Privacy Policy

AT Sigma Cube is a Microsoft 365-based digital workspace supporting collaboration between organisations. This short notice explains how we process personal data when inviting and identifying users, managing their access, and securely operating and supporting the service.

Business content processed in each Cube workspace is governed by the full privacy notice available in that workspace. That notice also identifies the controller responsible for the relevant service and provides its contact details.

Registered office: 1063 Budapest, Szinyei Merse u. 21., 1st floor, unit 5, Hungary

Privacy and incident reporting email address: **privacy@at-sigma.com**

AT Sigma Consulting Kft. ordinarily processes business content held in a Cube workspace as a processor acting on the documented instructions of the controller identified in that workspace. The full workspace privacy notice contains the details of the controller responsible for that content.

To provide access and operate the service, we may process in particular:

– name, work email address and represented organisation;

– technical identifiers associated with a Microsoft account and Microsoft Entra guest account;

– invitation, invitation-redemption and access status, and the configured display language;

– Cube roles, security-group memberships and permission data;

– sign-in, access, security and change logs, including IP address, device and browser data recorded by Microsoft;

– the content of support, privacy and incident reports, related communications and actions taken.

The data may come directly from you, your employer or the organisation you represent, the partner or client organisation responsible for the service, or Microsoft identity and security services.

We process the data to:

– invite, sign in and identify users;

– assign the appropriate role and access permissions;

– operate the Cube securely, verifiably and accountably;

– prevent, detect and investigate unauthorised access;

– handle support requests, privacy requests and incident reports;

– comply with legal obligations and manage legal claims.

The primary legal basis is the legitimate interest of AT Sigma Consulting Kft. and the organisations participating in the service in secure, controlled access and operation of the platform. Where a user is a contracting party as a natural person, processing may also be necessary to perform the contract. Compliance with a legal obligation may apply to privacy requests and incidents.

Routine business use of the Cube is not based on consent. We do not use access data to personalise advertising and do not sell personal data.

Access is limited to what is necessary for the recipient’s assigned duties and may include:

– authorised operations, support and security personnel and contractors of AT Sigma Consulting Kft.;

– appropriately authorised personnel of the partner or client organisation responsible for the relevant service;

– Microsoft and its subprocessors to the extent required to operate Microsoft 365 and Microsoft Entra ID;

– a competent authority, court or other recipient authorised by law.

– Access is removed when it is no longer required for the user’s assigned duties.

– User and contact profile data is retained for three years after access or the contact role ends, unless a shorter period is appropriate or a legal obligation, contractual record or legal claim requires longer retention.

– The applied Microsoft 365 audit-log retention period is 180 days.

– Support, privacy and incident cases are retained for five years after the case is closed.

The actual retention of some technical data generated by Microsoft services may also be affected by Microsoft’s service rules and by applicable lawful preservation or investigation requirements.

Subject to the applicable conditions, you may:

– request information about and access to your personal data;

– request correction of inaccurate data;

– request deletion or restriction of processing;

– object to processing based on legitimate interests;

– request data portability where its statutory conditions apply;

– lodge a complaint with the competent data-protection supervisory authority.

You may submit a request to **privacy@at-sigma.com**. If your request falls within the responsibility of another controller responsible for business content in a Cube workspace, we will forward it to the competent organisation without undue delay.

In Hungary, the competent supervisory authority is the **Hungarian National Authority for Data Protection and Freedom of Information (NAIH)**: https://www.naih.hu/.