Vitals Privacy Notice

Version 1.5 | Effective 19 October 2026

This notice explains how Innova Technologies Group Ltd uses personal information in connection with the Vitals website, purchasing and administration of Vitals, customer communications, and related business operations. It also explains the separate position where Innova Group processes Microsoft 365 tenant information on a customer's instructions.

1. Who we are

Vitals is a product of Innova Technologies Group Ltd (company number 17205930, VAT number 519893442), registered office 7 Stromberg Street, Anlaby, Hull, HU10 7ER, trading as Innova Group.

For the personal information described in this notice that we use for our own business purposes, Innova Technologies Group Ltd is the controller. You can contact us at hello@tenantvitals.com.

2. What this notice covers

This notice covers personal information relating to visitors to tenantvitals.com and app.tenantvitals.com, buyers and prospective buyers, authorised approvers and report recipients, IT providers and other business contacts.

When Vitals accesses a customer's Microsoft 365 tenant to perform an Assessment, Innova Group normally acts as a processor for the customer, or as a sub-processor where an IT provider purchases Vitals for its end client. That processing is governed by the applicable Vitals Data Processing Agreement or IT Provider / MSP Agreement rather than by Innova Group deciding to use the tenant data for its own purposes. Content that an IT provider enters about its customers in the partner portal, such as notes, is processed on that provider's instructions. Innova Group is the controller of its own account administration, billing, fraud, security and audit records; being the controller of those records does not entitle us to keep customer content that we process on a customer's or IT provider's instructions beyond the periods in the applicable agreement.

3. Information we collect and why

Information	How we use it	Lawful basis	Typical source
Name, business email address, company and role	To deal with enquiries, orders, approvals, delivery, support and account administration.	Contract, steps requested before a contract, and legitimate interests in operating and supporting Vitals.	You, your employer, buyer or IT provider.
Order and transaction information	To take payment, issue receipts, administer refunds, maintain accounting records and deal with disputes.	Contract and legal obligations; legitimate interests in financial administration and fraud prevention.	You and our payment providers, including Stripe where applicable.
Marketing source or referral information	To understand which source led to an enquiry or order and measure the effectiveness of our own marketing.	Legitimate interests in understanding and improving how Vitals is marketed, subject to applicable PECR requirements.	The page or referral information available during your visit and, if you proceed, the order record.
Website and technical information	To operate, secure and understand use of the Vitals website and application, including aggregated website analytics.	Legitimate interests in security, service operation and improvement. Where PECR applies to storage or access on your device, we rely only on an applicable exception unless consent is obtained.	Your browser/device and our hosting or analytics services.
Communications	To respond to you and send transactional messages about consent, approvals, reports, release, reminders, refunds and service matters.	Contract, steps before contract, legal obligations and legitimate interests in administering Vitals.	You and people involved in the relevant order.
IT provider team members: name, work email address, role and sign-in records	To give them access to the partner portal, administer the provider's account and keep an audit history of changes.	Contract and legitimate interests in operating and securing the service.	The provider and its team members.
Domain Check subscribers: email address and domain	To send the domain change updates the person asked for, after they confirm.	Consent, given by pressing the confirmation button on the page that the link in our email opens (double opt-in); opening the link alone does not confirm. It can be withdrawn at any time with the stop link in every update.	The person.
Service and audit records: technical request records, email delivery records, and a record of administrative actions including data removals	To operate and secure the service and to show that removals were carried out.	Legitimate interests in security, service operation and accountability.	Our systems and our staff.
Innova Group staff: the sign-in identity of staff who carry out administrative actions, send reports or have access withdrawn	To keep an accountable security and administration record.	Legitimate interests in accountability and security.	Our systems.

4. Cookies, browser storage and website analytics

We do not use advertising or behavioural-tracking cookies on the Vitals marketing website.

The Vitals application uses an ASP.NET Core antiforgery cookie to protect forms against cross-site request forgery. It may also use session-only browser storage for interface state, such as preventing an introductory animation from replaying during the same browser session. These technologies are used for security or requested service functionality, not behavioural advertising.

Vitals does not store marketing attribution information in cookies, local storage or session storage. Where we record how a visitor reached Vitals, that information is held only for the current visit and may be associated with an order if the visitor proceeds to purchase.

We use Vercel Web Analytics on the marketing website to understand aggregate website use. Vercel states that Web Analytics does not use analytics cookies and stores anonymised, aggregated analytics data rather than information that identifies an individual visitor.

We also use Google Analytics 4 (GA4) to understand website usage and marketing performance. Where GA4 involves storing or accessing information on a visitor’s device, it is used only where any consent required by PECR has been obtained. Information processed by Google is handled under Google’s applicable privacy and data-processing terms.

