Data processing agreement

Version 1.3 · Applies from 20 October 2026 (the Danish version prevails)

In short

Who decides: You are the controller. We only process the data to deliver ModernSync and on your instructions.

Which data: Contact details (such as name, company, job title, email, phone and business address) of the people in the groups you choose. With add-ons, also appointments from a shared calendar and users’ own contacts, which are only read.

Why: To get colleagues into employees’ Outlook and phones. With add-ons, also shared calendars, alerts and an overview of contacts and runs.

How long: ModernSync doesn’t store your contact cards. They are only read and written during a run. What we do store, and for how long, is set out in Annex A.

Who and where: Our only sub-processor is Microsoft (Azure in the EU). We tell you before we start using a new one.

Your rights: You can remove ModernSync’s access in your Entra ID and have your setup and history handed over when you stop. If there is a security breach, we tell you as soon as possible.

If this differs from the text below, the text below applies.

The law (GDPR Article 28) requires a data processing agreement when we process personal data for you. It is accepted together with the Terms when you sign up.

Controller: The organisation signing up for ModernSync (“you”). Processor: Moderntech Consulting ApS, Danish CVR 39976498, Højmarksvej 36, DK-8700 Horsens (“we”).

1. What the agreement covers

We process personal data for you to deliver ModernSync, as described in Annex A. Our own data about portal users and billing is described in the Privacy Policy.

2. We follow your instructions

We only process the data on your instructions. The instructions are this agreement, the terms and the choices you make in the portal.
We don’t ourselves transfer data to countries outside the EU. Our subprocessor may transfer data to countries outside the EU if this happens under Annex B and a valid transfer basis in GDPR Chapter V. In that case we tell you, unless the law prohibits it.
If we believe an instruction breaks the law, we tell you.
You are responsible for being allowed to share the data and for telling employees about it.

3. Confidentiality

Everyone who processes the data for us is bound by confidentiality.

4. Security

We protect the data with the measures in Annex C. We may change them as long as security doesn’t get worse.

5. Sub-processors

You approve that we use the sub-processors in Annex B and that we may use others.
We tell you in reasonable time before we start using a new sub-processor, so that you can object. If you object, you can stop using ModernSync.
Our sub-processors must protect the data as well as we do. For Microsoft, this is done through Microsoft’s own data protection terms. We are responsible to you for our sub-processors meeting their obligations.

6. Helping you

If an employee asks about their data, we pass the request on to you and help you answer it, as far as we can.
We help you with security, breaches, impact assessments and contact with the supervisory authority, as best we can based on what we know.
We may charge for help beyond what ModernSync itself does, based on time spent.

7. Security breaches

If we discover a breach affecting your data, we tell you as soon as possible. We tell you what we know so you can report it to the supervisory authority. If we can’t provide all the information at once, we send the rest as we get it.

8. Documentation and audits

You can ask us to show that we comply with this agreement. This is primarily done in writing, e.g. with this agreement and Microsoft’s audit reports. If that isn’t enough, or a supervisory authority requires it, you or an independent auditor can audit us by agreement. You pay your own costs and our reasonable, documented costs of the audit.

9. When you stop

If a trial ends without you choosing a subscription, ModernSync removes the contacts and calendars it has created for you, and you are then offboarded (section 3 of the terms). This is part of your instructions. When you offboard, you choose whether ModernSync removes the contacts it has created for you or keeps them in your mailboxes. If you keep them, they are no longer updated and from then on are your own data. You can have your setup and history handed over first (see section 5 of the Terms). We then delete the data we have processed for you, unless the law requires us to keep it. There are no contacts to return, because we don’t store them. Your original data stays in your own Microsoft 365.

10. Liability and law

Liability between us follows section 8 of the Terms, also for claims under this agreement. The cap does not affect the right of data subjects to compensation under GDPR Article 82. If the terms say something different about personal data, this agreement applies. The agreement follows Danish law, and disputes are settled by the District Court of Horsens.

Annex A – What we process

Purpose. To get your organisation’s contacts into employees’ Outlook and phones. In addition, the add-ons you switch on yourself:

Calendar add-on: to show shared calendars in employees’ Outlook.
Alerts: to tell the recipients you name when a run is stopped or fails.
Check for outdated contacts: to show you contacts that users saved themselves and that are outdated or duplicated.
Run details: to show you which contacts a test run or run creates, updates and removes, and which mailboxes get the changes, so you can see the effect before and after.

What happens. Every night, and when you start a run, ModernSync reads the members of the group or contact folder you choose and creates, updates and deletes contacts in the mailboxes of the group you choose. If you have chosen Include external contacts on a rule, it also reads the external contacts (organisational contacts) that are members of the source group. The calendar add-on is a second app that you approve on its own. The calendar app reads the calendar of the shared mailbox you choose and the days you are closed, and it writes only to the calendars it created itself in the recipient group. Alerts are sent from one of our mailboxes in Microsoft 365. Only your own administrator can switch on the check for outdated contacts and run details. The check reads the contacts users saved themselves in the recipients’ mailboxes and compares them with the source. Users’ own contacts are not changed, except contacts without notes, private numbers or several email addresses that you have asked ModernSync to take over (Annex C).

