Privacy Policy

Version: 1.0

Effective Date: 1st October 2026

This Privacy Policy explains how MSP SecureView LLC-FZ (“SecuVeo“, “we“, “our” or “us“) collects, uses, stores, shares and protects Personal Data when Customers access or use the SecuVeo platform, websites and related Services.

This Privacy Policy applies to:

This Privacy Policy should be read together with our:

  • Terms of Service;
  • Data Processing Agreement (“DPA”);
  • Cookie Policy (where applicable); and
  • any other policies published through the SecuVeo Policy Centre.

Where a conflict exists between this Privacy Policy and the Data Processing Agreement, the Data Processing Agreement shall prevail to the extent required by applicable data protection law.

By creating an account, accessing or using the Services, Customers acknowledge that they have read and understood this Privacy Policy.

1. Who We Are

The Services are provided by:

MSP SecureView LLC-FZ

Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates

Email: legal@secuveo.com

Website: https://secuveo.com

Application: https://app.secuveo.com

SecuVeo acts as a Controller for Personal Data it processes for its own website, account administration, billing, support, security and marketing purposes. For Personal Data processed through the Services on a Customer’s behalf, SecuVeo acts as a Processor where the Customer is the Controller, or as a Sub-Processor where the Customer processes data on behalf of its Client. That processing is governed by the Data Processing Agreement.

2. Definitions

For the purposes of this Privacy Policy:

Account Manager means an individual assigned to a Client within the Services who may appear on Security Review Reports and may optionally include a Meeting Call Link.

AI means artificial intelligence technologies used within the Services to assist with generating content, summaries, recommendations or other automated outputs.

Client means a customer or end customer of the Customer whose information may be stored within the Services.

Controller means the person or organization determining the purposes and means of processing Personal Data.

Customer means the individual or organization that has entered into the Terms of Service with SecuVeo.

Data Processor means an organization processing Personal Data on behalf of a Controller.

Microsoft Graph means Microsoft’s Graph API and associated Microsoft cloud services used to retrieve authorized Microsoft security information.

Microsoft Exchange Online means Microsoft’s cloud-based email service used by SecuVeo to retrieve authorized email security configuration information.

Microsoft Purview means Microsoft’s compliance platform used by SecuVeo to retrieve authorized compliance and data protection configuration information.

Personal Data means any information relating to an identified or identifiable natural person.

Policy Centre means the area within the Services where legal policies, notices and updates are published.

Processor means SecuVeo when processing Personal Data on behalf of Customers.

PSA means a supported Professional Services Automation platform integrated with the Services.

Report Compliance Record means the PDF audit record generated by the Services recording disclaimer acknowledgment information and related audit events.

Security Evidence means Microsoft security, email security, compliance configuration information, security settings, status information and related metadata retrieved through authorized Microsoft Graph, Microsoft Exchange Online and Microsoft Purview connections.

Security Review means an IT Security Review created using the Services.

Security Review Report means any report, PDF, recommendation summary, AI-generated content or related output generated through the Services.

Services means the SecuVeo cloud platform, websites, applications, software, integrations and related services provided by SecuVeo.

Sub-Processor means a third party engaged by SecuVeo to assist in providing the Services.

3. Scope of this Privacy Policy

This Privacy Policy applies to Personal Data collected through:

  • the SecuVeo websites;
  • the SecuVeo application;
  • Customer accounts;
  • Security Reviews;
  • Security Review Reports;
  • Report Compliance Records;
  • Microsoft Graph integrations;
  • Microsoft Exchange Online integrations;
  • Microsoft Purview integrations;
  • PSA integrations;
  • Support Tickets;
  • email communications;
  • platform usage;
  • cookies;
  • analytics technologies; and
  • any other interaction with the Services.

Independent third parties, including linked websites, Customer-selected PSA platforms, Microsoft services and payment providers, have their own privacy notices for processing they undertake independently. This Policy still explains SecuVeo’s collection, use and disclosure of Personal Data involving those services. Customer-directed processing by SecuVeo and its appointed Sub-Processors remains subject to the DPA and applicable transfer agreements.

Customers are responsible for reviewing the privacy policies of third-party providers they choose to connect to the Services.

4. Information We Collect

The type of Personal Data we collect depends upon how the Services are used.

4.1 Information Provided Directly by Customers

Customers may provide information including:

  • names;
  • business names;
  • email addresses;
  • telephone numbers;
  • job titles;
  • postal addresses;
  • for Customers completing a Data Transfer Agreement, legal entity details, registered or main business address, country, company registration number where applicable, representative name, role and contact information, and agreement acceptance records;
  • billing information;
  • payment information processed through third-party payment providers;
  • branding assets including company logos;
  • meeting scheduling links;
  • custom email domains;
  • DNS configuration information;
  • Support Ticket information;
  • attachments uploaded through Support Tickets;
  • account settings;
  • report templates;
  • Product Library information;
  • recommendations;
  • report content;
  • custom disclaimers;
  • and other information voluntarily submitted through the Services.

4.2 Platform User Information

Where Customers create User accounts, we may collect:

  • user names;
  • email addresses;
  • authentication information;
  • password hashes (where applicable);
  • Microsoft Single Sign-On identifiers;
  • Multi-Factor Authentication configuration information;
  • role assignments;
  • account status;
  • login history;
  • IP addresses;
  • browser information;
  • device information;
  • audit logs;
  • activity history;
  • and other information necessary to provide secure access to the Services.

4.3 Client Information

Customers may store information relating to their own Clients.

This information may include:

  • Client names;
  • company information;
  • primary contacts;
  • email addresses;
  • telephone numbers;
  • postal addresses;
  • Account Managers;
  • meeting scheduling links;
  • recurring billing information;
  • Security Review history;
  • recommendations;
  • Product Library information;
  • Security Review Reports;
  • audit history;
  • notes;
  • Internal Tasks;
  • and other information entered by Customers.

