Controller and contact
For personal data we process for our own purposes, such as operating our website and managing accounts and business relationships, the controller is Clouds On Mars Sp. z o.o., Bukowińska 22/13B, 02-703 Warsaw, Poland, registered under KRS 0000670382, VAT number 5213773786.
Where we process personal data from a customer's Microsoft tenant on that customer's instructions, we act as a processor. That processing is governed by the applicable service and data-processing terms.
Data we process
Website visits
Our hosting and security infrastructure may process standard technical request data such as IP address, request time, requested path, browser or device information, response status, and correlation identifiers. We use this information to deliver and protect the website and diagnose faults.
Usage analytics
Google Analytics measures visits to public pages and pages in the signed-in application. Before you choose and if you reject analytics cookies, Google receives limited measurements without reading or writing analytics cookies. These measurements include fixed page names and paths, consent state, request timing, and browser and device information. Requests to Google also expose your IP address as part of network communication. If you accept analytics cookies, Google can additionally use cookie identifiers to distinguish visits. We do not send account names, email addresses, tenant identifiers, access tokens, form contents, query strings, or URL fragments as analytics event data. Authentication callbacks and Marketplace activation pages are excluded.
Identity and product access
When you sign in, we process Microsoft Entra account information needed to authenticate you and keep access tenant-scoped. This may include your tenant and object identifiers, account name, email or username, and authentication metadata.
Marketplace subscription and activation
We process Marketplace subscription, offer and plan identifiers; beneficiary and purchaser tenant or object identifiers; subscription status and term information; operation identifiers; and activation and entitlement status. This lets us activate the subscription, authorize access, reconcile lifecycle changes, and maintain an audit trail.
Customer tenant data and service validation
When your organization authorizes Ntracko to access its Microsoft tenant, we may process application or delegated access tokens and the data needed to provide the features you use. Depending on the service and permissions granted, this may include tenant and account identifiers, names and business email addresses, license assignments, resource and environment configurations, usage and activity information, and data supplied for analysis or support.
We use this information to generate assessments, recommendations and reports, and to carry out operations requested or configured by your organization within the permissions granted.
To validate the accuracy, completeness and consistency of results, we may compare relevant source data with generated outputs, investigate discrepancies, and review diagnostic information. These checks are limited to delivering and validating the service for your organization, in accordance with its instructions and the applicable service and data-processing terms.
Anonymised results and service improvement
We may further transform and aggregate data processed in providing the service to produce anonymised statistics and insights. We may use these results to evaluate and improve the accuracy, quality and reliability of Ntracko's analyses, recommendations and services. Such results must not identify individuals through means reasonably likely to be used or disclose customer-specific confidential information. Processing personal data to produce these results remains subject to applicable law and the agreed service and data-processing terms.
Support correspondence
If you contact us, we process the details you provide, such as your name, work email, company, and message, to respond and manage the resulting support or business relationship.
Why we process data
The legal bases below apply where we act as a controller. Where we process customer tenant data as a processor, the customer determines the purposes and legal basis, and we process the data in accordance with its instructions and the applicable data-processing terms.
| Purpose | Legal basis |
|---|---|
| Provide product access, activation, entitlement checks, and subscription lifecycle handling | Performance of a contract and steps taken at your request before entering a contract, Article 6(1)(b) GDPR |
| Secure, monitor, troubleshoot, and improve service reliability | Our legitimate interests in operating a secure and reliable service, Article 6(1)(f) GDPR |
| Maintain accounting, compliance, security, and audit records | Legal obligations, Article 6(1)(c), and legitimate interests, Article 6(1)(f) GDPR |
| Answer questions and support requests | Contract performance or our legitimate interest in responding, Articles 6(1)(b) and 6(1)(f) GDPR |
| Store Google Analytics cookies and use their identifiers to measure website and application usage | Your consent, Article 6(1)(a) GDPR |
Providing identity and subscription information is necessary to activate and use Ntracko. Without it, we cannot authenticate your organization or verify its Marketplace entitlement.
Browser storage and cookies
Google Analytics loads on eligible pages with analytics storage denied by default. Selecting Accept analytics cookies enables analytics cookies. Selecting Reject analytics cookies keeps cookie-free measurement active without limiting access to Ntracko. Leaving the banner unanswered also keeps cookie-free measurement active. Advertising storage, advertising user data, and advertising personalization are disabled.
We remember your choice in localStorage under ntracko.analytics-consent.v1 for up to 180 days. If accepted, Google Analytics uses the _ga and _ga_2BQ64YB9BT cookies, configured to expire after 180 days without extending their expiry on each visit. Use the Cookie settings button on this privacy page to change your choice. Rejecting analytics cookies removes these cookies from this site and returns Analytics to cookie-free measurement. Clearing browser storage also removes your saved choice. Withdrawal does not delete data already collected.
Sign-in, tenant selection, and Marketplace activation use essential browser sessionStorage. Depending on the action you take, this can contain Microsoft authentication cache data, account and tenant identifiers, selected-tenant state, temporary access tokens, product authentication configuration, and short-lived activation state. It is scoped to the browser tab or session and is normally cleared when that tab or session closes. Blocking it may prevent sign-in or activation from working.
International transfers
Some Microsoft, Google, or group-company processing may involve access from or transfer to countries outside the European Economic Area. Where GDPR requires it, we rely on an adequacy decision, Standard Contractual Clauses approved by the European Commission, or another lawful transfer safeguard.
Retention and deletion
Activation sessions expire after 15 minutes and can be consumed only once. We retain subscription, entitlement, operation, security, and audit records only as long as needed to deliver the service, meet contractual or legal obligations, resolve disputes, protect the service, and maintain necessary audit evidence. Support correspondence is retained for the relationship and any period needed for follow-up or legal obligations.
Unsubscribing removes product entitlement but may not result in immediate deletion where minimum records must be retained for billing, fraud prevention, legal compliance, or audit integrity. When an approved deletion request applies, active access is revoked first and eligible data is removed from active systems; encrypted backups expire through their managed retention cycle.
Security
We apply technical and organizational measures appropriate to the risk, including encryption in transit and at rest, Microsoft Entra authentication, tenant-scoped authorization, restricted support access, credential redaction, immutable audit events, monitoring, backup controls, and regular security review. No method of transmission or storage is completely risk-free.
Your rights
Subject to the conditions in applicable law, you may have the right to:
- Access your personal data
- Correct inaccurate data
- Request erasure
- Restrict processing
- Object to legitimate-interest processing
- Receive portable data
- Withdraw consent where consent applies
- Avoid solely automated decisions with legal or similarly significant effects
Contact our Data Protection Officer at IOD@cloudsonmars.com. We may need to verify your identity and authority for the relevant tenant before fulfilling a request.
Complaints
You may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. Visit uodo.gov.pl for current contact information.
Other information
Automated decisions
We do not use personal data from the website or Ntracko service for automated decision-making or profiling that produces legal or similarly significant effects.
Children
Ntracko is a business administration service and is not intended for children. We do not knowingly collect personal data from children through this service.
Third-party links
Our pages may link to Microsoft, Clouds On Mars, or other external websites. Their own privacy notices govern data processing on those sites.
Changes to this policy
We may update this policy when the service, legal requirements, or our processing practices change. We will publish the revised version here and update the date shown above. Material changes may also be communicated through the service or an appropriate business contact.