Back

Data Protection Policy

Last Updated: 2026-10-11

1 Purpose & Scope

1.1 This Data Protection Policy (“ Policy ”) sets out the principles, roles, and operational practices governing the collection, use, disclosure, storage, and protection of personal data by VNXT Technologies DWC-LLC (the “ Company ”, “ we ”, “ us ”, or “ our ”) across two distinct contexts: (a) personal data collected through our marketing website located at pxm.vn3xt.com (the “ Website ”), where the Company acts as a data controller; and (b) personal data processed through PxM, our AI-powered strategy and performance management platform, built natively on the Microsoft Power Platform (the “ Platform ”), where the Company acts as a data processor on behalf of its customers.

1.2 This Policy operates alongside, and should be read together with, the following documents: the Privacy Policy, the Cookie Policy, the Data Processing Agreement (“ DPA ”) entered into with customers of the Platform, and the separate contractual terms entered into with the customers governing their use of the Platform. In the event of any conflict between this Policy and the DPA in respect of Customer Data, the terms of the DPA shall prevail.

2 Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below. Where applicable, these definitions are intended to align with the General Data Protection Regulation (“ GDPR ”), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“ CCPA/CPRA ”), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) (“ UAE PDPL ”), and other applicable data protection laws:

Applicable Data Protection Law	All data protection and privacy laws applicable to the processing of personal data under this Policy, including without limitation the GDPR, UK GDPR, CCPA/CPRA, and UAE PDPL, as amended or superseded from time to time.
Controller	The entity that determines the purposes and means of processing personal data.
Customer Data	Personal and business data that a customer, or its authorized users, submits to, generates within, or stores in the Platform in the course of using the Platform, including strategic planning, execution, and performance measurement data.
Data Subject	An identified or identifiable natural person to whom personal data relates.
Personal Data	Any information relating to an identified or identifiable natural person, including but not limited to names, contact details, identification numbers, and online identifiers.
Processing	Any operation performed on personal data, whether or not by automated means, including collection, recording, storage, use, disclosure, and deletion.
Processor	The entity that processes personal data on behalf of, and under the instructions of, a controller.
Special Category Data	Personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or other categories afforded heightened protection under applicable law.
Sub-processor	A third-party engaged by a processor to carry out specific processing activities on behalf of a controller.

3 Roles and Responsibilities

The Company’s role in relation to personal data differs depending on the context in which the data is processed. This section clarifies those roles so that customers, regulators, and other relevant parties can readily identify the applicable framework of accountability.

3.1 Website and Lead Data

In respect of personal data collected through the Website, including data submitted via the “Get a Demo” form and other contact or subscription forms, the Company acts as an independent data controller. The Company determines the purposes and means of processing such data, as further described in the Privacy Policy.

3.2 Customer and Platform Data

In respect of Customer Data submitted to, generated by, or otherwise processed through the Platform in the course of a customer’s use of the Platform, the customer acts as the data controller and the Company acts as a data processor, processing such data solely on the documented instructions of the customer and in accordance with the terms of the applicable DPA. The Company does not determine the purposes for which Customer Data is processed and does not use Customer Data for its own independent purposes, except as strictly necessary to provide, secure, support, and improve the Platform, or as otherwise permitted under the DPA.

3.3 Underlying Microsoft Infrastructure

The Platform is built natively on the Microsoft Power Platform and is integrated with Microsoft 365, Dynamics 365, and Microsoft Copilot. Microsoft Corporation (or its relevant affiliate) acts as a sub-processor in respect of the underlying cloud infrastructure, storage, and computing services on which the Platform operates. Microsoft’s processing of Customer Data is governed by Microsoft’s own data protection terms applicable to its enterprise cloud services, which are incorporated by reference into the Company’s sub-processor arrangements as described in section 8 of this Policy.

3.4 Summary of Roles

Context	Role
Website / Lead Data	Company = Controller
Customer / Platform Data	Customer = Controller; Company = Processor
Underlying Microsoft cloud infrastructure	Microsoft = Sub-processor

4 Categories of Personal Data Collected

4.1 Website and Lead Data

In connection with the Website, the Company collects the following categories of personal data: full name; business email address; job title and department; company name and industry; business telephone number; country or region; content of any free-text inquiry or message submitted through a contact or demo request form; and technical data collected automatically, including IP address, browser and device information, referral source, and Website usage data, as further described in the Cookie Policy.

4.2 Account and User Data (Platform Customers)

In connection with the provisioning and administration of customer accounts on the Platform, the Company collects the following categories of personal data on behalf of, and as instructed by, its customers: user names, business email addresses, and role or permission designations of authorized users; authentication data, including data associated with single sign-on via Microsoft Entra ID or equivalent identity provider; login history and session metadata; and support communications and related correspondence.

