Privacy Policy

1) Who we are (Controller and Processor)

Azendent Partners, LLC (“Team Venti”, “we”, “us”) is a remote-first, cloud-first Microsoft partner headquartered in Austin, Texas. We act as the controller for personal data we process for our own purposes (for example, marketing, website operation, sales, contracting, billing, account administration, recruitment, and security), unless a product-specific notice states otherwise. When we process personal data on behalf of, and under the instructions of, a customer (for example, end-user data within the Team Venti Services and Products), we act as a processor and the customer is the controller. In that case, this Policy is supplemented by the applicable Data Processing Agreement (DPA), and requests about that data are directed to the relevant customer/controller (see Section 12).

2) Scope

This Policy covers all personal data we collect or process in the context of marketing, sales, contracting, delivery, support, billing, and operation of the Team Venti Services and Products and our related websites and apps. It applies to employees, contractors, candidates, customers, partners, website visitors, and end users.

3) Our privacy commitments

We operate a privacy program aligned with the GDPR principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Our operational processes for implementing these principles are documented in our Data Handling Processes (Privacy Principles) and are supported by defined privacy governance and roles, including a Data Protection Officer (DPO). We align our technical and organizational controls to our independently examined SOC 2 (Security) control framework, which covers access control, encryption, network security and segmentation, threat and vulnerability management, security monitoring and reporting, incident response, change management, vendor risk management, and business continuity and disaster recovery (BC/DR).

4) What data we collect

• Business contact & account data. Name, employer, role/title, business email, phone, preferences; contract, order, and licensing information.
• Service operation data. Microsoft tenant/instance identifiers; Teams, calling, queue/auto-attendant and call detail records (CDRs) necessary to provide analytics and contact center features; technical telemetry (logs, device/OS/browser, IP addresses, timestamps, event metadata) used for quality, reliability, and security.
• Support interactions. Ticket content, diagnostics, recordings/screenshots you choose to share, and troubleshooting artifacts.
• Billing & compliance. Billing contacts and addresses; transaction history; tax identifiers where applicable.
• Recruitment data. CV/résumé details, work history, and interview records (for candidates).

We do not intentionally collect special category data. If a use case requires it, we will implement heightened safeguards and, where required, obtain explicit consent beforehand.

5) Sources of data

• Directly from you or your organization (forms, emails, support).
• From our services (telemetry and usage necessary to run the features you use).
• From Microsoft services that you authorize us to access (e.g., Teams Graph APIs).
• From partners/resellers you work with (subject to contracts).
• From our websites (teamventi.com, 365cloudstore.com, teamspowerpack.com, blueskyuc.com).

6) How we use data & our lawful bases (GDPR Art. 6)

The table summarizes the lawful bases (recorded in our RoPA) for Team Venti’s typical processing and the key purposes. If we later introduce a materially different purpose, we will update this Policy and our notices.

Processing activity	Examples of purposes	Lawful basis
Service delivery & operations (contact center, analytics, reporting)	Routing calls/queues, generating call metrics, wallboards, PowerPack analytics	Contract; Legitimate interests (service improvement and quality)
Security, fraud, abuse, and service integrity	Access control, logging, monitoring, vulnerability scans, incident response	Legitimate interests; Legal obligation where applicable
Customer support	Troubleshooting, replicating issues, communicating resolutions	Contract; Legitimate interests
Billing & collections	Invoicing, payment reconciliation, accounting	Contract; Legal obligation (tax, accounting)
Marketing to business contacts	Product updates, webinars, newsletters, event registration and follow-ups	Consent where required (e-privacy rules); otherwise Legitimate interests with opt-out
Recruitment & hiring	Evaluating candidates, interviews, pre-employment steps	Legitimate interests; steps prior to entering a contract
Legal requests & enforcement	Respond to lawful requests, enforce terms	Legal obligation; Legitimate interests

Where we rely on legitimate interests, we perform and document a balancing test in our RoPA. You can object to such processing (see Rights below).

7) Cookies & similar technologies

We use only what is necessary to run our sites and services and, where enabled, analytics/marketing cookies. Where required, we obtain consent and honor your choices via our cookie banner and preferences center. See our Cookie Notice for details.

8) How we share data (disclosures & subprocessors)

We share personal data only with:

• Subprocessors and subservice organizations needed to run our services. Our core hosting and infrastructure subservice organizations are Microsoft 365 (operated by Microsoft), Microsoft Azure, and Zoho Corporation (including Zoho Vault for secrets storage). These are treated as carve-out subservice organizations in our SOC 2 (Security) report; we perform due diligence, monitor them, and require security and privacy commitments in our agreements, including DPAs.
• Partners/resellers you direct us to work with.
• Professional advisors (legal, audit) under confidentiality.
• Authorities where legally required or to protect rights, safety, and security.

