B2B Enterprise and Workplace Services Addendum

1.1 PrivacyHawk offers business customers up to three distinct services. They involve different data, different roles, and different consent. This section identifies which is which, and which parts of this Policy apply to each.

(1) Tenant Exposure Scan. An organization’s Google Workspace or Microsoft 365 administrator installs and authorizes PrivacyHawk for the organization’s tenant. PrivacyHawk identifies the third-party companies and services that hold data associated with the organization’s employee work email addresses, and reports them to the administrator. This is the core PrivacyHawk Enterprise product. Subsections 1.2 through 1.10 govern it.

(2) Employee Privacy Accounts (optional). Some organizations elect to provide their employees with individual PrivacyHawk accounts covering the employee’s own personal and work data — including data broker removal, deletion and opt-out requests, breach and dark web monitoring, mobile protection, and identity protection benefits. This applies only where an organization has purchased and offered this benefit and the employee has individually enrolled. If your employer has not offered you a PrivacyHawk account, nothing in this subsection applies to you. Where an employee does enroll, the account is the employee’s own, and Sections 1 through 9 of the Privacy Policy apply to it in the same way they apply to any consumer user. Subsection 1.11 describes the additional limits that apply because the account was provided through an employer.

(3) Business relationship data. Separately from (1) and (2), PrivacyHawk collects information for its own business purposes from the individuals who buy, administer, and support the product. Subsection 1.12 describes this.

1.2 Roles and responsibilities

For the Tenant Exposure Scan, the organization is the data controller (or “business”) and PrivacyHawk acts as its processor (or “service provider”), processing tenant data on the organization’s instructions as set out in our Terms of Service, which the organization accepts when it subscribes to the Services. Individual rights described in Section 5 of the Privacy Policy with respect to Tenant Exposure Scan data are exercised through the organization’s administrator.

For Employee Privacy Accounts, the enrolled employee is the user and PrivacyHawk’s role is the same as it is for any consumer user of the Services. The employer is not a party to the employee’s account and does not control it.

For business relationship data described in subsection 1.12, PrivacyHawk is the controller.

1.3 Tenant Exposure Scan — permissions requested, data retrieved, and data retained

The permissions an administrator grants are broader than the data PrivacyHawk actually retrieves, and the data PrivacyHawk retrieves is broader than the data PrivacyHawk retains. We describe all three below so there is no ambiguity about what the grant technically permits.

Google Workspace. We request the following OAuth scopes and no others.

Gmail message metadata (https://www.googleapis.com/auth/gmail.metadata)

1. What the permission technically allows: read access to Gmail message metadata, including message headers (sender, recipients, subject line, date), labels, thread and message identifiers, and history records. It does not permit access to message bodies or attachments.
2. What PrivacyHawk retrieves: the domain portion of the sender address, and the message date.
3. What PrivacyHawk retains: the third-party domain, and the date it was first and most recently observed.

Directory read-only (https://www.googleapis.com/auth/admin.directory.user.readonly)

1. What the permission technically allows: read-only access to the organization’s user directory, including user profiles, primary email addresses, aliases, organizational unit, job title, manager, and account status.
2. What PrivacyHawk retrieves: the account identifiers necessary to enumerate the accounts covered by the organization’s license and to run the scan.
3. What PrivacyHawk retains: nothing beyond what is necessary to administer the organization’s license.

We do not request or receive access to Google Drive, Google Calendar, Google Contacts, Google Chat, Google Meet, or any other Google service.

Microsoft 365. Our Microsoft integration operates on the same principle. We request Mail.ReadBasic.All and User.Read.All, and no others. As with Gmail, the mail permission technically permits retrieval of basic message properties including sender, recipients, subject line, and date — but not message bodies, previews, or attachments — and the directory permission technically permits retrieval of user profile fields. PrivacyHawk retrieves and retains the same narrow set described above: third-party sender domains and the dates observed.

What is never retrieved. Under no circumstances does the Tenant Exposure Scan retrieve or retain message bodies, attachments, subject lines, recipient lists, individual sender addresses, calendar or file contents, device contacts, SMS messages, government identifiers, or location data.