4.3 Customer Data Processed Through the Platform

1. As part of the ordinary operation of the Platform, customers and their authorized users may input, upload, or generate Customer Data comprising strategic plans, objectives and key results, execution and project data, performance metrics, dashboards, reports, and related business content. Such Customer Data may incidentally include personal data relating to the customer’s own personnel, such as names, roles, and performance-related information, where the customer chooses to include such information within the Platform.
2. Where a customer enables integration between the Platform and its own human resources systems or platforms as part of the Integration Ecosystem described in the Platform’s documentation, the Company will process personal data received through that integration ( i.e . employee names, roles, reporting lines, or resource capacity and allocation data) as an anticipated and deliberate category of Customer Data, rather than an incidental one. In such cases, the customer is responsible for ensuring it has an appropriate legal basis and has provided any necessary notices to the relevant individuals prior to enabling the integration, consistent with section 14 (Customer Responsibilities) of this Policy.
3. The Company does not determine the content or categories of Customer Data submitted by customers, whether entered manually or received through an enabled integration, and processes such data solely as instructed.

4.4 Special Category Data

The Company does not knowingly collect or process Special Category Data through the Website or in the ordinary operation of the Platform. Customers are responsible for ensuring that they do not submit Special Category Data to the Platform other than where strictly necessary and in compliance with Applicable Data Protection Law, and for notifying the Company where such data is submitted so that appropriate safeguards may be applied.

5 Sources of Personal Data

The Company collects personal data from the following sources: directly from individuals, such as through forms submitted on the Website or during account provisioning; automatically, through the individual’s use of the Website or the Platform, including via cookies, log files, and similar tracking technologies; from customers, in respect of Customer Data and user account data submitted or generated in connection with the Platform; and from Microsoft identity and directory services, where a customer elects to enable single sign-on or directory synchronization as part of its Platform configuration.

6 Purposes and Legal Bases for Processing

The Company processes personal data only for specified, explicit, and legitimate purposes, and relies on the following legal bases, as applicable under the GDPR, UK GDPR, and equivalent provisions of other Applicable Data Protection Law.

Responding to demo requests and inquiries	Legitimate interest; steps taken at the request of the data subject prior to entering into a contract
Sales and marketing communications	Consent, or legitimate interest where permitted under applicable law
Website operation, security, and improvement	Legitimate interest
Provisioning and administering customer accounts	Performance of a contract with the customer
Processing Customer Data within the Platform	Performance of a contract; processing on documented instructions of the customer as controller
Providing AI-assisted features (including Copilot integration)	Performance of a contract; legitimate interest in delivering the contracted functionality of the Platform
Compliance with legal obligations	Compliance with a legal obligation
Establishing, exercising, or defending legal claims	Legitimate interest

Where processing is based on consent, individuals may withdraw such consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal, in accordance with section 12 of this Policy.

7 AI and Automated Processing

The Platform incorporates artificial intelligence features, including integration with Microsoft Copilot, to support strategic planning, execution tracking, and performance analysis. This section describes the principles governing the use of personal data and Customer Data in connection with such AI features.

7.1 No Use of Customer Data for Model Training

The Company does not use Customer Data, or personal data contained therein, to train, fine-tune, or otherwise improve any underlying foundation model, including Microsoft Copilot or any other third-party AI model, except with the prior written consent of the relevant customer. AI-generated outputs within the Platform are produced using the customer’s own data at the time of the request, in accordance with the architecture and data handling commitments of the underlying Microsoft Copilot and Power Platform AI services.

7.2 AI Interaction and Prompt Data

Where a user submits a prompt or query to an AI feature within the Platform, the content of that prompt, together with any associated output, may be logged for the purposes of service delivery, troubleshooting, abuse prevention, and service improvement, subject to the data handling commitments described in this Policy and the applicable DPA. Such logs are treated as Customer Data and are subject to the same access controls, retention limitations, and security measures as other Customer Data.

7.3 Human Oversight

AI-generated outputs within the Platform, including recommendations, summaries, and performance insights, are intended to support and inform decision-making by the customer’s personnel and are not intended to constitute automated decision-making producing legal or similarly significant effects without human involvement. Customers remain responsible for reviewing and validating AI-generated outputs before relying on them for material business decisions.

7.4 Underlying Microsoft AI Services

AI features within the Platform that rely on Microsoft Copilot or other Microsoft AI services are subject to Microsoft’s own data protection and responsible AI commitments applicable to its commercial cloud and Copilot offerings, which govern matters such as data residency, retention of prompt and response data, and safeguards against use of customer data for training Microsoft's foundation models.