Customers remain responsible for ensuring they have the legal authority to collect, store and process such information using the Services.

4.4 Information Imported from PSA Platforms

Where Customers enable supported PSA integrations, the Services may import:

  • Client information;
  • Client Contacts;
  • recurring billing information;
  • products;
  • services;
  • Account Managers;
  • company identifiers;
  • contact information;
  • and other supported information made available through the connected PSA platform.

Customers remain responsible for reviewing and validating imported information before relying upon it.

4.5 Information Retrieved from Microsoft 365 Integrations

The Services may retrieve Security Evidence including:

  • Microsoft security configuration information;
  • Microsoft licensing information;
  • Microsoft Entra configuration information;
  • Conditional Access information;
  • multi-factor authentication configuration;
  • device compliance information;
  • BitLocker encryption status;
  • external sharing configuration;
  • guest access configuration;
  • administrator security configuration;
  • Exchange Online security configuration;
  • Safe Links configuration;
  • Safe Attachments configuration;
  • Anti-Phishing configuration;
  • external email forwarding configuration;
  • Microsoft Purview compliance configuration;
  • Data Loss Prevention policy configuration;
  • retention policy configuration;
  • Microsoft Defender information;
  • Secure Score information; and
  • other supported Microsoft security and compliance information.

Customers remain responsible for ensuring they have appropriate authority to access Microsoft Tenants connected to the Services.

4.6 Data We Do Not Intentionally Collect

The Services are not intended for special category or other highly sensitive Personal Data, including health, biometric or genetic information, information concerning racial or ethnic origin, religious or philosophical beliefs, political opinions or trade union membership, government identification numbers, and criminal convictions or offenses.

The Customer must not deliberately submit such information unless SecuVeo has separately agreed to the processing and the necessary lawful conditions, documented instructions and appropriate safeguards are in place. The Customer’s own lawful basis or need for the information does not, by itself, authorize that processing through the Services.

If such information is submitted unexpectedly, the parties shall cooperate to restrict access and arrange its removal or other lawful handling as appropriate. Each party retains its own applicable data protection obligations.

5. How We Use Personal Data

Where SecuVeo acts as a Processor or Sub-Processor, it processes Personal Data on the Customer’s documented instructions and for the purposes described in the Data Processing Agreement. Where SecuVeo acts as a Controller, it processes Personal Data for its own purposes as described in this Privacy Policy. The activities below may involve either role, depending on the data and circumstances.

Depending on how the Services are used, Personal Data may be used to:

  • provide access to the Services;
  • create and manage Customer accounts;
  • authenticate Users;
  • provide Microsoft Single Sign-On (SSO);
  • provide Multi-Factor Authentication (MFA);
  • process subscription payments;
  • administer subscriptions;
  • manage Subscription billing arrangements, including recurring payments, plan changes, billing adjustments, account credits and renewals;
  • generate Security Reviews;
  • generate Security Review Reports;
  • generate Report Compliance Records;
  • generate AI-assisted Executive Summaries;
  • generate AI-assisted Changes Since Last Review;
  • assist with AI-generated recommendations;
  • synchronize information from supported PSA platforms;
  • retrieve Security Evidence from authorized Microsoft Graph, Microsoft Exchange Online and Microsoft Purview connections;
  • deliver Security Review Reports;
  • deliver email notifications;
  • maintain audit logs;
  • provide customer support;
  • investigate suspected misuse of the Services;
  • detect, prevent and investigate fraud or unauthorized access;
  • improve the reliability, usability and security of the Services;
  • develop new features and functionality;
  • communicate important product, billing and policy updates;
  • comply with legal and regulatory obligations;
  • enforce our Terms of Service and other policies; and
  • protect the rights, property and security of SecuVeo, our Customers and third parties.

We will process Personal Data only where we have an appropriate legal basis to do so.

6. Artificial Intelligence Processing

Certain features within the Services use artificial intelligence (“AI”) to assist Customers in generating Security Review content.

AI-assisted functionality may include:

  • Executive Summaries;
  • Changes Since Last Review;
  • Recommendations;
  • PSA keyword recommendations;
  • deployment recommendations;
  • report drafting assistance;
  • historical comparisons;
  • and other AI-assisted functionality introduced from time to time.

AI-generated content is intended solely to assist Customers.

Customers remain solely responsible for reviewing, validating and approving all AI-generated content before relying upon it, distributing it or including it within any Security Review Report.

AI-generated content should not be considered legal, regulatory, financial, cybersecurity or professional advice.

6.1 Information Submitted for AI Processing

Depending on the feature being used, information submitted for AI processing may include:

  • Customer names;
  • Client names;
  • Security Review findings;
  • recommendations;
  • recurring billing information;
  • Product Library information;
  • Security Evidence, including Microsoft Graph, Exchange Online and Microsoft Purview Security Evidence;
  • report content;
  • historical Security Review information;
  • operational information required to generate AI-assisted outputs; and
  • other information reasonably necessary to provide AI-assisted functionality.

AI processing is limited to the Customer-authorized functionality and necessary provision, maintenance, security, support and abuse prevention for that functionality under lawful documented instructions and the applicable provider agreement. Personal Data in submitted report content remains subject to the DPA and applicable transfer safeguards. Any processing required by law remains subject to the applicable legal and contractual restrictions.

6.2 AI Service Providers

SecuVeo may use approved third-party AI providers to process information submitted for AI-assisted functionality.

Such providers act as authorized Sub-Processors under our Data Processing Agreement.

SecuVeo shall bind approved AI Sub-Processors to the obligations in DPA Section 11. Processing and retention must follow the applicable commercial API agreement, documented instructions and transfer safeguards, including any lawful security, abuse-prevention or legally required exceptions. SecuVeo does not use Customer Data to train public or third-party AI models and shall use commercial API arrangements that prohibit training on that data unless the Customer separately authorizes it. This Policy does not promise universal zero retention or a fixed provider retention period.