Who it concerns.

The people in your source group or contact folder and, with Include external contacts, also the external people in your address book who are members of the source group.
The people in your recipient group.
The people you name as alert recipients.
With the check for outdated contacts, also the people users have saved as contacts themselves.

Which data.

Contacts: name, company, department, job title, office, email, phone numbers, business address, technical IDs and account status from Microsoft 365. For external contacts the same data, but without account status.
Calendar: subject, time and location of appointments in the shared mailbox you choose (only appointments the mailbox created itself or has accepted. Private and cancelled ones are skipped).
Alerts: the recipients’ email addresses.
Check for outdated contacts: name, email and phone numbers (mobile, business and home) of the contacts users saved themselves. They are read but not changed.
Run details: the name of the contacts a run changes, the names of the fields that change, and the name and email of the recipients that get the changes.

ModernSync is not intended for sensitive data (GDPR Articles 9 and 10). You choose the groups and the calendar and make sure they don’t contain such data.

What we store, and for how long. ModernSync doesn’t store the contact cards (numbers, addresses and the like) or the calendar appointments. They are only processed during the run. Otherwise we only store the following, for as long as you use ModernSync and no longer than stated here:

What	How long
Your setup: rules, calendar rules, the days you are closed and alert recipients	Alert recipients until you remove them. The setup is deleted 90 days after offboarding
Mailbox overview: the recipients’ name, email and technical ID plus status and time of the latest synchronisation	Deleted 90 days after offboarding
Leavers: the technical ID and the time the account was disabled or lost its licence	Until the contact has been removed
Change log, so it can be established who changed your setup: time, object ID and tenant ID of whoever did it, whether it was us, which call was made, and the names of the fields that changed. The content is not stored, except whether runs are test runs only, and the organisation’s status	12 months. Deleted 90 days after offboarding
Run history. It may contain technical error messages, and email addresses in them are masked before they are stored	12 months. Deleted 90 days after offboarding
Technical logs	30 days
Nightly backup of the setup (organisation name, company number, rules, alert recipients and acceptance of the terms) and the month’s usage, so we can restore them after a fault	30 days
Findings from the check for outdated contacts: the type of finding, whether it concerns phone or email, the name of the user’s contact and the name of the colleague, at most 50 findings per mailbox. Numbers and addresses are not stored, and contacts without findings are not stored at all	Replaced each time the mailbox is checked again. Deleted straight away when you switch the check off or offboard
Run details for the latest test run and the latest run: the names of the contacts that are created, updated or removed, which fields change (not their content), and the name, email and technical ID of the recipients that get the changes	Replaced by the next run of the same kind. Deleted after 30 days, and straight away when you turn them off or offboard

If what we store changes, we update this annex and let you know.

Annex B – Sub-processors

Sub-processor	What	Where
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland	Hosting (Microsoft Azure), sign-in (Entra ID) and sending alerts (Microsoft 365)	EU. Any transfers outside the EU are covered by Microsoft’s data protection terms with the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework

Your own Microsoft 365, where the contacts are, is your own supplier and not our sub-processor.

Annex C – How we protect the data

Least access: ModernSync consists of a contacts app and, if you choose the calendar add-on, a calendar app. Each app only has the permissions it needs. The contacts app can’t read email, calendars or files, and the permission for external contacts can only read. You approve the calendar app on its own, and it writes only to calendars it created itself. You grant and remove access in your own Entra ID.
Only its own contacts: ModernSync only changes contacts it created itself and the contacts you have asked it to take over with the setting Adopt existing contacts. A contact that is taken over has at most one email address and no notes, private numbers, birthday or other fields that ModernSync does not write itself. Other contacts with the same email belong to the user and are not touched. When the contacts stop (cancellation, trial end, deleted rule, recipient outside the group), the contacts taken over stay with the user without our marker. They are deleted only when the person is no longer in the group or contact folder the contacts come from, for example because the colleague has left or has been removed from the group. The check for outdated contacts reads users’ own contacts but does not change them.
Safeguards against mistakes: ModernSync has safeguards against deleting by mistake.
Separated customers: Each customer’s data and access are kept separate.
No passwords: ModernSync uses Microsoft managed identity instead of stored passwords or keys. The app you approve has no certificate and no password.
Encryption: Data is encrypted both when sent and when stored.
Access control: Authorised people at ModernTech have access to operations. Administrative accounts require multifactor authentication.
Monitoring: We are alerted automatically when operations fail.
Hosting in the EU: Microsoft Azure in the EU.

ModernSync Data Processing Agreement