We keep our use of cookies and other storage/access technologies under review. If we introduce a technology that requires consent under PECR, we will obtain consent before using it.

5. Payments and service providers

We use service providers to operate Vitals. Depending on the interaction, they may receive personal information necessary to provide their service:

• Stripe — payment processing and related transaction services.
• Stripe — payment processing for card and Bacs Direct Debit payments. Stripe receives payer identification, contact and payment/transaction information needed to establish and administer the selected payment method and acts under its applicable terms for those payment services.
• Resend (Plus Five Five, Inc.) — transactional email delivery, including messages containing report-access links.
• Microsoft Azure — hosting, compute and storage for the Vitals application and customer Assessments, encrypted backups of our database, and service logs held in Azure Monitor (Application Insights).
• Vercel — hosting of the Vitals marketing website and privacy-focused Web Analytics.
• Google — Google Analytics 4 website analytics, where enabled in accordance with the consent position described above.

We require processors acting on our behalf to handle personal information under appropriate contractual and data-protection obligations.

6. Automated recommendations

Vitals produces prioritised recommendations automatically, from its analysis of the available Microsoft 365 evidence. In the current service, assessment information is not sent to an AI provider to generate them.

If the design changes so that personal information would be sent to an AI provider, we will reassess the processing and update the applicable contractual and privacy information before doing so.

7. Microsoft 365 Assessment data

When a customer authorises a Vitals Assessment, the service uses read-only Microsoft Graph permissions to examine relevant Microsoft 365 configuration and metadata. This can include user and guest account identifiers, group/role membership, device and compliance metadata, sharing metadata, authentication-method registration and related directory audit events, per-person Microsoft 365 activity and licence information, indicators that selected contact methods are present, mailbox-rule metadata such as rule names, conditions and forwarding addresses, and, where the applicable controller instruction expressly authorises the feature, a limited subset of recent interactive sign-in metadata used to assess Conditional Access adoption and effectiveness. For that sign-in check, Vitals does not request names, UPNs/email addresses, IP addresses, locations, device details or application names; account identifiers are used transiently in memory for distinct-account counts and individual sign-in records are not persisted. Aggregate counts and derived results may still be personal data where a small population makes an individual identifiable. If the feature is not authorised for a tenant, the assessment continues without collecting or using that sign-in evidence.

Vitals does not read the contents of email messages, Teams chat messages or files. The detailed categories, permissions, purposes, retention arrangements and processor obligations are set out in the applicable Vitals Data Processing Agreement or IT Provider / MSP Agreement.

8. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide Vitals, meet legal and accounting obligations, resolve disputes and establish or defend legal claims.

Customer report-access and Assessment retention periods are governed by the applicable Vitals agreement and DPA. Certain commercial records, such as company, invoice, payment and transaction information, may be retained for longer where required for tax, accounting, fraud-prevention or legal purposes.