6.3 AI Accuracy

Artificial intelligence may generate inaccurate, incomplete, outdated or inappropriate content.

SecuVeo does not guarantee the accuracy, completeness or suitability of AI-generated outputs.

Customers remain solely responsible for:

  • reviewing all AI-generated content;
  • validating AI-generated information;
  • verifying recommendations;
  • confirming technical accuracy;
  • confirming legal and regulatory compliance;
  • and determining whether AI-generated content is appropriate before use.

7. Microsoft 365 Integrations

Where authorized by the Customer, the Services may connect to Microsoft Graph, Microsoft Exchange Online and Microsoft Purview to retrieve authorized Security Evidence from Microsoft 365 tenants.

Retrieved information may include:

Microsoft Graph

  • Microsoft Entra configuration information;
  • Microsoft security configuration information;
  • Conditional Access information;
  • Multi-Factor Authentication configuration information;
  • device compliance information;
  • disk encryption configuration information;
  • external sharing configuration information;
  • guest access configuration information;
  • administrator security configuration information;
  • Microsoft Defender information;
  • Microsoft licensing information;
  • Secure Score information;

Microsoft Exchange Online

  • email security configuration information;
  • email protection configuration information;
  • external email forwarding configuration information;

Microsoft Purview

  • compliance configuration information;
  • data protection configuration information;
  • information governance configuration information;

General

  • and other supported Microsoft security and compliance information.

This information may be used to:

  • populate Security Review Items;
  • generate Security Review Reports;
  • generate Executive Summaries;
  • generate Changes Since Last Review;
  • provide supporting Security Evidence;
  • compare historical security configurations;
  • automatically recommend deployment status for supported Security Review Items;
  • populate the Microsoft Security Evidence section of Security Reviews;
  • and assist Customers in completing Security Reviews.

Customers remain responsible for:

  • ensuring they have authority to connect Microsoft Tenants;
  • maintaining appropriate Microsoft authorizations and administrative permissions;
  • maintaining the Microsoft permissions required to authorize the connected Microsoft 365 tenant;
  • removing access when authorization no longer exists;
  • complying with Microsoft’s licensing requirements;
  • and validating all retrieved Security Evidence before relying upon it.

Microsoft 365 integrations are optional.

8. PSA Integrations

Where supported, Customers may connect Professional Services Automation (“PSA”) platforms to synchronize information with the Services.

Imported information may include:

  • Client information;
  • Client Contacts;
  • recurring billing information;
  • products;
  • services;
  • Account Managers;
  • company identifiers;
  • contact information;
  • and other supported information made available through the connected PSA platform.

Customers may alternatively:

  • import Client information using spreadsheet templates provided by SecuVeo; or
  • manually enter supported information within the Services.

Customers remain responsible for reviewing and validating all imported or synchronized information before relying upon it.

8.1 AI-Assisted PSA Matching

Where supported, the Services may use artificial intelligence to recommend keywords that may correspond to recurring billing items imported from supported PSA platforms.

Customers may:

  • accept AI-generated keyword recommendations;
  • modify AI-generated recommendations;
  • delete AI-generated recommendations; or
  • create their own keyword matching rules.

Based upon Customer-configured keyword matching rules, the Services may automatically recommend or populate deployment statuses for Security Review Items.

Customers remain solely responsible for reviewing and confirming all automatically populated deployment statuses before generating or distributing any Security Review Report.

8.2 PSA Opportunities and Tickets

Where supported by the connected PSA platform, Customers may create opportunities or service tickets directly from within the Services.

Information submitted to the PSA platform is controlled by the Customer.

SecuVeo does not guarantee the availability, successful synchronization or ongoing compatibility of any third-party PSA integration.

9. Report Generation

The Services generate Security Review Reports based upon information entered by Customers, imported from connected services and generated through supported automated functionality.

Generated reports may include:

  • Security Review findings;
  • recommendations;
  • Security Scores;
  • Product Library information;
  • AI-generated content;
  • Security Evidence retrieved from Microsoft Graph, Microsoft Exchange Online and Microsoft Purview;
  • recurring billing information;
  • cybersecurity framework references and alignments, including NIST CSF 2.0 and Cyber Essentials, where selected by the Customer;
  • historical comparisons;
  • executive summaries;
  • report branding;
  • Personal Data included by the Customer or generated from Customer-provided information;
  • and other information selected by the Customer.

Customers remain solely responsible for reviewing all report content before distribution.

SecuVeo does not independently verify the accuracy of Customer-supplied, imported or AI-generated information included within Security Review Reports.

10. Report Compliance Records & Disclaimer Acknowledgment

Where enabled by the Customer, recipients of Security Review Reports may be required to acknowledge a disclaimer before accessing a report.

As part of the acknowledgment process, recipients may be asked to provide the email address to which the Security Review Report was originally sent.

This information is collected solely to:

  • identify the acknowledging recipient;
  • maintain the report audit trail;
  • generate the Report Compliance Record;
  • demonstrate disclaimer acknowledgment;
  • assist Customers with compliance recordkeeping;
  • and help protect the integrity of report access records.

Report Compliance Records may include:

  • acknowledgment date and time;
  • the email address entered by the recipient;
  • IP address;
  • browser information;
  • device information;
  • and other audit information reasonably necessary to demonstrate report access and disclaimer acknowledgment.

This information is not used for marketing purposes.

11. Cookies and Similar Technologies

The Services use cookies and similar technologies to provide functionality, improve security, enhance user experience and analyze usage of the Services.

Cookies are small text files placed on a user’s device when visiting a website.

The Services may use:

  • essential cookies;
  • authentication cookies;
  • session cookies;
  • security cookies;
  • preference cookies;
  • analytics cookies; and
  • other similar technologies necessary to operate the Services.

Customers may configure browser settings to reject certain cookies. However, disabling certain cookies may affect the functionality or availability of parts of the Services.

