Product Schedule — Olyteck Cyber

1. Processing

Purpose: Microsoft 365 security posture and sharing-hygiene service for SharePoint, OneDrive, Teams and Entra ID. A read-only scanner finds over-exposure (public and external sharing, guests, ownerless groups, admin and MFA gaps, risky apps, Secure Score gaps). As options, the Customer can let administrators fix what is found, give every employee a personal page ("My space") to review and fix their own shares, and run clean-up campaigns that ask the people concerned to do so, with reminders in Microsoft Teams. Processing is for security purposes only: Cyber is not used to measure productivity, assess performance or monitor the behaviour of the Customer's staff (master DPA §3, Purpose limitation).

Data minimisation: Counts findings, never files. Cyber reads configuration and permission metadata through Microsoft Graph; it never downloads file contents, message bodies or attachments. On Olyteck's servers it keeps findings per site, person, group or app (identifier, name, counts, flags, severity, dates), never share URLs or file contents. The detailed evidence of an administrator's deep scan (file names, paths, recipients) stays in that administrator's browser. File names reach the server in two cases only: a share an employee confirms in My space (the file name and the reason they typed, so the confirmation is remembered), and a fix waiting for an approval (up to 30 minutes).

AI / LLM: No AI / LLM sub-processors. Findings are produced by deterministic rules; no Customer data is sent to an AI service.

Microsoft Graph scopes:

• Scanner (application, read-only, consented once by an administrator): Sites.Read.All, Files.Read.All, Group.Read.All, GroupMember.Read.All, User.Read.All, Directory.Read.All, AuditLog.Read.All, Policy.Read.All, Reports.Read.All, SecurityEvents.Read.All, Application.Read.All, MailboxSettings.Read, SharePointTenantSettings.Read.All, Team.ReadBasic.All, TeamSettings.Read.All, TeamMember.Read.All, Channel.ReadBasic.All, ChannelMember.Read.All, IdentityRiskEvent.Read.All
• Sign-in (delegated, each user): openid, profile, email, User.Read
• Fixing (delegated, optional): Files.ReadWrite.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, User.Read, offline_access, openid, profile — acts as the signed-in person, within that person's own rights
• Teams messaging (optional): resource-specific TeamsActivity.Send.User (activity-feed notifications to people who have the Olyteck Teams app); for chat reminders, delegated Chat.Create, ChatMessage.Send, User.Read, offline_access, openid, profile from the one administrator who connects; Teams sign-in to the My space tab (access_as_user)

2. Optional processing

Each of the following is a separate option. Unless its heading says otherwise, it is off until the Customer enables it; switching one off stops the processing it describes. They are listed here so the Customer's own privacy notice, works-council information and legitimate-interest assessment can describe the configuration actually in use.

Fixing from Cyber (administrators and employees) Off by default

• What is processed: When a person clicks a fix (remove a sharing link, remove a person from a share or a group), Cyber performs it in Microsoft 365 as that person, with their own rights. To do so it keeps that person's Microsoft refresh token, encrypted (AES-256-GCM) with a key held outside the database. The action is recorded in Cyber's audit log (who, what, when; for a person removed from a share, their directory identifier and e-mail domain, never their address) and in the Customer's own Microsoft audit log.
• What is never processed: Nothing is changed without a person's click. The unattended scanner cannot write. Cyber never acts beyond the rights of the person clicking.
• Why: So that over-exposure can be closed where it is found, by the person entitled to close it.
• Permissions: The separate Fixing application (delegated permissions above), consented separately by an administrator.
• If switched off: Disconnecting in Cyber deletes that person's token; removing the application's consent in Entra stops all fixing at once. Scanning is unaffected.

My space (employee page) Available once the scanner is consented; used only by people who sign in by default

• What is processed: An employee who signs in sees the files and sites they share beyond their team, and who has access, read live from Microsoft 365. Their list is cached in their own browser to open quickly, and forgotten at sign-out. When they confirm that a share is needed, Cyber keeps the file name, the kind of share and the reason they typed, so the share is not raised again until the confirmation expires.
• What is never processed: The employee sees only their own shares and sites. File contents are never read. The cached list stays in the person's browser and is not sent to Olyteck.
• Why: The person who created a share is the one who knows whether it is still needed.
• Permissions: Scanner permissions (read), limited in the product to the signed-in person's own drive and sites; fixing uses the Fixing application if it is enabled.
• If switched off: Not offering the page to staff (and not running campaigns) means no employee confirmations are recorded. Confirmations are deleted 90 days after they expire or are withdrawn.

