Data Processing Agreement
Last updated: October 12, 2026
This agreement describes how Power Portals LLC, doing business as Power Portals Pro ("we", "us"), processes personal data on behalf of customers ("you") who buy our offers through the Microsoft commercial marketplace. It forms part of the Microsoft Standard Contract that governs those purchases, with our amendment to it, as sections 2.1 to 2.4 of that contract provide, and uses its defined terms. It applies from the moment you purchase, without a separate signature; if you would like a signed copy, write to us and we will countersign this text. Our privacy policy covers the personal data we collect for our own purposes, such as your account on this website.
1. Definitions
- Personal data means any information relating to an identified or identifiable person that we process for you, and includes "personal information" and "personal data" as defined in the Data Protection Laws.
- Data Protection Laws means the laws that apply to our processing of that personal data, which may include: the comprehensive consumer privacy laws of US states, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and the privacy laws of Colorado, Connecticut, Texas, Utah, Virginia and other states; the EU General Data Protection Regulation ("GDPR"); the UK GDPR and Data Protection Act 2018; and the Swiss Federal Act on Data Protection.
- Controller, processor, data subject and similar terms have the meanings the Data Protection Laws give them. Under US state laws, "controller" includes "business", and "processor" includes "service provider".
2. Roles and instructions
You are the controller of personal data processed through our offers, and we are your processor. Where you act as a processor for someone else, we are your subprocessor. We process personal data only on your documented instructions, which are the Standard Contract, your order, these terms, and the work you ask us to do. If we believe an instruction would break the Data Protection Laws, we will tell you, and need not follow it.
3. What we process
| Offer | Personal data we process |
|---|---|
| Power Portals Pro licence | None of your portal's data: the portal runs on your infrastructure. A licence check sends us your organisation id, the portal's web address and its licence key, which are not personal data. |
| Full Service | The personal data your portal handles — typically the names, email addresses, sign-in details and records of your portal's users and your staff — as it passes through the hosting we run. It is stored in your own Microsoft Dataverse environment, not by us. Our hosting holds it only in short-lived memory caches and in application logs (requests, errors and performance), which are kept for at least 30 days and no more than 90 days, and used only to operate and support the portal. When we work in your environment at your request, we may see the data that work involves. |
- Purpose: to provide the offer you bought, and the support and other work you ask us for.
- Duration: for as long as your subscription lasts, and for our logs, the retention period above after that.
- Data subjects: those in section 2.3(b)(v) of the Standard Contract: your representatives and end users, and anyone whose personal data is in data you make available to us.
- Sensitive data: we do not need any sensitive or special-category personal data to provide our offers. If your portal handles it, you are responsible for deciding that it should, and for configuring the portal to protect it.
4. US state privacy laws
Where US state privacy laws apply, we act as your service provider or processor, and we:
- do not sell or share personal data, as the CCPA defines those terms, or use it for targeted or cross-context behavioural advertising;
- do not retain, use or disclose personal data for any purpose other than the purpose in section 3, or outside our direct business relationship with you, except as the Data Protection Laws allow a service provider to;
- do not combine personal data we process for you with personal data from any other source, except as those laws allow;
- comply with the obligations those laws place on us, give the personal data the same level of privacy protection they require of you, and tell you if we decide we can no longer meet them;
- accept that you may take reasonable and appropriate steps to make sure we use the personal data consistently with your obligations, and to stop and remediate any use that is not authorised.
We certify that we understand these restrictions and will comply with them.
5. Where it is processed
Full Service hosting runs in Microsoft Azure data centres in the United States, unless we agree another Azure region with you. Your Dataverse environment stays in the region you chose for it with Microsoft.
6. Transfers out of the EEA, Switzerland and the UK
Where personal data from the European Economic Area is transferred to us outside it, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 apply, as Module Two (controller to processor), or Module Three (processor to processor) where you are a processor. They are incorporated into this agreement by reference, with these choices:
- Clause 7 (docking clause) applies.
- Clause 9: option 2, general written authorisation, with the notice period in section 8 below.
- Clause 11: the optional language does not apply.
- Clauses 17 and 18: the law and courts of Ireland.
- Annex I: the parties, data and processing described in this agreement; Annex II: the measures in section 7 below; Annex III: our subprocessor list.
For transfers from Switzerland, the same clauses apply with the Swiss Federal Act on Data Protection in place of the GDPR and the Swiss Federal Data Protection and Information Commissioner as the supervisory authority. For transfers from the United Kingdom, the UK International Data Transfer Addendum issued by the Information Commissioner applies.
7. Security
- Portals are served over HTTPS only, with TLS 1.2 as the minimum.
- Our applications reach your Dataverse environment without passwords or stored secrets: the portal through an Azure managed identity, and our staff through a certificate whose private key cannot be exported from Azure Key Vault.
- Only authorised staff can use our administrative access, each through their own sign-in with multi-factor authentication.
- Each use of our administrative access — the certificate our staff sign in with — is logged with who used it and when, and the log is kept for 12 months.
- Each customer's hosting and logs are kept in Azure resources of its own, not shared with other customers.
- Your portal reaches only the tables and columns configured for it, and row-level restrictions are applied in the query sent to Dataverse.
8. Subprocessors
You consent to the subprocessors on our subprocessor list. We give at least 14 days' notice before a new subprocessor is given access to personal data, during which you may object. We bind each subprocessor to written obligations that protect personal data at least as well as this agreement, and remain responsible for their compliance with it.
9. Personnel
Everyone we authorise to process personal data is bound by confidentiality obligations.
10. Helping you meet your obligations
- Requests from data subjects. If a data subject asks us to exercise their rights over data we process for you, we will refer them to you. We will help you respond to such requests as section 2.3(c) of the Standard Contract provides. Because your portal's data is in your own Dataverse environment, most requests can be met there directly.
- Assessments. We will give you the information you reasonably need about our processing for a data protection assessment or a consultation with a regulator.
11. Personal data breaches
We will tell you without undue delay, and in any case within 72 hours, of becoming aware of a personal data breach affecting data we process for you, with what we know at that point, and keep you informed as we learn more.
12. Return and deletion
Your data stays in your Dataverse environment, so it remains yours when the subscription ends; there is nothing for us to return. When it ends we remove the hosting, and our application logs are deleted at the end of their retention period, unless a law requires us to keep them longer.
13. Audits
We will make available the information needed to demonstrate our compliance with this agreement, as section 5.2 of the Standard Contract provides, in the first instance through a security questionnaire or our own written answers.
14. Precedence and liability
Where the Standard Contractual Clauses apply, they prevail over anything else in this agreement or the Standard Contract. Otherwise, if this agreement conflicts with the Standard Contract as amended, the Standard Contract applies. Each party's liability under this agreement is subject to the limitations of liability in the Standard Contract as amended.
Contact
Power Portals LLC (doing business as Power Portals Pro)
2998 E Lakeside Dr, Eagle Mountain, UT 84005
Email: support@powerportalspro.com