Where required by applicable law, Customers will be provided with appropriate choices regarding the use of non-essential cookies.

A separate Cookie Policy may provide additional information regarding cookies and similar technologies used by the Services.

11.1 Essential Cookies

Essential cookies are required for the operation of the Services and cannot normally be disabled.

These cookies may be used to:

  • authenticate Users;
  • maintain secure login sessions;
  • provide Multi-Factor Authentication;
  • remember authentication status;
  • protect against fraudulent activity;
  • maintain platform security;
  • load balancing;
  • maintain application performance; and
  • provide other core functionality required to operate the Services.

11.2 Analytics

SecuVeo may use analytics technologies to better understand how the Services are used.

Analytics information may include:

  • pages visited;
  • features used;
  • session duration;
  • browser type;
  • operating system;
  • device type;
  • approximate geographic location;
  • referring websites;
  • IP address;
  • application performance metrics; and
  • usage trends.

Analytics information helps us:

  • improve the Services;
  • identify usability issues;
  • improve performance;
  • diagnose technical issues;
  • monitor reliability;
  • prioritize product improvements; and
  • understand how Customers interact with the Services.

Where possible, analytics information is aggregated or de-identified.

11.3 Preference Cookies

Preference cookies may be used to remember Customer preferences, including:

  • language;
  • display preferences;
  • time zone;
  • login preferences;
  • dashboard settings;
  • report preferences; and
  • other personalization settings.

12. Legal Basis for Processing

The legal bases in this Section apply where SecuVeo acts as a Controller and Applicable Data Protection Law requires a lawful basis. Where SecuVeo acts as a Processor or Sub-Processor, the Customer or its Client determines the lawful basis for that processing; SecuVeo processes the data under the DPA and documented instructions.

Performance of a Contract

Where an individual is personally a party to a contract with SecuVeo, we may process their Personal Data as necessary to perform that contract or take steps at their request before entering into it. This may include administering their Account or Subscription, providing support and processing payments. A contract with an organization does not by itself provide this lawful basis for processing its employees’ or representatives’ Personal Data.

Legitimate Interests

Where permitted by applicable law, we may process business-contact and account information for our legitimate interests in reviewing registration applications, managing our relationships with Customer organizations, administering Accounts and Subscriptions, authenticating Users, handling billing and support, and recording and administering agreement acceptance and transfer arrangements.

We may also rely on legitimate interests for maintaining security and reliability, monitoring performance, detecting fraud and misuse, investigating security incidents, maintaining appropriate business and security records, improving the Services, and establishing, exercising or defending legal claims. Where required, we assess necessity and balance these interests against the rights and freedoms of the individuals concerned. Processor data governed by the DPA is not repurposed for these independent purposes merely because it is held within the platform.

Legal Obligations

We may process Personal Data where necessary to comply with applicable legal obligations, including legally required financial or compliance records, binding court orders and valid requirements of competent public authorities. Contractual obligations and a general desire to enforce legal rights do not by themselves constitute this lawful basis.

Consent

Where consent is required and relied upon, we will obtain it separately for the relevant processing. Acknowledging this Privacy Policy or accepting the Terms or DPA does not itself provide blanket consent to processing. Consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent before withdrawal.

13. Sharing Personal Data

SecuVeo does not sell Personal Data.

We share Personal Data only where reasonably necessary to provide the Services, comply with legal obligations or protect our legitimate interests.

Depending upon how the Services are used, Personal Data may be shared with:

  • authorized Sub-Processors;
  • payment providers;
  • hosting providers;
  • authentication providers;
  • AI service providers;
  • email delivery providers;
  • analytics providers;
  • professional advisers;
  • auditors;
  • insurers;
  • regulators;
  • law enforcement authorities where legally required; and
  • other parties where disclosure is required or permitted by applicable law.

All recipients are expected to process Personal Data only for legitimate purposes consistent with this Privacy Policy and our contractual obligations.

13.1 Current Service Providers

SecuVeo uses the following providers for Customer-directed processing under the DPA:

  • Amazon Web Services EMEA SARL (Luxembourg): cloud hosting and storage, with primary infrastructure in Virginia (us-east-1), backups in Oregon (us-west-2) and PDF archive storage in Ohio (us-east-2), United States. Further service-specific processing locations are governed by the applicable AWS provider records and transfer safeguards.
  • Anthropic, PBC (United States): direct commercial API processing for AI-assisted report functionality. Data is stored in the United States; default processing traffic may be routed through the United States, Europe, Asia and Australia. Affiliate personnel may access data for authorized support, safety and incident handling as described in the applicable provider records.
  • The Rocket Science Group LLC d/b/a Mailchimp (United States), including Mandrill/Mailchimp Transactional: transactional email delivery involving names, email addresses and necessary message content. Hosting is in the United States. Its published provider records include further service-dependent locations, including Germany, the United Kingdom, Romania and Greece; listing these locations does not mean each handles SecuVeo data.
  • Ionx Solutions LLP (United Kingdom), trading as Verisys: malware scanning of uploaded attachments using the UK scanning endpoint. Files submitted for routine scanning are normally deleted when scanning finishes. Ionx’s published terms permit exceptional retention for legal requirements, disputes, fraud prevention and contractual enforcement. This processing, including any exceptional retention, is governed by a binding data processing agreement between SecuVeo and Ionx. SecuVeo shall ensure any required onward-transfer protections are in place before the affected transfer begins. Any retained Personal Data remains subject to applicable purpose, security and deletion requirements.

Stripe handles SecuVeo subscription billing, including names, email addresses, billing addresses and additional billing contacts supplied by the Customer. Its roles depend on the activity and the applicable Stripe agreement and privacy documentation. It is not listed as a report-processing Sub-Processor in the transfer agreements.

Authorized internal support staff and developers may access data from the United Kingdom, Spain, the United Arab Emirates and India, subject to confidentiality, access restrictions and any required transfer safeguards.