What administrators can see. An administrator’s dashboard shows the third-party companies and services identified across the tenant, and the dates observed. It does not show messages, subject lines, individual sender addresses, or any other personal information from any employee’s mailbox.

1.4 How we use Tenant Exposure Scan data

We use it solely to identify which third-party companies and services hold data associated with the organization’s work email addresses, to produce the exposure inventory and risk reporting in the administrator dashboard, and to monitor for new exposures over time. We do not use it for any other purpose.

1.5 Limited Use of Google Workspace data

PrivacyHawk’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace user data and developer policy, including the Limited Use requirements. The commitments below apply to Google Workspace data and to any data derived from it.

(a) Use. We limit our use of Google Workspace data to providing or improving the appropriate use case and the features that are visible and prominent in the PrivacyHawk Enterprise user interface.

(b) Transfers. We do not transfer Google Workspace data, except:

1. to provide or improve our appropriate use case or user-facing features that are visible and prominent in the requesting application’s user interface, and only with the user’s consent;
2. for security purposes, such as investigating abuse;
3. to comply with applicable laws or regulations; or
4. as part of a merger, acquisition, or sale of assets, after obtaining explicit prior consent from the user.

We do not sell Google Workspace data, transfer it to advertising platforms, data brokers, or information resellers, use it to serve or target advertising of any kind, or use it to determine credit-worthiness or for lending purposes.

(c) Artificial intelligence and machine learning. Data obtained from a Google Workspace tenant is never used to train, create, or improve any artificial intelligence or machine learning model.

This prohibition is absolute and applies to the raw data obtained from Google Workspace scopes and to everything derived from it, including aggregated, anonymized, and de-identified derivations. Google Workspace data is not used to create, train, improve, evaluate, fine-tune, or benchmark any foundational, frontier, generalized, industry-specific, organization-specific, or other non-personalized model. It is not incorporated into any training corpus. It is not stored in conjunction with any such model. It is not transferred to any third party for any of those purposes. The only exception Google’s Limited Use requirements permit — a model personalized to a specific user for the appropriate use case or user-facing feature — is not one PrivacyHawk currently relies on for Workspace data.

PrivacyHawk does operate machine learning systems that improve its opt-out automation over time, as described in Section 2.2(b) of the Privacy Policy. Those systems are trained on data obtained from sources other than Google Workspace tenants. Google Workspace data does not enter them.

Processing Google Workspace data through an AI system at the time a scan runs — that is, inference, where the data is evaluated by a model but does not alter the model — is distinct from training and is permitted. Where we use a third-party AI provider for such processing, we do so under contractual terms that prohibit the provider from using the data to train its own models and permit it to retain the data only temporarily, for security and abuse monitoring.

(d) Human access. We do not allow humans to read Google Workspace data, unless:

1. we have obtained and documented the affected user’s explicit consent or affirmative agreement to view specific data — for example, where a user contacts us for support and agrees that we may examine specific data in order to resolve their issue;
2. a tenant owner or authorized representative of the tenant owner authorizes it for performance of the services, for example, for PrivacyHawk’s managed Shadow Digital Footprint services where PrivacyHawk’s internal team assists with making data deletion and other opt out requests to clean up the organization’s shadow digital footprint; this authorization is always provided by agreeing to PrivacyHawk’s Enterprise Terms of Service;
3. the data, including derivations, is aggregated and anonymized and used for internal operations in accordance with applicable legal requirements;
4. it is necessary for security purposes, such as investigating a bug or abuse; or
5. it is necessary to comply with applicable laws or regulations.

PrivacyHawk personnel do not have access to the contents of any employee’s mailbox. Access to the third-party domain data produced by a scan is restricted, under a least-privilege access control policy, to the specific authorized engineering and support personnel who require it for the purposes listed above, and such access is logged.

(e) Personnel and successors. We require our employees, agents, contractors, and successors to comply with the Google API Services User Data Policy and the Google Workspace user data and developer policy.

(f) Precedence. The commitments in this subsection 1.5 govern Google Workspace data notwithstanding anything to the contrary in our Terms of Service, including any general license to use customer data for research, product improvement, artificial intelligence model training, or machine learning. That general license does not extend to Google Workspace data or to data derived from it. Subsection 1.6 sets out which of these commitments apply to Microsoft 365 tenant data.

