​Customer Data in Your Microsoft Tenant

This section is particularly important for enterprise customers and their Data Protection Officers.

 

How the Time to Sell Software Processes Data

The Time to Sell software solution is deployed as a Microsoft Power Platform managed solution within the Customer's own Microsoft 365 tenant. When operating, the software:

• Reads Outlook Calendar data via Microsoft Graph API (read-only - no data is written to Outlook)

• Reads Microsoft Teams meeting metadata and transcripts via Microsoft Graph API (read-only)

• Reads CRM opportunity data from Dynamics 365, Salesforce, or HubSpot (read-only - no data is written to the CRM)

• Stores analysis results (time scores, pipeline scores, coaching feedback) in Microsoft Dataverse within the Customer's tenant

• Sends data to Azure OpenAI Service within the Customer's own Azure subscription for AI analysis

• Delivers reports via Microsoft Teams and Outlook within the Customer's tenant

 

Data Residency

All data processed by the Time to Sell software remains within the Customer's Microsoft 365 tenant and Azure subscription, except for active usage count for billing purposes. Specifically:

• No Customer personal data is transmitted to Time to Sell Limited's servers

• No Customer personal data is stored outside the Customer's Microsoft environment

• Azure OpenAI processing occurs within the Customer's own Azure subscription - not Time to Sell's infrastructure

• The Customer's existing Microsoft 365 data residency commitments apply to all data processed by the Time to Sell software

 

Data Controller and Processor Roles

In the context of the Time to Sell software operating within the Customer's tenant:

• The Customer is the Data Controller - they determine the purposes and means of processing their employees' personal data

• Time to Sell Limited is not a Data Processor in the ordinary course of service delivery, because we do not process Customer personal data on our infrastructure.

• Where a Customer requires a formal Data Processing Agreement (DPA) for compliance purposes, Time to Sell Limited will enter into a DPA. Contact enquiries@timetosell.ie to request a DPA.

 

Azure OpenAI and No Training on Customer Data

The Time to Sell software uses Azure OpenAI Service (GPT-4o) for AI analysis. The following commitments apply:

• Customer data is NOT used to train Microsoft's AI models

• Azure OpenAI API calls are made from within the Customer's own Azure subscription - Time to Sell Limited does not make API calls on behalf of customers

• Prompts and responses are not stored by Microsoft beyond the immediate API call (subject to Microsoft's Azure OpenAI data handling commitments)

 

​

Data Sharing and Third Parties

Time to Sell Limited shares personal data only in the following circumstances:

 

Microsoft

Time to Sell is published on the Microsoft Marketplace. Microsoft processes subscription and billing data on our behalf as part of the marketplace infrastructure. Microsoft's privacy practices are governed by the Microsoft Privacy Statement at privacy.microsoft.com.

Marketplace

We engage a third party to manage our Microsoft Partner Centre account and Marketplace listing. They may process limited business contact information in the course of this service.

Professional Advisors

We may share data with our legal advisors, accountants, and other professional service providers where necessary for the operation of our business. All such parties are bound by confidentiality obligations.

Legal Requirements

We may disclose personal data where required by law, court order, or regulatory authority, including the Data Protection Commission of Ireland.

Business Transfers

In the event of a merger, acquisition, or sale of Time to Sell Limited, personal data may be transferred to the acquiring entity. We will notify affected individuals in advance of any such transfer.

 

International Data Transfers

Time to Sell Limited is based in Ireland and operates primarily within the European Economic Area (EEA). Where we transfer personal data outside the EEA (for example, to Microsoft's global infrastructure), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission

• Adequacy decisions where applicable

• Microsoft's Data Protection Addendum, which includes SCCs for international transfers

 

Data Retention

 

​​

​

​

​

​

​

​

​

​

​

​

 

Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

 

Right                                                  What It Means

Right of Access (Art. 15)                  You can request a copy of the personal data we hold about you

Right to Rectification (Art. 16)         You can ask us to correct inaccurate or incomplete personal data

Right to Erasure (Art. 17)                 You can ask us to delete your personal data in certain circumstances

Right to Restriction (Art. 18)            You can ask us to restrict processing of your personal data in certain circumstances

Right to Data Portability (Art. 20)   You can request your personal data in a structured, machine-readable format

Right to Object (Art. 21)                  You can object to processing based on legitimate interests or for direct marketing

Right to Withdraw Consent (Art. 7)Where processing is based on consent, you can withdraw it at any time

Right to Lodge a Complaint           You can complain to the Data Protection Commission of Ireland at dataprotection.ie

 

To exercise any of these rights, contact us at enquiries@timetosell.ie. We will respond within 30 days. We may need to verify your identity before processing your request.

 

Security

Time to Sell Limited implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS 1.2 minimum) and at rest

• Access controls - only authorised personnel can access personal data

• Regular security reviews of our systems and processes

• Staff training on data protection and security

 

For data processed within the Customer's Microsoft tenant, security is governed by the Customer's own Microsoft 365 security configuration, including Microsoft Entra ID authentication, role-based access control, and Microsoft's enterprise security infrastructure.

 

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. The effective date at the top of this policy indicates when it was last updated.