The accepted transfer agreement’s Schedule 4 provides the relevant provider records and onward-transfer protections. Public provider lists do not mean every listed location processes SecuVeo data or authorize unrestricted processing. Changes to Customer-data Sub-Processors follow the advance notice and objection process in DPA Section 11.

13.2 Professional Advisers

Personal Data may be disclosed where reasonably necessary to:

  • lawyers;
  • accountants;
  • auditors;
  • insurers;
  • compliance advisers; or
  • other professional advisers.

Such disclosures will be limited to information reasonably necessary for the relevant purpose.

13.3 Legal Requirements

SecuVeo may disclose Personal Data where we reasonably believe disclosure is necessary to:

  • comply with applicable law;
  • comply with a court order;
  • comply with lawful requests from public authorities;
  • establish, exercise or defend legal claims;
  • investigate fraud;
  • investigate security incidents;
  • enforce our legal rights;
  • enforce our Terms of Service;
  • or protect the rights, property or safety of SecuVeo, our Customers or others.

Where legally permitted, we will seek to notify the affected Customer before disclosing Personal Data.

Where legally permitted, SecuVeo may also challenge, narrow or seek clarification of requests that we reasonably believe are unlawful, invalid or disproportionate before disclosing Customer Data. Where an applicable transfer agreement requires notification, review of legality, challenge or minimization of disclosure, SecuVeo shall fulfill those obligations; this section does not make them optional.

14. International Data Transfers

SecuVeo is incorporated in the United Arab Emirates. The Services use AWS infrastructure in the United States, with primary hosting in Virginia, backups in Oregon and archive storage in Ohio. Anthropic uses United States storage with further processing and access locations described in Section 13.1. Mandrill/Mailchimp Transactional uses United States hosting with service-dependent further locations described there. Verisys scans attachments in the United Kingdom. Authorized internal support and development personnel may access data from the United Kingdom, Spain, the United Arab Emirates and India. These accesses remain subject to applicable transfer requirements.

Where international transfers require a legal safeguard, the parties will put an effective safeguard in place before the affected transfer, as described in the DPA. UK and EU/EEA Customers identified during approval of new Free Trial Accounts must complete and accept the applicable Data Transfer Agreement on first login before platform access is enabled. The completed agreement is available in their Policy Center.

The transfer agreement contains the applicable contractual safeguards and processing schedules. Applicable assessments and supplementary safeguards remain required; agreement acceptance does not replace them. SecuVeo’s own account-administration and business records are processed as described in this Privacy Policy and remain subject to their applicable legal requirements.

14.1 Data Security During Transfers

SecuVeo maintains technical and organizational measures described in the DPA, including encryption in transit and at rest, access controls, monitoring and recovery measures. Safeguards required under an applicable Data Transfer Agreement remain effective throughout the relevant processing, including any authorized PDF archive period. No method of transmission or storage can be guaranteed completely secure.

15. Data Security

For Customer Personal Data, SecuVeo maintains the measures required by DPA Section 7 and any applicable accepted transfer agreement, including its technical and organizational measures schedule. The description below does not reduce those obligations.

Security measures may include:

  • encryption in transit using TLS/HTTPS;
  • encryption at rest using industry-standard encryption technologies where appropriate;
  • Multi-Factor Authentication (MFA);
  • Microsoft Single Sign-On (SSO);
  • role-based access controls;
  • authentication monitoring;
  • audit logging;
  • secure password handling;
  • access controls;
  • vulnerability management;
  • continuous security and infrastructure monitoring;
  • encrypted backups;
  • Point-in-Time Recovery (PITR);
  • disaster recovery procedures;
  • regular backup integrity testing;
  • regular software updates; and
  • other technical and organisational measures designed to protect the confidentiality, integrity and availability of Personal Data.

Security measures may be reviewed and updated from time to time to address evolving threats, changes in technology and improvements to the Services.

Although SecuVeo uses commercially reasonable safeguards, no system, network or method of electronic storage or transmission can be guaranteed to be completely secure.

Customers remain responsible for maintaining appropriate security within their own organizations, including securing their User accounts, devices and connected systems.

15.1 Security Incident Notification

If SecuVeo becomes aware of a Personal Data breach affecting Personal Data processed on a Customer’s behalf, it will notify the affected Customer without undue delay in accordance with the Data Processing Agreement. Information may be provided in phases as the investigation progresses.

16. Data Retention

For Personal Data processed as Controller, SecuVeo uses the retention criteria below only to the extent lawful and necessary for the relevant purpose. Customer Personal Data processed as Processor or Sub-Processor is retained only under the Customer’s documented instructions, DPA Section 12 and applicable law. General business, security or dispute purposes do not independently authorize extended retention of Customer Personal Data.

Retention periods may vary depending on the type of information involved.

Information may be retained for:

  • providing the Services;
  • maintaining Security Review history;
  • maintaining audit records;
  • fraud prevention;
  • security investigations;
  • legal or regulatory compliance;
  • disaster recovery;
  • backup and restoration;
  • enforcing contractual rights; and
  • other legitimate operational purposes.

16.1 Customer Data, Suspension, Termination and PDF Archives

Customer Data is processed during provision of the Services under the Terms and DPA. Stripe’s Unpaid status initially restricts creation of new Security Review Reports. If non-payment continues, the notice and manual suspension process in Section 8.2 of the Terms applies. Suspension blocks login but does not itself delete Customer Data or cancel the Subscription.

During non-payment suspension, Customer Data remains protected and is retained for the limited purposes described in the DPA, including payment recovery, secure custody, authorized Support requests and return or deletion. Customers may contact SecuVeo Support before Account termination to request copies of available Security Review Reports or other records, subject to identity and authority verification and secure delivery arrangements. This does not restore platform access.

Once at least thirty (30) days have elapsed after non-payment suspension, a SecuVeo Admin may manually terminate the Account and cancel the Stripe Subscription. A separate manual deletion action removes the MSP Account and associated live records, including client/contact records, live PDF records, attachments and audit records. These actions are not automatic and do not authorize indefinite retention.