8 Data Sharing and Sub-processors

The Company does not sell personal data. The Company may share personal data with the following categories of recipients, in each case subject to appropriate contractual safeguards requiring the recipient to protect such data in accordance with Applicable Data Protection Law.

• Microsoft Corporation and its relevant affiliates, as the underlying infrastructure and platform provider for Microsoft 365, Dynamics 365, the Power Platform, Azure, and Microsoft Copilot.

• Website hosting, form processing, and content management service providers supporting the operation of the Website.

• Customer relationship management (“ CRM ”), email marketing, and sales engagement platforms used to manage leads and customer communications.

• Analytics providers used to understand Website usage, as further described in the Cookie Policy.

• Professional advisers, including legal, accounting, and audit service providers, where necessary in connection with the operation of the business.

• Regulators, law enforcement, courts, or other public authorities, where required by law or necessary to protect the rights, property, or safety of the Company, its customers, or others.

• A successor entity in the context of a merger, acquisition, financing, or sale of business assets.

A current list of sub-processors engaged in connection with the Platform, including the name, location, and function of each sub-processor, is maintained separately and made available to customers upon request or, where applicable, through a published sub-processor list referenced in the DPA. The Company will provide customers with reasonable advance notice of any intended addition or replacement of a sub-processor, in accordance with the terms of the applicable DPA, to enable the customer to object on reasonable grounds where required under Applicable Data Protection Law.

9 International Data Transfers

9.1 Personal data processed by the Company may be transferred to, stored, and processed in countries other than the country in which the relevant individual or customer is located. Where Customer Data is transferred outside the region in which it originates, such transfers are, wherever possible, made within the data residency boundaries selected by the customer for its Microsoft 365, Dynamics 365, and Power Platform tenant, consistent with Microsoft’s data residency commitments for its enterprise cloud services.

9.2 Where cross-border transfers of personal data occur, the Company relies on appropriate safeguards recognized under Applicable Data Protection Law, including Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, adequacy decisions issued by competent authorities, or other lawful transfer mechanisms, as applicable. Further detail regarding specific transfer mechanisms applicable to a customer’s data may be requested through the Company’s privacy contact identified in section 18 of this Policy.

10 Data Retention

10.1 The Company retains personal data and account data only for as long as reasonably necessary to fulfil the purposes for which it was collected, in accordance with the following principles:

Website lead and inquiry data	Retained for the duration of the prospective relationship and for a reasonable period thereafter, or until the individual requests deletion, whichever is earlier
Customer account and user data	Retained for the duration of the applicable subscription term and for twenty-four (24) months thereafter to support account recovery and legal compliance
AI prompt and interaction logs	Up to ninety (90) days, for service delivery, troubleshooting, and abuse-prevention purposes
Customer Data within the Platform	Retained for the duration of the applicable subscription term and deleted or returned in accordance with the customer’s instructions and the terms of the DPA following termination or expiry of the subscription
Data required for legal, tax, or regulatory compliance	Retained for seven (7) years from the end of the relevant financial year.

10.2 Upon termination or expiry of a customer’s subscription to the Platform, the Company will, in accordance with the terms of the applicable DPA, delete or return all Customer Data within a commercially reasonable period, except to the extent retention is required by Applicable Data Protection Law.

11 Data Security Measures

11.1 The Company implements technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction, proportionate to the nature and sensitivity of the data processed. These measures include, without limitation, the following:

• Encryption of data in transit and at rest, leveraging the security capabilities of the underlying Microsoft Azure, Microsoft 365, Dynamics 365, and Power Platform infrastructure.

• Role-based access controls and the principle of least privilege.

• Multi-factor authentication and single sign-on integration via Microsoft Entra ID, where enabled by the Customer.

• Data governance, classification, and loss prevention through Microsoft Purview, which applies sensitivity labels, data loss prevention policies, and policy enforcement to Customer Data processed within the Platform, consistent with the customer’s own regulatory and organizational requirements.

• Multilayered threat protection through Microsoft Defender, including Defender for Office 365, Defender for Endpoint, and Defender for Cloud Apps, providing advanced threat detection, safe file handling, and real-time risk mitigation across identities, devices, applications, and cloud workloads.

• Continuous security monitoring and incident detection through Microsoft Sentinel, which provides cloud-native SIEM and SOAR capabilities, using real-time analytics, correlated logs, and automated investigation to detect and respond to threats across Azure, Microsoft 365, and the Platform's supporting infrastructure.

• Logging and monitoring of access to Customer Data and administrative systems.

