ModernSync Privacy Policy
Version 1.1 · Applies from 20 October 2026 (the Danish version prevails)
In short
- The contact cards: ModernSync doesn’t store your contact cards. It copies them between mailboxes in your own Microsoft 365 and processes them for you under the data processing agreement.
- Which data and why: We only keep what we need for sign-in, operations, alerts and invoicing. That is who signs in and what they do, the organisation’s setup and usage, the email addresses you enter, and technical logs.
- How long: Technical logs for 30 days, runs and the activity log for 12 months, the setup until 90 days after offboarding, and invoicing records for 5 years (Danish Bookkeeping Act). The table in section 3 has the full list.
- Who sees it: Microsoft runs ModernSync for us in the EU. Our auditor and our accounting software, Dinero, see invoice data. We never sell data or use it for marketing.
- Cookies: The portal uses no tracking cookies. The website only measures visits with Google Analytics if you say yes.
- Your rights: You can see, correct and delete your data and complain to the Danish Data Protection Agency. Write to privacy@modernsync.io.
- If this differs from the text below, the text below applies.
1. Who we are
Moderntech Consulting ApS, Danish CVR 39976498, Højmarksvej 36, DK-8700 Horsens. Write to privacy@modernsync.io if you have questions.
In this policy, “you” means your organisation or, where it is about portal users, you personally.
2. The contacts in your Microsoft 365
When ModernSync synchronises contacts, we process them on your behalf. This also applies to the add-ons your administrator switches on. What we process, and for how long, is set out in the Data Processing Agreement. If you are an employee of a customer and have questions about your contact details, contact your employer.
3. What we keep ourselves
| What | Why | How long |
|---|---|---|
| Name, username, object ID and role of people who sign in to the portal, and what they did | To give access and keep a record of who did what. The administrator who signed the organisation up also gets operational emails. These are a reminder before the trial ends, and one message if we pause synchronisation. We do that when ModernSync can no longer reach your organisation | Runs and who started them: 12 months. Activity log (object ID of whoever changed something, time and which fields): 12 months. Everything else: while you are a customer and up to 90 days after you offboard |
| Organisation name, country, company or VAT number, selected groups, number of mailboxes and runs | To deliver ModernSync and invoice | Runs: 12 months. Setup: while you are a customer and up to 90 days after you offboard. Invoicing records: 5 years from the end of the financial year (Danish Bookkeeping Act). The run history may contain technical error messages, and email addresses in them are masked before they are stored |
| Backup of your setup and the month’s usage | To be able to restore your setup and invoicing records after a fault | 30 days |
| The organisation’s tenant ID, the time of the first trial or activation and whether the extra trial has been used. No names | To keep to the rule that each organisation gets one trial period, also after the setup has been deleted (legitimate interest, Article 6(1)(f)) | 5 years after the setup is deleted |
| The operations contact you enter when you sign up (your sign-in email unless you change it) and other email addresses you enter for alerts | To tell you when a run is stopped by the delete guard or fails, when we cannot reach your organisation, and before the trial ends. The email is sent from one of our mailboxes in Microsoft 365 | Until you remove them, and at most until 90 days after you offboard |
| Technical logs (time, result and errors). An error from Microsoft may contain an email address | To run ModernSync and find errors | 30 days. Deleted automatically |
| What you write to us | To answer you | Until the matter is closed |
| Feedback you send from the portal: the type (suggestion, bug or other), your text, the page you were on and your object ID | To improve ModernSync and be able to answer you (legitimate interest, Art. 6(1)(f)) | 12 months, and deleted with your setup |
The legal basis is our agreement with you, Danish bookkeeping law and our interest in a secure, working service (GDPR Article 6(1)(b), (c) and (f)). Data about you as a portal user comes from your Microsoft sign-in. We make no automated decisions about you.
4. Who sees the data
- Microsoft runs ModernSync for us in the EU (Azure and Entra ID) and provides the mailbox we send alerts from (Microsoft 365). In the rare cases where Microsoft processes data outside the EU, this is covered by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
- The European Commission’s VAT register VIES: when you sign up, we check your company or VAT number (EU countries only). We send only the country code and the number, and we keep the answer (valid or not, the organisation’s name in the register and the time) as VAT documentation.
- Dinero (Visma Dinero ApS) is our accounting software and processes invoice data for us as a processor. That is the organisation’s name, address and company or VAT number, the contact person’s name and email, and the invoice amount. Dinero does not receive contact cards or other data about your employees. Dinero stores data in the EU. Some of Dinero’s sub-processors are outside the EU, for example in the USA, and this is covered by the EU Standard Contractual Clauses.
- Our auditor sees invoice data.
We share it with no one else.
5. Cookies and analytics
The portal uses no cookies for analytics or marketing. The browser remembers your sign-in while the tab is open, which language you chose and the date of the latest “What’s new” entry you have seen (local storage in the browser, no personal data, only so the portal can show what is new).
The website (modernsync.io) asks before it measures anything. If you say yes, we use Google Analytics to see which pages are read and where visitors continue to the portal. Google Analytics sets cookies (_ga and _ga_<id>) that expire after at most 13 months and records, among other things, pages, time, browser, device and approximate country. According to Google, Google Analytics does not store IP addresses. Data is kept in Google Analytics for 2 months.
- Legal basis: your consent (GDPR Article 6(1)(a) and the Danish cookie order).
- Recipient: Google Ireland Limited as processor. Google may process data in the USA. This is covered by the EU-U.S. Data Privacy Framework and the EU standard contractual clauses.
- Your choice is stored in your browser (not as a cookie) for 12 months. If you say no, Google Analytics is not loaded at all.
- Change your choice at any time under “Cookie settings” at the bottom of the website. If you withdraw consent, we delete the Google Analytics cookies in your browser.
6. Your rights
You can ask to see, correct or delete your data, restrict its use, receive a copy or object. Some data we must keep by law, such as for bookkeeping. Write to privacy@modernsync.io.
If you are unhappy, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, DK-2500 Valby, datatilsynet.dk, or to the supervisory authority in your own EU country.
7. Changes
We update this policy when needed. The latest version is always in the portal.