1.6 Microsoft 365 tenant data

We apply the following commitments from subsection 1.5 to data obtained from a Microsoft 365 tenant and to data derived from it: the same limits on use (1.5(a)), the same limits on transfer (1.5(b)), the same restrictions on human access (1.5(d)), and the same retention and deletion commitments in subsection 1.9.

By subscribing to PrivacyHawk Enterprise and agreeing to our Terms of Service, a customer organization agrees that we may use Microsoft 365 tenant data, and data derived from it, to operate, secure, and improve the Services, including by developing and improving the machine learning models used to deliver privacy and security functionality. We do not use this data for advertising and do not transfer it to third parties for model training.

1.7 Scope of the restrictions in this section

The commitments in subsections 1.5 and 1.6 attach to data by its source, not by the identity of the person it concerns. They apply to data obtained from a Google Workspace or Microsoft 365 tenant through an administrator’s authorization, and to data derived from it, and they continue to apply after that data has been aggregated, anonymized, or transferred. Subsection 1.6 identifies which of these commitments apply to Microsoft 365 tenant data.

They do not govern data PrivacyHawk obtains from other sources — including personal email accounts an individual connects to the consumer Services, and information obtained from public records or data brokers. Our handling of that data is governed by Sections 1 through 9 of the Privacy Policy. Data obtained from a personal Google account connected to the consumer Services is separately subject to the Limited Use commitments in Section 2.2(c) of the Privacy Policy, and data from a personal Microsoft account to Section 2.2(d).

1.8 Sharing

We never sell the limited data we get from the Tenant Exposure Scan.

We share it with the subprocessors necessary to operate the service — cloud hosting, security, and support infrastructure — under contractual confidentiality and security obligations, and only for the purposes described in subsection 1.4. A current list of subprocessors is available on request.

Tenant Exposure Scan data is not disclosed to anyone else other than for data deletion and opt out purpose. PrivacyHawk uses Tenant Exposure Scan data limited to email address and website of the company to which the user is sending the opt-out request to send deletion or opt-out requests (upon request of the account owner or authorized representative).

Where an individual has an Employee Privacy Account (subsection 1.11), deletion and opt-out requests made through that account are handled as described in Section 4 of the Privacy Policy.

1.9 Storage, retention, and deletion

Tenant data is processed and stored in Google Cloud Platform data centers in the United States, encrypted in transit and at rest.

An administrator may revoke PrivacyHawk’s access at any time from the Google Workspace Admin console or the Microsoft 365 admin center, and may request deletion at any time by emailing support@privacyhawk.com.

Upon revocation, deletion request, or termination of the organization’s subscription, we immediately delete: all Google Workspace and Microsoft 365 data; all data derived from it, including third-party domain records, exposure inventories, and risk scores; any cached copies; and operational logs that reference tenant data. Backups and disaster recovery snapshots are purged within 7 days, after which no copy remains.

We may retain aggregated and anonymized statistics derived from tenant data for product improvement and internal operations, in accordance with subsection 1.5(d)(3). Such statistics do not identify, and cannot reasonably be used to identify, any organization or individual. Statistics derived from Google Workspace data are not used to train or improve any artificial intelligence or machine learning model.

Deletion under this subsection does not require us to reverse improvements already made to the Services or to models trained on Microsoft 365 tenant data in accordance with subsection 1.6, from which an individual organization’s data cannot be separately extracted.

1.10 Notice and consent

Before any data is accessed, the person granting access is shown Google’s or Microsoft’s own hosted consent screen, which identifies PrivacyHawk and itemizes each permission being requested. PrivacyHawk displays its disclosure of what data will be accessed, how it will be used, and how it will be shared in the product itself, immediately before that consent screen is presented. That disclosure is not located only in this Policy or in our Terms of Service. No data is collected before affirmative consent is given.

An administrator’s authorization covers the organization’s tenant. It does not, by itself, authorize PrivacyHawk to act on behalf of any individual employee. Where PrivacyHawk performs an action that requires an individual’s own authorization — including exercising an individual’s personal privacy rights as an authorized agent — that authorization comes from the individual, through their own enrollment and consent, and not from the administrator.

Where the product performs an action on a user’s behalf, the user confirms that action.

