POLICY PRIVACY — M365 Access Audit
1. DATA CONTROLLER AND CONTACT DETAILS
The data controller with respect to licensing data is: SOFTRONIC sp. z o.o., ul. J. H. Dąbrowskiego 79A, 60-529 Poznań, Poland, NIP (Tax Identification Number): 9721065862, KRS (National Court Register): 0000302690, District Court in Poznań, 8th Commercial Division of the National Court Register.
Trade name: ARVETIO.
Privacy contact: kontakt@arvetio.com (subject: “GDPR / privacy”).
With respect to audit data from the Microsoft 365 tenant, the data controller is the client organization; the application operates as a local tool on the client’s computer, and SOFTRONIC/ARVETIO does not receive, transmit, or store such data.
2. TWO SEPARATE DATA STREAMS
The application processes two completely separate data streams that are never combined: audit data (processed exclusively locally) and licensing data (transmitted to the ARVETIO backend).
3A. MICROSOFT 365 AUDIT DATA (LOCAL ONLY)
With the consent of the Microsoft 365 administrator, the application reads, in READ-ONLY mode: the inventory of SharePoint and OneDrive sites and files within the selected scope; permissions and access rights (roles, sharing links, guest/external access); and directory data necessary to identify users and groups (name, email/UPN, group membership, guest designation, and privileged account designation).
Purpose: access auditing and risk reporting for the client’s administrator. The data does not leave the client’s computer.
The read scope is limited to the minimum necessary permissions (Sites.Read.All, Files.Read.All, User.Read.All, Directory.Read.All, GroupMember.Read.All). The application does not make any changes to Microsoft 365.
3B. LICENSING DATA (ARVETIO BACKEND)
For license management, the application transmits the following to api.arvetio.com: the license key, installation identifier, tenant identifier, activation/verification timestamps, and application version.
Purpose: license activation and verification, support, and protection against unauthorized use. We do not collect audit content or end-user data for this purpose.
4. LEGAL BASES (GDPR)
Licensing data will be processed on the following legal bases and for the following purposes:
a) Entering into and performing a contract/order in connection with our business activities (pursuant to Article 6(1)(b) GDPR if you are our customer, or pursuant to Article 6(1)(f) GDPR if your data has been entrusted to us by another data controller).
b) Contact, sales and marketing activities – we respond to questions and requests for quotations submitted to us and send information based on the consents obtained (pursuant to Article 6(1)(a) GDPR).
c) Compliance with a legal obligation incumbent on the controller, license protection, and security (pursuant to Article 6(1)(c) and (f) GDPR).
5. STORAGE AND SECURITY
Audit data: stored exclusively locally in a SQLCipher database encrypted with a 256-bit key protected by Windows DPAPI (LocalMachine).
Licensing data: stored in Microsoft Azure (West Europe); transmission is secured via HTTPS/TLS.
6. RECIPIENTS AND SUB-PROCESSORS
Microsoft Azure (hosting of the licensing backend).
We do not disclose audit data to anyone (we do not have access to it).
We do not use data obtained through the Microsoft API for advertising or marketing purposes.
7. RETENTION PERIOD
Audit data: stored locally in accordance with the configured retention settings (by default, the last 10 scans); uninstalling the application permanently deletes the local database and certificate.
Licensing data: stored for the duration of the license and for the period required by applicable law.
8. DATA SUBJECT RIGHTS
Right of access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent: kontakt@arvetio.com.
You also have the right to lodge a complaint with the President of the Polish Data Protection Authority (UODO).
9. WITHDRAWING MICROSOFT 365 CONSENT
At any time: https://myapps.microsoft.com (My Apps → M365 Access Audit → Remove) or in Microsoft Entra: Enterprise Applications → M365 Access Audit → Permissions/Remove.
10. COMPLIANCE
This Policy is maintained at a level of protection at least equivalent to the Microsoft Privacy Statement (https://privacy.microsoft.com/privacystatement), in accordance with §5 of the Microsoft APIs Terms of Use.
11. BOT PROTECTION (CLOUDFLARE TURNSTILE)
To protect the service against automated abuse (bots, spam, and unauthorized orders), the portal and dashboard use the Cloudflare Turnstile service. When accessing the portal and when placing an order, the mechanism evaluates technical browser signals — including IP address, visit duration, and interaction patterns (e.g. cursor movements) — in order to distinguish a human user from a bot.
Turnstile does not use cookies for tracking and does not profile users for advertising purposes. The service provider is Cloudflare, Inc., acting as a data processor; the legal basis is the legitimate interest of the controller (Article 6(1)(f) GDPR) — protection of the service.
Details of data processing: https://www.cloudflare.com/turnstile-privacy-policy and https://www.cloudflare.com/privacypolicy.
12. COOKIES AND SIMILAR TECHNOLOGIES
What cookies are. Cookies are small text files saved by your browser on your device, which the service can read on subsequent visits. For the same purposes we may use technologies with a similar function (e.g. the browser's local storage — localStorage). A typical cookie contains the service's domain name, a storage time, and a unique value.
What we use cookies for. The Arvetio portal uses two categories of cookies:
- Essential (always active, cannot be disabled) — required for the portal to work correctly:
• maintaining the session and sign-in to the Client Panel,
• remembering the contents of your cart,
• remembering your cookie choices,
• protecting the portal against bots and abuse (Cloudflare Turnstile).
Legal basis: necessity for providing the service requested by the user and the legitimate interest of the controller (Article 6(1)(b) and (f) GDPR).
- Analytics (only with your consent) — if we enable analytics tools, they help us understand how you use the portal so that we can improve it. We set them only after you give your consent. Legal basis: consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
Managing consent. On your first visit we display a banner where you can accept all cookies or essential cookies only. You can change your choice at any time via the „Cookie settings" link in the portal footer.
Storage time. Session cookies are deleted when you close your browser; persistent cookies remain for a defined time or until you delete them.
Browser control. You can block or delete cookies in your browser settings. Disabling essential cookies may limit or prevent the use of the portal. Instructions for popular browsers:
• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge
• Safari (Apple): https://support.apple.com/en-us/safari
13. OTHER INFORMATION
Copyright. The content of the portal (texts, graphics, layout, the Arvetio mark) is protected under the Polish Act of 4 February 1994 on copyright and related rights. The copyright belongs to SOFTRONIC Sp. z o.o. Use of this content beyond permitted fair use requires our consent.
Liability. The portal is informational in nature. We make every effort to keep the presented data current and complete, but we give no warranty in this respect. We are not responsible for the content of external websites linked from the portal.
Product information. Information, specifications, and screenshots reflect the state as at the date of publication. We may change the offer, features, and pricing at any time; the terms in force at the time of purchase are binding.
Changes. We may update this Privacy Policy. The current version is always published here together with its version number and date.
Effective date: 23 October 2026