We do not sell personal data. We maintain a subprocessor register and manage subprocessor changes through our vendor governance process.

9) International data transfers

Where data moves outside the EEA/UK (for example, to the U.S. with Microsoft Azure or other providers), we implement appropriate safeguards such as the EU Commission’s Standard Contractual Clauses (SCCs) and the UK IDTA/Addendum, plus technical and organizational measures (encryption, access controls, need-to-know). We monitor legal developments and will adjust transfer mechanisms as needed.

10) Security

We apply layered technical and organizational measures aligned to our SOC 2 (Security) control environment, including identity and access management (RBAC and MFA via Microsoft Entra ID), encryption in transit and at rest, network segmentation, regular vulnerability scanning and remediation, dependency scanning, anti-malware, security monitoring and log management, incident response with post-incident reviews, change management, and at least annual penetration testing. We also operate vendor risk management and BC/DR exercises. Access to production data is restricted on a least-privilege, need-to-know basis and is subject to periodic access reviews.

11) Retention

We retain personal data only as long as necessary for the purposes described, or as required by law or contract, and we review retention at least annually. Retention is governed by our Data Retention & Disposal Policy and Data Classification Standard. Key points include:

• End of contract. When a customer contract ends or a verified deletion instruction is received, we return or delete Customer Data within 30 days, unless a longer period is required by law or agreed in writing. Data held in backups ages out within the backup retention window.
• Account/profile data (controller). Duration of the account plus a short grace period.
• Operational, authentication, and security logs. Typically up to 12 months; audit logs up to 24 months.
• Support tickets. Typically up to 24 months.
• Billing, tax, and contract records. Retained per applicable statutory and accounting requirements (typically up to 7 years).
• Marketing leads. Until opt-out or a defined period of inactivity.

When no longer needed, data is securely deleted or irreversibly anonymized, and disposal is tracked. Legal holds override standard retention periods.

12) Your rights (EU/UK GDPR)

You have the right to request:

• Access to your personal data and a copy in a portable format.
• Rectification of inaccurate or incomplete data.
• Erasure (in defined circumstances).
• Restriction of processing.
• Objection to processing based on our legitimate interests (including direct marketing).
• Withdrawal of consent at any time where processing is based on consent (without affecting prior processing).
• No solely automated decisions with legal or similarly significant effects, and human review if we ever use such decisions.

How to exercise your rights: contact privacy@teamventi.com. We acknowledge requests within 3 business days and respond within one month, which may be extended by up to two further months for complex or numerous requests (we will tell you if an extension applies). To protect your data, we verify your identity before disclosing personal data or taking irreversible action, requesting only the minimum information needed. Where a request concerns data we process on behalf of a customer (processor role), we will direct you to, or coordinate with, the relevant customer/controller. Our handling of these requests follows our Privacy Procedures — Data Subject Requests & Identity Verification. You may also lodge a complaint with your local supervisory authority. Requests from individuals in other jurisdictions (for example, under applicable U.S. state privacy laws) are handled under the same procedures to the extent those laws apply.

13) Children’s data

Our services target business users and are not directed to children. We do not knowingly collect personal data from children.

14) Changes to this Policy

We will update this Policy to reflect changes in our practices or legal requirements and will post a prominent notice for material changes, including the effective date.

15) Product-specific notices

Certain products (for example, the Teams PowerPack platform, including its Customer Experience/contact center capabilities) may include additional privacy details about the data types processed (such as call detail records and Teams analytics) and specific retention or configuration options. Those notices supplement this Policy and should be read together with it.

16) Contact

Data Protection Office — privacy@teamventi.com If you are in the EU/UK, you may also contact your local supervisory authority at any time.

Appendix A — Summary of key safeguards tied to SOC 2 (Security)

• Information security and access control policies; RBAC; MFA and single sign-on (Microsoft Entra ID); password standards; periodic access reviews.
• Network segmentation (Azure Network Security Groups); secure transmission (TLS); encryption at rest.
• Security monitoring and log management (Microsoft Defender for Cloud, Azure Monitor); regular vulnerability scanning; dependency scanning (GitHub Advanced Security); anti-malware (Microsoft Defender); at least annual penetration testing and remediation.
• Incident response (detection, containment, notification, recovery) with post-incident reviews.
• Change management (authorization, testing, approvals, protected branches).
• Vendor risk management (subprocessor register, periodic assessment, and review of subservice organizations’ assurance reports).
• Business continuity and disaster recovery with periodic testing.

Document control: Owned by the DPO. Reviewed at least annually and upon material changes in processing or law. Aligned with the Team Venti SOC 2 (Security) report (examination period 1 August 2025 – 31 January 2026) and the related privacy and security documents listed above.