When live platform processing ends, SecuVeo returns or deletes Personal Data processed on the Customer’s behalf at the Customer’s choice under the DPA. A return request made before termination is handled before the relevant data is deleted. Associated live Customer Data that is not Personal Data is also removed through live Account deletion, subject to the separately authorized PDF archive and protected backup rules below.

Limited PDF recovery archive: Under the instructions in DPA Section 12.3, separately stored copies of generated Security Review Report PDFs may remain for up to two (2) years from live MSP Account deletion so the Customer can request recovery through Support. The archive contains only generated Security Review Report PDFs. Report Compliance Record PDFs and other files and records are deleted as part of live MSP Account deletion and are excluded from the two-year recovery archive, subject to the protected backup and legally required retention rules below. The archive does not restore the Subscription or platform access. SecuVeo verifies identity and authority before securely providing retained PDFs. Customers may end the archive service and request deletion at any time. A request to delete all Customer Personal Data includes archive copies unless the Customer expressly instructs otherwise. Archive copies are deleted at the end of the two-year period unless deleted earlier or retention is required by applicable law. They remain subject to the DPA’s security, confidentiality, transfer and Data Subject protection requirements throughout the archive period.

Backups and disaster recovery: Personal Data temporarily remaining in encrypted backup, Point-in-Time Recovery or disaster-recovery systems is protected, kept beyond ordinary use and deleted through the applicable backup cycle, which may be up to six (6) months. Applicable deletion instructions are reapplied before restored data is used for ordinary processing if a backup is restored before that period ends. This cycle does not extend the separate two-year PDF archive period. Data retained because applicable law requires it is limited to the required purpose and deleted when the required period ends.

SecuVeo’s own Controller records, such as billing, business-account and legally required records, may have separate lawful retention requirements. Mandatory return and deletion rights and applicable transfer-clause obligations remain unaffected by commercial access restrictions.

16.2 Client Retention and Scheduled Deletion

Customers may choose to hide a Client or schedule a Client for permanent deletion at a future date using functionality available within the Services.

Hiding a Client does not delete the Client or associated Customer Data. Where a Client is scheduled for future deletion, the Client and associated Customer Data will remain stored within the Services until the scheduled deletion date.

A Client may remain stored within the Services even where that Client has been removed from, deleted from, or is no longer returned by a connected PSA platform. Removal of a Client from a connected PSA platform does not automatically delete the corresponding Client or associated Customer Data from SecuVeo.

On the scheduled deletion date, the Client and associated Customer Data will be processed for permanent deletion. An instruction to permanently delete an individual Client also applies to that Client’s separately archived PDFs unless the Customer expressly instructs otherwise. Any copies temporarily remaining in backups or disaster-recovery systems and any retention required by applicable law follow the protection, restricted-use and deletion rules in Section 16.1 and the DPA. General operational purposes do not independently authorize retention of Customer Personal Data beyond lawful processing instructions and applicable law.

16.3 Audit Records

During the provision of the Services, audit information may be retained longer than other Customer-generated content where necessary to:

  • investigate security incidents;
  • demonstrate compliance;
  • resolve disputes;
  • protect the integrity of the Services;
  • comply with legal obligations; or
  • establish, exercise or defend legal claims.

When the Services end, Personal Data in audit records is subject to the return, deletion and lawful retention rules in Section 16.1 and the Data Processing Agreement.

Audit records may include:

  • login history;
  • authentication events;
  • administrative actions;
  • report generation history;
  • disclaimer acknowledgments;
  • Report Compliance Records;
  • Support Ticket activity;
  • account changes;
  • and other platform audit information.

16.4 Customer Copies and Data Return

Customers should download Security Review Reports and Report Compliance Records and export Audit Log data they wish to retain while platform access is available. During non-payment suspension, Customers may contact SecuVeo Support before Account termination to request copies of available reports or other records under Section 42 of the Terms and Sections 12.2 and 14 of the DPA.

After live Account deletion, the Customer may request copies of archived PDFs through Support during the authorized archive period, or request their deletion, as described in Section 16.1 and DPA Section 12.3. Secure delivery of records or return of Personal Data does not restore platform access. These arrangements do not limit return or deletion obligations under the DPA, the applicable international-transfer clauses or applicable law.

17. Customer Responsibilities

Customers remain responsible for ensuring they have the legal authority to collect, use and process any Personal Data submitted to the Services.

Customers are responsible for:

  • obtaining all necessary permissions, authorizations and consents where required;
  • ensuring information entered into the Services is lawful;
  • complying with applicable privacy laws;
  • protecting User credentials;
  • enabling Multi-Factor Authentication where appropriate;
  • reviewing AI-generated content before use;
  • validating information imported from PSA platforms;
  • validating Security Evidence retrieved from Microsoft Graph, Microsoft Exchange Online and Microsoft Purview;
  • ensuring Microsoft permissions remain authorized;
  • removing access to connected services when authorization no longer exists;
  • ensuring recipients of Security Review Reports are appropriately authorized;
  • and using the Services in accordance with the Terms of Service.

Customers remain solely responsible for determining what Personal Data they choose to upload, import or otherwise process using the Services.

18. Your Privacy Rights

Depending on your location and applicable law, you may have certain rights regarding your Personal Data.

These rights may include the right to:

  • request access to your Personal Data;
  • request correction of inaccurate Personal Data;
  • request deletion of Personal Data;
  • request restriction of processing;
  • object to certain processing activities;
  • request data portability;
  • withdraw consent where processing is based upon consent;
  • and lodge a complaint with an applicable supervisory authority.

These rights are not absolute and may be subject to legal exceptions or limitations.

Where SecuVeo processes Personal Data on behalf of a Customer as a Processor or Sub-Processor, requests relating to that data should normally be directed to the Customer. The Customer may be the Controller or may act on behalf of its Client, depending on their relationship.

