and customisation metadata, to read plug-in registrations and to change plug-in step registrations. The SalesGuard Updater role contains no privilege on opportunity, lead, account, contact or activity records.
The System Customizer role is a Microsoft role and allows much more. On 5 October 2026 we read its privileges in a SalesGuard test environment with SalesGuard 1.1.0.119. There, it allows its holder to create, read, change and delete:
It also allows its holder to change the customisations of your environment: to import, export and publish customisations, to create, change and delete tables, columns, solutions and workflows, and to change web resources. Customisations can include code that runs in your environment. If your organisation has changed the System Customizer role, its privileges in your environment can differ.
This means: in the current version of SalesGuard (1.1.0.119), the SalesGuard Updater can technically read, change and delete all opportunities and leads in your environment.
No PowerData process signs in as the SalesGuard Updater, and no update has been delivered through it. Our commitment: we will not use the SalesGuard Updater to read, change or delete your business data. This is a commitment about how we use the Updater; its roles would technically permit more.
Your administrators can disable or remove the SalesGuard Updater application user at any time. SalesGuard keeps working without it; SalesGuard’s installation check can then show a warning for the Updater. Uninstalling the SalesGuard solution does not remove the application users or the four SalesGuard enterprise applications that your approval added in Microsoft Entra; remove them separately if required.
A later version of SalesGuard no longer sets up the SalesGuard Updater, and we will update this section when that version is released.
Updater registration: when the Updater is set up, we store in Microsoft Azure Table Storage, region West Europe: tenant ID, environment ID, environment URL, a status (pending or enrolled), the ID of the Updater application user, a one-way hash of the environment URL and a number between 0 and 99 derived from tenant ID and environment ID. The record describes environments, not people. It was created for the future delivery of SalesGuard updates through the Updater; at present no automated process reads it. Storage period: we keep the record for as long as the SalesGuard Updater that it describes can be present in that environment. Because uninstalling SalesGuard does not remove the Updater, the record is also kept after SalesGuard is uninstalled. At present we do not delete the record. Once we have set a fixed storage period for these records, we will state it here.
13.5.CONNECTION DATA AND OPERATIONAL LOGS
Every request to our service transmits the caller’s IP address and client identification (User-Agent) to Microsoft Azure, which hosts the service. For requests that the Setup page and the return from Microsoft’s sign-in send from the administrator’s browser, this is the administrator’s own IP address and browser identification; for requests from SalesGuard in your environment it is normally a Microsoft service address. Our application code does not read or log IP addresses or User-Agent data. Application Insights, which holds our logs (see below), may record User-Agent data. It can use an IP address to work out an approximate location (country, region and city) and stores that location; it then discards the IP address and stores 0.0.0.0 instead. According to our deployment configuration, we have not switched on the storage of IP addresses in Application Insights, and we have not switched on separate web server logs for the service. Microsoft may also record connection data, including IP addresses, in its own platform logs to operate and secure Azure. We cannot access these logs or set how long they are kept.
To operate, secure and troubleshoot the service, it writes logs and telemetry to Microsoft Azure Monitor (Application Insights), region West Europe. Logs written by our code contain technical identifiers such as environment ID, installation job ID, correlation ID, application and application-user IDs, status and error codes, and durations. Our code does not write the administrator’s sign-in name or Entra object ID, tokens or authorisation codes into these logs. One exception is outside our control: if Microsoft’s Power Platform administration interface reports an error when it creates an application user, we log its error code and a shortened copy of its error message; we do not control what that message says. Query parameters of incoming requests are removed from the telemetry. Telemetry collected automatically about our service’s outgoing requests to Microsoft services can contain your tenant ID, your Dataverse host name and your environment ID as part of the address called. Storage period: logs and telemetry are kept for 30 days and then deleted automatically.
13.6.WHERE DATA IS PROCESSED AND WHO RECEIVES IT
Our setup service, its storage and its logs run in Microsoft Azure, region West Europe, which is located in the Netherlands. Our Azure Storage account is locally redundant and is not replicated to another region. Microsoft processes these data for us as our processor. Our contracting party for Azure is Microsoft Ireland Operations Limited under the Microsoft Customer Agreement, and the Microsoft Products and Services Data Protection Addendum, which is part of that agreement, applies.
Recipients: Microsoft, as our cloud provider (Azure Functions, Azure Storage, Azure Key Vault for signing the installation proof, Azure Monitor). Microsoft also provides Microsoft Entra ID (sign-in), the Power Platform administration interface (creation of the application users) and your Dataverse environment; your organisation uses these services under its own agreement with Microsoft.
Microsoft can process some data outside the European Union, for example pseudonymised system logs that it uses for security, or data it accesses to provide support. For such transfers, the EU standard contractual clauses in Microsoft’s Data Protection Addendum apply; Microsoft is also certified under the EU-U.S. Data Privacy Framework.
13.7.LEGAL BASIS
We process the data described in sections 13.2 to 13.5, including the Updater registration, on the basis of Art. 6(1)(f) GDPR. Our legitimate interest, and your organisation’s, is to install SalesGuard securely and to operate, secure and troubleshoot the setup service. This includes checking that the same administrator of the same tenant completes every step, and preventing reuse of approvals. For the Updater registration, our legitimate interest is to know in which environments the SalesGuard Updater was set up. Your rights as a data subject, including the right to object to processing based on Art. 6(1)(f) GDPR, are described in section 10 (Rights of the data subject). Our contact details are in section 1.
13.8.SALESGUARD INSTALLATION AND UPDATE RECORDS
In addition to the records described above, we keep one installation record per environment so that we know which version of SalesGuard each environment runs, which environments need an update and whether an update worked. This installation record is separate from the installation replay-protection records in section 13.3, which have their own storage period.