Privacy Policy

1. Introduction

Synchplus Consulting (Pty) Ltd ("Synchplus", "the Company", "we", "us"), a company registered in the Republic of South Africa (registration number 2023/710873/07; registered address Suite J, 165 West Street, Sandown, Sandton 2109, South Africa), is the controller of the account, enquiry and website information described in this policy, and processes the content you back up on your instructions as your processor. This Privacy Policy explains how we collect, use, store and protect personal information processed through the VaultFuzion platform, on this website, and when you enquire about VaultFuzion, including through Microsoft Marketplace. It applies to our partners (managed service providers), to organisations that contract with us directly, to the users of their tenants, and to anyone who contacts us. It does not depend on you having signed an agreement with us; where you have, any Data Processing Addendum in that agreement applies in addition to this policy.Kapardyn Inc., a Delaware corporation, contracts for and is responsible for the Services. Synchplus Consulting (Pty) Ltd (registration 2023/710873/07), South Africa, is the registered business that performs them and holds the Microsoft partner registration.

2. Information We Collect

Account Information:

• Name, email address, organisation name, and role
• Authentication credentials (securely hashed with an industry-standard algorithm)
• Multi-factor authentication enrollment data (encrypted at rest)

Enquiry Information (website forms and Microsoft Marketplace "Contact me"):

• Name, work email address, telephone number, company, job title, and country or region
• The notes you write to describe your needs, and the offer or page the enquiry came from
• Our correspondence with you about the enquiry

Microsoft 365 Data (backed up on your behalf):

• Exchange mailbox content (emails, calendar, contacts), and records of messages forwarded from those mailboxes
• OneDrive files and folders
• SharePoint site content
• Teams channel messages and files
• Entra ID configuration snapshots, sign-in and directory audit records

Platform Usage Data:

• Audit trail events (login, backup, restore, configuration changes)
• API access logs and session metadata

3. Purpose of Processing

We process personal information for the following purposes:

• Providing Microsoft 365 backup, restore, and protection services
• Entra ID configuration monitoring and drift detection
• eDiscovery, legal holds, and compliance reporting
• Account management, billing, and customer support
• Responding to enquiries, including Microsoft Marketplace "Contact me" requests, and following them up
• Platform security, fraud prevention, and abuse detection
• Tamper-evident audit logging for legal and compliance purposes

3A. Microsoft Marketplace "Contact me" Enquiries

VaultFuzion is listed on Microsoft Marketplace as a "Contact me" offer. When you select Contact me, Microsoft passes your enquiry to us so that we can respond. This section applies wherever you are located, including the United States, the EU and the United Kingdom.

• What we receive from Microsoft: your name, email address, telephone number, country or region, company and job title, any notes you typed into the enquiry, and the name of the offer and the marketplace action that generated it.
• Why we use it: to respond to your enquiry, to discuss your requirements and, if you go on to buy, to set up your account. We do not use it for unrelated marketing and we do not sell it.
• Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in responding to enquiries we receive. Microsoft asks for your consent before it shares your details with us, and you can end the conversation at any time by telling us.
• Where it is processed: by Synchplus Consulting (Pty) Ltd, a South African company, and by the hosting providers that run our platform. If you are in the EU or the UK this is a transfer outside your jurisdiction, protected as described in Section 8.
• How long we keep it: for as long as we need it to respond and follow up. We delete each sales enquiry 12 months after we receive it — each enquiry on its own schedule. An enquiry that leads to an agreement becomes part of that customer's records instead.
• Your choices: to have your details corrected or deleted, or to ask us not to contact you again, email info@kapardyn.com.

Microsoft keeps its own record of your enquiry under the Microsoft Privacy Statement; we are not responsible for Microsoft's processing.

4. Data Retention

Backup data is retained according to your configured retention policy, supporting configurable retention periods of up to 7 years. Retention policies are configurable per tenant with daily, weekly, and maximum-age parameters.

Audit trail records are retained for the full subscription period plus 2 years, forming a tamper-evident hash chain: each record’s hash is recomputable from its own contents, an edited record fails that recheck, a deleted record leaves a reference that no longer resolves, and each chain’s head is additionally anchored and signed on a nightly schedule.