1.11 Employee Privacy Accounts

This subsection applies only where an organization has purchased Employee Privacy Accounts and offered them to its employees, and the individual employee has enrolled. If your employer has not offered you a PrivacyHawk account, this subsection does not apply to you.

Where an employee enrolls:

1. The account is the employee’s own. Sections 1 through 9 of the Privacy Policy apply to it in full, including the descriptions of data collected, purposes, retention, and individual rights.
2. The employee — not the employer, and not PrivacyHawk acting on the employer’s instruction — designates PrivacyHawk as their authorized agent for privacy rights requests, on the terms described in our Terms of Service.
3. Deletion and opt-out requests are handled as described in Section 4 of the Privacy Policy.
4. The employer’s administrator has no visibility into the employee’s account. Administrators cannot see the employee’s messages, subject lines, senders, recipients, personal email content, data broker records, breach or dark web monitoring results, or any other personal information associated with the account. Administrator reporting is limited to the tenant-level information described in subsection 1.3.
5. An employee may decline to enroll, and may close the account at any time, without the employer being informed of the reason.

1.12 Information PrivacyHawk collects as controller

Independently of the data processed on an organization’s behalf, PrivacyHawk collects and determines the purposes for the following:

1. Administrator and contact information: name, business email address, job title, phone number, and organization, for the individuals who evaluate, purchase, administer, or are billed for the Services.
2. Billing and transaction records: billing contact details, purchase and invoice history, and payment records. Card details are handled by our payment processor and are not stored by us.
3. Support records: the content of support tickets, correspondence, and any information voluntarily provided in the course of a support interaction.
4. Website and marketing data: the data described in Section 2.1(b) of the Privacy Policy and in our Cookie Notice for visitors to our website, including log data, usage data, and cookie data, subject to the consent requirements described in our Cookie Notice.
5. Security and audit logs: authentication events, administrative actions within the product, access logs, and similar records generated by our systems, which we retain for security, fraud prevention, and compliance purposes.

We process this information as a controller for the purposes described in Section 2.2 of the Privacy Policy, and it is subject to Section 2.2 and Sections 3 through 9 of the Privacy Policy. It is not customer-controlled tenant data and is not subject to the Limited Use restrictions in subsection 1.5, because it is not obtained from Google Workspace or Microsoft 365 APIs.

1.13 Permitted use and worker monitoring

PrivacyHawk Enterprise is provided exclusively for privacy protection and cybersecurity purposes: identifying and reducing third-party exposure of organizational and employee data.

PrivacyHawk Enterprise is not a workforce monitoring, productivity measurement, or employee evaluation tool. It does not measure or report on employee productivity, communications volume, working hours, message content, or performance. Exposure findings and risk scores reflect the behavior of third-party companies that hold data, not the conduct or competence of any employee.

Prohibited uses. As a condition of using the Services, the customer organization agrees not to use PrivacyHawk Enterprise output — including exposure inventories, risk scores, and any derived metric — as a factor in any decision regarding hiring, compensation, promotion, demotion, reassignment, scheduling, training, discipline, or termination, or in any other employment decision affecting an individual worker. The customer organization further agrees not to use the output to single out, rank, or profile individual employees for adverse treatment.

Customer responsibilities. The customer organization is responsible for determining the lawful basis for processing its workers’ data, for providing its workers with any notice required by applicable law regarding the scanning of company accounts, for conducting any data protection impact assessment, legitimate interests assessment, or worker consultation required in its jurisdiction, and for honoring worker rights requests relating to tenant data. PrivacyHawk will provide reasonable assistance with such requests.

1.14 Security

PrivacyHawk Enterprise is operated in accordance with the security practices described in Section 6 of the Privacy Policy. PrivacyHawk has completed a SOC 2 audit; a copy of the report is available to prospective and current enterprise customers under NDA. Applications accessing Google restricted scopes are subject to the Cloud Application Security Assessment (CASA) and, where applicable, periodic third-party security assessment.

1.15 Contact

Administrators and enterprise customers may contact us regarding PrivacyHawk Enterprise data practices, access, or deletion at support@privacyhawk.com. Employees with questions about an Employee Privacy Account may use the same address, and may also exercise the rights described in Section 5 of the Privacy Policy directly.