How long we keep it

What	How long
Buyer, approver and recipient names and email addresses on an order, signatory name and IP address, and the report	Removed from the live service within 30 days after the report is delivered or, for Vitals In-Depth, released. Where an order includes a verification, we do not keep your address for it. If the order is refunded or closed before delivery, within 30 days after the refund or closure (for a delivered order later refunded, the earlier of the two dates). If it is never completed, within 120 days after the order was paid or, if never paid, created; later activity does not restart that period.
Verification report delivery	Where an order includes a verification, we may keep the minimum assessment baseline needed to perform it (the identifier of the assessed tenant and the stored results of the earlier assessment, not contact details and not report documents) for no longer than 180 days after release, and we remove it when the verification completes or lapses; report documents follow their own shorter retention. For an order placed through an IT provider, the report goes to the provider's current contact details or portal. Otherwise a direct purchaser contacts us at hello@tenantvitals.com, quoting the order reference, during the verification window and gives an address then; we use it for that one delivery only and do not keep it beyond the minimal delivery record that the send requires. A verification report is removed 30 days after it was delivered or, if it was not delivered, 30 days after it was completed, and a verification that has not been completed 30 days after it fell due lapses.
Assessment history of an enrolled tenant	Deleted or de-identified within 30 days after enrolment ends, unless the customer is re-enrolled first, together with any report document, any verification still owed and the notes and commercial inputs the provider recorded about the customer. Where an IT provider still holds the customer, only the customer's name, tenant identifier and the state of the relationship with the provider remain, until the provider or we remove the customer.
Pseudonymised assessment comparison profile	Kept only to compare a customer's next assessment with its latest delivered one, linked to the customer through a pseudonymous identifier and not anonymous; it holds no tenant name or domain, raw tenant identifier, site names or addresses, or ordinary contact details. A verification adds nothing to it. Removed when the customer or IT provider asks us to remove the tenant's data. A minimal relationship record (name, tenant identifier, relationship state) is kept only while an IT provider still holds the customer.
Staff sign-in identity in our administration and security records	Kept on the basis of legitimate interests in accountability and security for no longer than six years after the entry was made. Separately we keep, for as long as that person could otherwise sign in, only the minimum identifier and revoked state needed to prevent withdrawn staff access from being restored. These records are not removed when a customer or provider is erased and hold no customer or provider personal data.
Acceptance and audit evidence	Evidence that an agreement was accepted is limited to the agreement version, the time of acceptance and a stable reference to the organisation or order, and is kept for no longer than six years after the order is completed, refunded or closed or, for an IT provider, after its account is closed (an account that has not been closed is an open relationship). We do not keep a signatory's name, email address or IP address to prove acceptance. Security and audit records are kept for no longer than six years after the entry was made, are limited to what proves the event and are not kept with unrelated customer content.
Report links	Expire no later than 30 days after they are sent, including links sent by our staff.
Email delivery records (type, status, times and the provider's reference; no message text and no address)	Up to 400 days. Error text returned by the email provider, which can include an address, is replaced earlier: when the related order's personal data is removed, or after 30 days.
Records of assessment runs (no personal data)	Up to 400 days after the run ended.
Domain Check requests	An unconfirmed request is deleted after 14 days; an unsubscribed address after 30 days; a confirmed subscription until you unsubscribe.
Service logs held in our monitoring service (Azure Monitor / Application Insights)	30 days. Access links, tokens and approval secrets in web addresses are removed at source before logs are stored there, and email addresses are masked.
IT provider team members	Held while they are on the provider's team. On request, or when the provider's account is closed, we remove their name and email address and show them in our history as an erased person.
Record that a removal took place	A reference, date, the kind of record, internal identifiers, the reason recorded and who in our team carried it out; it does not contain the information removed. Kept for no longer than six years after the entry was made. A separate ledger that holds internal identifiers and dates only is kept for 400 days so that a removal can be repeated if a backup is restored.

Backups

We keep encrypted backup copies of our database only to restore the service after a failure. When we erase information we remove it from the live service within the periods above; that is separate from the expiry of backups. Erased information may remain in encrypted recovery backups for no more than 45 days; we do not alter a backup, and copies already in a backup are removed when that backup is deleted. If we restore a backup, we repeat every erasure made since it was taken before processing resumes and before the service is made available again. Only in exceptional cases (a legal claim, a regulator's request, an incident investigation or a legal duty) do we place a hold on a backup, and only explicitly, for a stated reason, recorded, reviewed at least every 90 days and released when no longer needed; a copy under such a hold may survive for as long as the hold lasts. Ordinary backup storage is not a hold.

Vitals may retain a pseudonymised assessment comparison profile of a customer's latest delivered assessment: the structured results that a later comparison needs (scores, band, licence mix, rule versions and the check, finding and capability results, without any report document), kept solely to compare with a future assessment of the same tenant. It does not include the tenant name or domain, the raw tenant identifier, site names or addresses, or ordinary contact details, and it is linked to the customer only through a pseudonymous identifier that we can recompute when the tenant is next assessed; it is therefore not anonymous. We do not use it for any other purpose, and we remove it when a customer or IT provider asks us to remove the tenant's data. Assessments that were never delivered to the customer are not kept.

9. International transfers

Some of our service providers are based in, or may process information from, countries outside the United Kingdom. Where personal information is transferred internationally, we use an applicable UK data-transfer mechanism or other lawful safeguard where required. Further information about relevant safeguards is available from us on request.

10. Your rights

Depending on the circumstances, UK data-protection law may give you rights to ask us for access to your personal information, to correct or erase it, to restrict or object to processing, and to receive certain information in a portable form. Where processing is based on consent, you may withdraw that consent without affecting earlier lawful processing.

Where we rely on legitimate interests, you may object to processing in appropriate circumstances. We will consider the objection against the relevant legal requirements.

To exercise a right or ask a privacy question, email hello@tenantvitals.com. We may need to verify your identity before acting on a request. We will respond within one month of receiving your request, and we will tell you whether we have kept anything and why. Where we hold your information on a customer's or IT provider's instructions, we will pass your request to them.

11. Complaints

Please contact us first if you have a concern about how we use personal information. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator. Information about making a complaint is available at ico.org.uk.

12. Changes to this notice

We may update this notice when Vitals, our providers or applicable law changes. The current version will be published with its effective date. Material changes will be brought to the attention of affected people where required.

Contact

Innova Technologies Group Ltd
7 Stromberg Street, Anlaby, Hull, HU10 7ER
Email: hello@tenantvitals.com