• Regular review and testing of security controls, including vulnerability management practices.

• Contractual security obligations imposed on Sub-processors, including Microsoft, consistent with their respective enterprise cloud security commitments.

• Personnel data protection and confidentiality training, and confidentiality obligations applicable to employees and contractors with access to personal data

  1. Where the Company or its sub-processors hold independent security certifications or attestations, details are available to Customers upon request.

12 Data Subject Rights

12.1 Individuals whose personal data is processed by the Company may have certain rights under Applicable Data Protection Law, subject to the exceptions and limitations set out in the relevant law. These rights may include the right to be informed of the processing of personal data; the right to request access to personal data held about them; the right to request correction of inaccurate or incomplete data; the right to request erasure of personal data; the right to request restriction of processing; the right to object to processing carried out on the basis of legitimate interest or for direct marketing purposes; the right to request portability of personal data; and the right to withdraw consent at any time, where processing is based on consent.

12.2 Where an individual’s personal data is processed as part of Customer Data, and the Company acts as a processor, the Company will direct any request received directly from a data subject to the relevant customer as controller, and will provide reasonable assistance to the customer in responding to such requests, in accordance with the terms of the applicable DPA. Individuals with queries regarding personal data processed within a specific organization’s use of the Platform should, in the first instance, contact that organization directly.

12.3 Requests relating to Website or lead data may be submitted directly to the Company using the contact details set out in section 18 of this Policy. The Company will respond to verified requests within the timeframe required under Applicable Data Protection Law and may request additional information to verify the identity of the requester prior to fulfilling a request

13 Data Breach Notification

13.1 The Company maintains procedures to detect, investigate, and respond to incidents involving the unauthorized access, disclosure, alteration, loss, or destruction of personal data (“ Security Incidents ”).

13.2 Where a Security Incident affects Customer Data, the Company will notify the affected customer without undue delay, and in any event within the timeframe specified in the applicable DPA, providing such information as is reasonably available regarding the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences of the incident, and the measures taken or proposed to address the incident and mitigate its effects. The Company will cooperate with the customer as reasonably necessary to enable the customer to comply with its own notification obligations under Applicable Data Protection Law.

13.3 Where a Security Incident affects personal data processed by the Company as controller, including Website or lead data, the Company will assess the incident in accordance with Applicable Data Protection Law and, where required, notify the competent supervisory authority and any affected individuals within the applicable statutory timeframe.

14 Customer Responsibilities

14.1 Where a customer acts as data controller in respect of Customer Data processed through the Platform, the customer is responsible for ensuring that it has a valid legal basis for the collection and processing of such data, including any personal data relating to its own personnel or third parties submitted to the Platform; that it has provided any notices, and obtained any consents, required under Applicable Data Protection Law prior to submitting personal data to the Platform; that it does not submit Special Category Data to the Platform other than where strictly necessary and lawful, and that it notifies the Company where such data is submitted; that it configures user access, roles, and permissions within the Platform in a manner consistent with the principle of least privilege; and that it promptly notifies the Company of any changes to its processing instructions that may affect the Company's processing of Customer Data.

14.2 The Company processes Customer Data solely on the documented instructions of the customer, as set out in the applicable DPA, and shall promptly inform the customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law.

15 Data Protection Governance

15.1 The Company maintains internal governance structures to oversee compliance with this Policy and Applicable Data Protection Law, including designated personnel responsible for privacy and data protection matters, internal policies and procedures governing data handling, periodic data protection impact assessments for higher-risk processing activities, and periodic review and audit of sub-processor arrangements and security controls.

16 Children’s Data

The Website and the Platform are intended for a business and professional audience and are not directed at, nor designed to attract, individuals under the age of 18. The Company does not knowingly collect personal data relating to children through the Website or in the ordinary operation of the Platform. If the Company becomes aware that it has inadvertently collected personal data from a child, it will take reasonable steps to delete such information promptly.

17 Changes to This Policy

The Company may update this Policy from time to time to reflect changes in its data processing practices, changes in Applicable Data Protection Law, or changes to the Platform or its underlying Microsoft infrastructure. Any material changes affecting customers will be communicated in accordance with the notice provisions of the applicable DPA or the contractual agreement with the Company. The “Last Updated” date at the top of this Policy indicates when it was most recently revised.

18 Contact Information

18.1 Questions, concerns, or requests regarding this Policy or the Company’s data protection practices may be directed as follows:

VNEXT Technologies DWC-LLC

Email : contact.pxm@vn3xt.com

18.2 Customers seeking to raise a request under the DPA should, in addition, contact their designated account or support representative in accordance with the escalation procedures set out in the applicable contractual agreement with the Company.