When your agreement with us ends, we stop taking new backups and, for 90 days, keep the records we hold about your backups; the platform's restore functions, and any export function enabled for you, stay available for those 90 days (for a direct customer, we run the restores you request). During those 90 days, the retention policy configured for each tenant continues to apply. Backup content in a bucket you provide stays there; backup content in a bucket we provide is kept for the 90 days and then deleted from that bucket, once no S3 Object Lock retention period prevents it. After the 90 days we delete the records we hold about your backups (including the encryption keys, metadata, search indexes and your storage credentials) and, on request, confirm the deletion in writing. Copies in our encrypted database backups are deleted within 90 days after those records are deleted; from then on, backup content left in a bucket can no longer be decrypted. We keep the audit trail described above and our support-ticket records, keep our invoices, contracts, and billing and distributor records for the period the law requires, and keep a tenant's records while a legal hold applies. Cancelling a subscription, non-payment or a suspension of access does not by itself delete anything. We never remove an S3 Object Lock retention period; a bucket owner who holds the permission to bypass a governance-mode retention can remove one earlier.

5. Data Security

• AES-256-GCM encryption of backup content at rest, under per-tenant keys
• TLS 1.2 or later for data in transit to and from our portals and API
• Per-tenant encryption keys for cryptographic isolation
• Industry-standard password hashing with no plaintext storage
• Encrypted MFA secrets using platform master key
• MSP data isolation enforced at every API endpoint
• SHA-256 hash-chain audit trail for tamper-evidence

6. Rights of Data Subjects

Whether you are a customer, a user of a customer's tenant, a website visitor or someone who has enquired about VaultFuzion, you may ask us to:

• Access the personal information we hold about you
• Have inaccurate personal information corrected
• Have your personal information deleted: a sales enquiry outright; other information subject to legal hold, audit-trail and retention obligations
• Object to or restrict specific processing activities, including any direct marketing
• Port your data in a structured, machine-readable format

These rights arise under the data-protection law that applies to you (for example the GDPR or UK GDPR if you are in the EU or the United Kingdom); we honour them for everyone whose information we hold, wherever you are. Where we process information as a processor for one of our customers, we will refer your request to that customer and help them respond. To exercise any of these rights, contact us at the email address in the Contact section below. We respond to verifiable requests within thirty (30) days.

7. Third-Party Sharing

We do not sell or share personal information with third parties for marketing purposes. We may share data with: Microsoft (to access Microsoft 365 and Microsoft Entra ID through Microsoft Graph, and, for Microsoft Marketplace enquiries, as the source of the enquiry), the cloud infrastructure operators that provide the data-centre hosting and compute on which the Service runs, the storage provider that hosts a bucket we provide for your backups (if you use one), Peach Payments for card payments (we never see or store your card number), the email service we use to communicate with you, and law enforcement agencies or regulators when compelled by valid legal process. Backup content itself is written to an S3-compatible bucket: one you own and control (bring your own storage), or, for a direct customer, a bucket we provide. The servers that run the Service also hold the account, enquiry and operational data needed to run it and to respond to you; the Microsoft Entra ID configuration, sign-in and directory audit records we back up, which we also analyse to detect security threats; records of messages forwarded from the mailboxes we back up (who forwarded each one, and to which addresses); and, if eDiscovery search has been turned on for your tenant, an index of the text of your backed-up mail and attachments, calendars, contacts, files, Teams channel messages, Groups conversations and Planner. Where each category is processed is set out in Section 8.

8. Cross-Border Data Transfers

Backup content is written to the S3-compatible bucket you provide, in the region you choose, or, for a direct customer, to a bucket we provide, whose location we tell you on request; we do not move it. The other data described in Section 7 is processed by Synchplus Consulting (Pty) Ltd, a South African company, and by the hosting providers that run the Service, so it may be processed outside the country you are in, including in South Africa. Where the law that applies to you restricts such transfers (for example the GDPR or UK GDPR), we rely on the safeguards that law provides for: your request that we contact you, the performance of our contract with you, and, where a transfer mechanism is required, standard contractual clauses or equivalent safeguards agreed with you. Calls to Microsoft Graph are made to the Microsoft cloud that hosts your tenant. We maintain the security measures in Section 5 regardless of where data is processed.

9. Privacy Contact

Our privacy team can be contacted at:

10. Complaints

If you are not satisfied with our response to a privacy concern, contact us first at the address above and we will escalate it. You may also lodge a complaint with the supervisory authority in your country (for example the Information Commissioner's Office in the United Kingdom, or your national data protection authority in the EU). Customers with a signed agreement may also use the dispute-resolution process in that agreement.