SecuVeo will reasonably assist Customers in responding to applicable data subject requests where required by law or contract.

18.1 Exercising Your Rights

Requests relating to Personal Data may be submitted by contacting:

legal@secuveo.com

To protect Personal Data, SecuVeo may take reasonable steps to verify the identity and authority of the individual making the request before responding.

We will respond within the timeframes required by applicable law.

SecuVeo may refuse a request, or charge a fee, only where and to the extent applicable law permits, including an applicable legal exemption or a request that is manifestly unfounded or excessive. Any such decision will be assessed individually and supported by the required reasons and evidence. A request is not refused merely because it repeats an earlier request or is technically difficult. Where required, SecuVeo will explain its decision and the available complaint and judicial-remedy rights. Requests concerning data processed on a Customer’s behalf are handled with that Customer in accordance with the DPA.

19. California Privacy Rights

If applicable, residents of California may have additional rights under the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), or other applicable California privacy laws.

Subject to applicable law, California residents may have the right to:

  • know what Personal Data we collect;
  • request access to Personal Data;
  • request correction of inaccurate Personal Data;
  • request deletion of Personal Data;
  • request information regarding the categories of Personal Data collected;
  • request information regarding categories of third parties with whom Personal Data has been shared; and
  • exercise applicable privacy rights without unlawful discrimination.

SecuVeo does not sell Personal Data.

SecuVeo does not knowingly share Personal Data for cross-context behavioral advertising as those terms are defined under applicable California privacy laws.

California privacy requests may be submitted using the contact information provided in this Privacy Policy.

20. Marketing Communications

SecuVeo may send communications relating to the Services.

These communications may include:

  • account notifications;
  • subscription information;
  • billing notices;
  • payment confirmations;
  • Security Review delivery notifications;
  • security notifications;
  • product announcements;
  • feature releases;
  • maintenance notifications;
  • policy updates;
  • service availability notices;
  • support communications; and
  • other communications necessary for the operation of the Services.

Transactional communications that are necessary to provide the Services cannot generally be opted out of while a Customer maintains an active account.

Where required by applicable law, Customers may opt out of receiving marketing communications by:

  • using the unsubscribe link included within marketing emails;
  • updating communication preferences within the Services where available; or
  • contacting SecuVeo using the contact information provided in this Privacy Policy.

Opting out of marketing communications will not prevent Customers from receiving essential service-related communications.

21. Children’s Privacy

The Services are intended solely for business use by organizations and individuals who are at least eighteen (18) years of age.

The Services are not intended for use by children.

SecuVeo does not knowingly collect Personal Data directly from individuals under the age of eighteen (18).

If we become aware that Personal Data has been collected directly from a child without appropriate legal authorization where required, we will take commercially reasonable steps to delete such information.

If you believe a child has provided Personal Data directly to SecuVeo, please contact us using the contact information provided in this Privacy Policy.

22. Third-Party Websites and Services

The Services may contain links to third-party websites, products, services or resources.

The Services may also integrate with third-party platforms including, but not limited to:

  • Microsoft;
  • Professional Services Automation (PSA) platforms;
  • payment providers;
  • authentication providers;
  • artificial intelligence providers;
  • analytics providers; and
  • other third-party services.

SecuVeo does not own or control third-party services.

This Privacy Policy applies only to the Services provided by SecuVeo.

The collection, processing and protection of Personal Data by third-party providers are governed by their own privacy policies, terms and applicable contractual arrangements.

Customers are responsible for reviewing the privacy practices of any third-party services they choose to connect to the Services.

Independent third parties are responsible for their own privacy practices, security measures and content. This does not exclude SecuVeo’s obligations for its own processing, disclosures or appointed Sub-Processors under the DPA and applicable transfer agreements.

23. Business Transfers

As SecuVeo continues to develop, our business structure may change.

If SecuVeo or substantially all of its assets are involved in:

  • a merger;
  • acquisition;
  • corporate restructuring;
  • financing transaction;
  • sale of assets;
  • change of ownership; or
  • similar business transaction,

Personal Data may be transferred to the acquiring or successor organization as part of that transaction.

Any successor organization will be required to continue processing Personal Data in accordance with applicable law and any contractual obligations that continue to apply.

Where required by applicable law, Customers will be notified of material changes affecting the processing of Personal Data.

24. Our Commitment to Customer Data

SecuVeo is committed to protecting the confidentiality, integrity and security of Customer Data and to maintaining the trust placed in us by our Customers.

SecuVeo’s business is providing software to Managed Service Providers. We do not provide managed IT services and have no commercial interest in competing with our Customers or developing direct commercial relationships with their Clients. Customer Data belongs to the Customer. When processing Personal Data on a Customer’s behalf, SecuVeo acts on the Customer’s instructions in accordance with the Data Processing Agreement. SecuVeo may separately act as a Controller for its own account, billing, support, security and website data as described in this Privacy Policy.

The Customer retains all right, title and interest in and to Customer Data at all times.

SecuVeo will not use Customer Personal Data for independent commercial purposes. Provision, maintenance, security, support and improvement of the Services involving that data must remain within the Customer’s lawful documented instructions and the DPA, subject to processing required by applicable law.

Without the Customer’s express authorization, and except where required by applicable law, SecuVeo will never knowingly:

  • use Customer Data to provide managed IT services or operate a competing managed service business;
  • market, advertise or sell products or services directly to a Customer’s Clients, except where expressly instructed by the Customer as part of the Services;
  • sell, rent, license or otherwise commercially exploit Customer Data;
  • use Customer Data to build customer lists, marketing databases, commercial profiles or marketing intelligence for SecuVeo’s own benefit;
  • use Customer Data or Client Data to train any public, shared or third-party artificial intelligence (AI) models;
  • disclose Customer Data except as described in this Privacy Policy, the Terms of Service, the Data Processing Agreement or as required by applicable law.