Clean-up campaigns Off — each campaign is created and launched by an administrator by default

• What is processed: From a recent scan, Cyber lists the people who own shares in the campaign's scope: name, first name, work e-mail, department, the number of their shares by kind at launch, and then where each person stands (not yet opened, opened, confirmed, closed, finished, excluded, message not delivered) and how many shares are left. Administrators see this per person and per department and can export the list to send the messages from the Customer's own mail system.
• What is never processed: No manager summary is produced, and no manager identifier is collected. No score, ranking or comparison between people is produced. Campaign data is not used for any purpose other than the campaign.
• Why: To close exposure across the organisation by asking the people concerned, and to show the before/after result to management and auditors.
• Permissions: Scanner permissions (read).
• If switched off: Per-person campaign data is deleted 90 days after the campaign closes (drafts never launched: 30 days); only the campaign's totals are kept as evidence.

Microsoft Teams: notifications and chat reminders Off by default

• What is processed: Campaign reminders shown in the Teams activity feed of the people concerned, and optionally sent as a Teams chat message from the account of one administrator who connects for that purpose. The message contains the person's first name, the number of shares to review, the deadline and a link to their My space. For chat, Cyber keeps that administrator's refresh token, encrypted (AES-256-GCM) with a key held outside the database.
• What is never processed: No file name or link to a file is ever sent. Cyber cannot read Teams chats or channels.
• Why: Reminders reach people where they work.
• Permissions: The separate Olyteck Messaging application and the Olyteck Teams app (permissions above), uploaded and assigned by the Customer's Teams administrator.
• If switched off: Removing the Teams app or its consent stops notifications; disconnecting the chat sender in Cyber deletes its token. Messages already delivered stay in Teams under the Customer's own Teams retention.

Teams sign-in to My space Off until the Customer installs the Olyteck Teams app by default

• What is processed: Inside Teams, the My space tab signs the person in with the identity Teams already holds (identifiers, name, sign-in name), on a cookie of its own.
• What is never processed: No password is seen. The tab has no access beyond what the browser page has.
• Permissions: Olyteck Messaging application, scope access_as_user.
• If switched off: Removing the Teams app stops it; the browser page keeps working.

Scheduled deep scans on Olyteck's servers Off (rhythm set by an administrator: never, weekly, every 2 weeks, monthly) by default

• What is processed: The OneDrive and SharePoint deep scan run on Olyteck's servers instead of in the administrator's browser. The file-level detail is processed in memory and discarded; only the per-person and per-site findings and counts are kept.
• What is never processed: No file names, paths or recipients are stored from a server deep scan.
• Why: Campaigns need a recent scan without an administrator keeping a browser open.
• Permissions: Scanner permissions (read).
• If switched off: Setting the rhythm back to never stops them; their findings expire under the retention below.

None of this is used to measure productivity, assess performance or monitor the behaviour of the Customer's staff — see master DPA §3, Purpose limitation.

3. Categories of personal data

• Microsoft 365 configuration and permission metadata, kept as findings: site, group, app and policy names; counts of public, external and organisation-wide shares; Secure Score and Conditional Access state
• Findings about people, kept for security: per-person sharing counts; whether an account has MFA registered and whether it is an administrator; whether a Copilot licence has been used in the last 30 days (last activity date, for licence management, not as a measure of work). Other identity views in the administrator console (guests, dormant accounts, risky users, sign-ins) are read live from Microsoft and not stored by Olyteck
• Users who sign in (administrators and employees): Entra object and tenant identifiers, name, sign-in name and e-mail, role, sign-in times and last sign-in IP address
• Employee confirmations in My space: file name, kind of share, the reason typed, dates
• Campaign rosters (if campaigns are used): name, first name, work e-mail, department, share counts, status and events
• Encrypted refresh tokens of people who connect the Fixing or Teams chat options
• Audit log of state-changing actions: who, what, when, IP address and browser
• Account and billing data (tenant administrators; Stripe customer created for administrators only)

4. Retention

Billing records are kept 10 years (French accounting law); audit logs 24 months — see master DPA §7.

5. Sub-processors

Each is bound by a written contract imposing data-protection obligations equivalent to the master DPA. This list is authoritative and version-dated.

6. Changes to this Schedule

Any addition or replacement of a sub-processor that materially handles Customer personal data is posted here at least 30 days before it takes effect, so the Customer can review and object on reasonable grounds. Customers may subscribe to e-mail notifications, or raise an objection, by emailing [email protected]. See the master DPA §6 for the full procedure, and the Trust Center for the company-wide view.