Where SecuVeo engages authorized Sub-Processors to assist in providing the Services, those Sub-Processors will process Customer Data solely on SecuVeo’s behalf, only for the purpose of providing the Services, and are contractually required to protect Customer Data in accordance with applicable data protection laws.

Nothing in this section restricts SecuVeo from using aggregated, anonymized or de-identified information that cannot reasonably be used to identify or re-identify an individual, Customer or Client.

Such aggregated, anonymized or de-identified information may be used to:

  • improve the Services;
  • develop new features and functionality;
  • analyze platform performance;
  • identify product usage trends;
  • enhance the security, reliability and performance of the Services;
  • produce statistical, operational or benchmarking reports; and
  • support the ongoing development and improvement of the Services.

Aggregated, anonymized or de-identified information will never be used to identify, contact, profile or target individual Customers or their Clients.

25. Changes to this Privacy Policy

SecuVeo may update this Privacy Policy from time to time to reflect:

  • changes to applicable law;
  • changes to the Services;
  • changes to our privacy practices;
  • changes to Sub-Processors;
  • changes to security practices; or
  • other legitimate business or operational requirements.

Changes to this Privacy Policy that materially and adversely affect a Customer’s rights or obligations during a current Subscription term are subject to the advance email notice and rejection and termination rights in Section 50 of the Terms of Service. Other material changes to our privacy practices will be communicated as required by applicable law.

Where required by the Services, Customers may be required to acknowledge updated privacy policies before continuing to use all or part of the Services.

The “Effective Date” shown at the beginning of this Privacy Policy indicates when the current version became effective.

An updated Privacy Policy explains our current processing practices from its stated effective date. Acknowledgment of the notice or continued use of the Services does not itself constitute consent to processing. Where a change requires consent or another legal step, SecuVeo will complete that step separately before the affected processing begins.

26. Contact Us

If you have any questions regarding this Privacy Policy, the processing of Personal Data, your privacy rights, or wish to exercise any rights available under applicable privacy laws, please contact us.

Data Protection Contact

Email: legal@secuveo.com

Websites:

https://secuveo.com

https://app.secuveo.com

Address:

MSP SecureView LLC-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates

We will use commercially reasonable efforts to respond to privacy-related inquiries promptly and within any timeframes required by applicable law.

27. Regional Privacy Information

Depending on where you are located, additional privacy rights or obligations may apply under local privacy laws.

Nothing in this Privacy Policy limits or excludes any rights that cannot lawfully be limited or excluded under applicable data protection legislation.

Where required by applicable law, SecuVeo will comply with additional regional privacy requirements, including those relating to:

  • lawful processing;
  • transparency;
  • international transfers;
  • data subject rights;
  • breach notifications;
  • children’s privacy;
  • data retention;
  • consumer privacy rights; and
  • regulatory cooperation.

Where SecuVeo acts as a Processor or Sub-Processor, requests relating to Personal Data processed on a Customer’s behalf should generally be directed to that Customer, which is responsible for handling the request or coordinating with its Client as applicable.

28. Automated Decision-Making

The Services include automated functionality designed to assist Customers in completing Security Reviews.

Examples include:

  • AI-generated Executive Summaries;
  • AI-generated Changes Since Last Review;
  • AI-assisted keyword recommendations;
  • automated deployment status recommendations;
  • historical report comparisons;
  • Security Score calculations;
  • report generation; and
  • other automated platform functionality.

These features are intended solely to assist Customers.

SecuVeo does not use Personal Data to make solely automated decisions that produce legal effects concerning individuals or similarly significant decisions without appropriate human involvement.

Customers remain solely responsible for reviewing, validating and approving all automated outputs before relying upon them.

29. Do Not Track

Some web browsers support a “Do Not Track” (“DNT”) preference.

At this time, there is no universally accepted standard for recognizing or responding to DNT browser signals.

Accordingly, the Services do not currently respond differently based solely on DNT signals received from a web browser.

If industry standards relating to Do Not Track evolve, SecuVeo may update its practices accordingly.

30. Accessibility

SecuVeo is committed to making information about our privacy practices accessible to our Customers.

If you require this Privacy Policy in an alternative format due to a disability or accessibility requirement, please contact us using the contact information provided in this Privacy Policy.

We will use commercially reasonable efforts to provide reasonable accommodations where appropriate.

31. Interpretation

Headings are provided for convenience only and do not affect the interpretation of this Privacy Policy.

References to:

  • “including”;
  • “includes”;
  • “such as”;
  • “for example”; and
  • similar expressions,

are illustrative only and shall not be interpreted as limiting the scope of the words preceding them.

Unless the context requires otherwise:

  • words importing the singular include the plural and vice versa;
  • references to persons include individuals, companies, partnerships and other legal entities; and
  • references to applicable law include amendments, replacements and successor legislation.

32. Entire Privacy Policy

This Privacy Policy, together with the Terms of Service, Data Processing Agreement and any documents expressly incorporated by reference, represents SecuVeo’s complete privacy notice relating to the Services.

If there is any conflict between this Privacy Policy, the Terms of Service and the Data Processing Agreement, the documents shall apply in the following order of precedence:

  1. The applicable EU Standard Contractual Clauses and UK Addendum incorporated into the DPA, as their own precedence rules require;
  2. The remainder of the DPA for processing within its scope;
  3. The Terms of Service; and
  4. This Privacy Policy as the applicable privacy notice.

Nothing in this Privacy Policy limits any obligations imposed upon either party under the Terms of Service or the Data Processing Agreement.

33. Acknowledgment

Customers are provided with this Privacy Policy when registering for an Account and may access it through the website and Policy Center. A recorded acknowledgment confirms that the notice was presented and acknowledged; it does not constitute blanket consent to processing or acceptance of a separate Data Transfer Agreement.

Where required, SecuVeo will notify Customers of material changes and may request acknowledgment of the updated notice. Any consent required for a specific processing activity will be obtained separately.