Microsoft 365 Privacy, Security & Monitoring Notice

Jadex Strategic Group (“Jadex,” “we,” “our,” or “us”) is committed to transparency regarding how information is collected, processed, protected, monitored, and retained within our Microsoft 365 environment. Accordingly, this notice explains how Jadex manages information within company-owned and company-managed Microsoft 365 services.

This Microsoft 365 Privacy, Security & Monitoring Notice applies to services such as Microsoft Entra ID, Exchange Online, Microsoft Teams, SharePoint Online, OneDrive, Microsoft Defender, Microsoft Purview, Microsoft Intune, Microsoft Copilot, and related Microsoft cloud services. In addition, this notice applies to related security, governance, compliance, monitoring, and administrative tools that support our Microsoft 365 environment.

This notice is intended for employees, contractors, vendors, strategic partners, referral partners, business associates, temporary staff, and authorized third parties who access, use, or interact with Jadex-managed Microsoft 365 resources. Furthermore, this notice should be read together with our /Website Privacy Policy, Website Terms and Conditions, and Microsoft Teams Privacy and Security Policy.

This notice applies to information processed within Jadex-managed Microsoft 365 environments and related business systems. For example, this notice may apply when users access email, Teams, SharePoint, OneDrive, Microsoft Copilot, Microsoft Defender, Microsoft Intune, Microsoft Purview, or other approved Microsoft 365 services.

• Company-owned Microsoft 365 tenants.
• Company-managed devices.
• Personally owned devices authorized to access company resources.
• Email communications.
• Team collaboration platforms.
• File storage and document management systems.
• Compliance and governance tools.
• Security and monitoring systems.
• Artificial intelligence and productivity services integrated into Microsoft 365.

However, this notice does not replace separate contractual confidentiality obligations, acceptable use policies, employment agreements, independent contractor agreements, vendor agreements, referral agreements, partner agreements, or client-specific requirements. Instead, this notice supplements those obligations by explaining how Microsoft 365 data may be managed, protected, monitored, and retained.

To operate, secure, govern, and maintain our Microsoft 365 environment, Jadex may collect and process several categories of information. In addition, Microsoft services may generate operational, diagnostic, security, compliance, or audit data as users interact with company-managed systems.

Jadex provides Microsoft 365 services primarily for business purposes. Therefore, users should treat company-managed Microsoft 365 accounts, Teams spaces, mailboxes, files, and collaboration tools as business systems rather than personal communication channels.

Business communications conducted through company systems may be logged, monitored, archived, retained, reviewed, or investigated when necessary to support:

• Security operations.
• Compliance requirements.
• Operational continuity.
• Legal obligations.
• Regulatory inquiries.
• Incident investigations.

Accordingly, users should understand that company-owned systems remain company assets and may be subject to business, security, governance, compliance, contractual, and legal requirements. In addition, meeting-related privacy and monitoring practices may also be described in our Microsoft Teams Privacy and Security Policy.

To protect company systems, clients, partners, and organizational information, Jadex maintains security monitoring capabilities throughout Microsoft 365. As a result, authorized personnel may review activity when needed to investigate threats, detect misuse, verify compliance, or maintain operational resilience.

Security controls may include monitoring of:

• Authentication events.
• Sign-in activity.
• Conditional Access events.
• Endpoint compliance.
• Threat detections.
• Administrative actions.
• Data access patterns.
• Data sharing activity.
• Security alerts.
• Risk indicators.
• Audit logs.
• Device compliance events.

Furthermore, security monitoring supports incident response, access governance, regulatory obligations, risk management, client protection, and organizational resilience. However, Jadex limits monitoring and review activities to authorized business, security, legal, compliance, or operational purposes.

Jadex may authorize the use of Microsoft Copilot, Microsoft Copilot Studio, Azure AI services, and other approved artificial intelligence capabilities within company-managed environments. In addition, Jadex may establish security, governance, data classification, and acceptable use requirements for approved AI services.

When users use approved AI services:

• Inputs may be processed to generate responses, recommendations, automation, or analysis.
• Interactions may be logged for operational, compliance, security, or quality assurance purposes.
• Users remain responsible for validating AI-generated content before relying upon it.
• Sensitive information may only be processed in accordance with company policies and data classification requirements.
• Unauthorized AI services, browser extensions, or third-party AI tools may be restricted or prohibited.

Therefore, users must use AI capabilities in a manner that complies with company security, governance, compliance, privacy, and acceptable use requirements. Additionally, users should review related privacy practices in our Website Privacy Policy and Microsoft Teams Privacy and Security Policy when AI features interact with meetings, transcripts, collaboration content, or Microsoft 365 services.

Jadex does not sell personal information. However, Jadex may share information in limited circumstances necessary to deliver services, maintain security, support business operations, comply with legal obligations, or fulfill contractual requirements.

Additionally, broader information-sharing practices are described in our Website Privacy Policy.

Jadex maintains administrative, technical, and organizational safeguards designed to protect information processed within Microsoft 365. In addition, Jadex uses Microsoft security, identity, compliance, and governance capabilities to strengthen operational protection and reduce risk.

• Multi-factor authentication.
• Conditional Access controls.
• Encryption in transit and at rest.
• Endpoint management and device compliance controls.
• Identity and access management processes.
• Role-based access controls.
• Security monitoring and threat detection.
• Data classification and protection controls.
• Access reviews and governance procedures.
• Security awareness and training programs.

Jadex may retain information stored or processed within Microsoft 365 according to business, contractual, legal, regulatory, operational, and security requirements. Additionally, different Microsoft 365 workloads may follow different retention schedules, preservation rules, and deletion timelines.

Jadex may retain information pursuant to:

• Litigation holds.
• Regulatory preservation requirements.
• Contractual obligations.
• Compliance reviews.
• Internal investigations.
• Operational recovery requirements.

Therefore, users should not assume that information disappears from all systems immediately after a user deletes it from an individual Microsoft 365 workload. For example, information may remain in retention systems, audit logs, backups, eDiscovery tools, security systems, or compliance repositories when lawful or business requirements apply.

Subject to applicable laws, contractual obligations, and business requirements, individuals may have rights regarding their personal information. Accordingly, Jadex will evaluate privacy requests based on applicable law, contractual commitments, security requirements, and operational obligations.

• Request access to personal information.
• Request correction of inaccurate information.
• Request available exports of information.
• Request deletion where permitted.
• Object to certain processing activities where legally applicable.
• Request restrictions where permitted by law.

However, certain requests may be limited when Jadex must retain information for operational, legal, regulatory, contractual, compliance, security, or evidence-preservation purposes. For a broader explanation of privacy rights and request handling, users should review our Website Privacy Policy.

Individuals using Jadex-managed systems acknowledge and understand that company systems support business, security, governance, legal, compliance, and operational needs. Therefore, users should not expect company-managed Microsoft 365 environments to operate as purely private personal systems.

• Company systems are intended primarily for business purposes.
• Company information remains company property.
• Security, compliance, and governance monitoring may occur.
• Audit logging and system oversight may occur.
• Business communications may be retained according to company requirements.
• Jadex may modify, suspend, or revoke system access when necessary to protect organizational interests.

In addition, information stored within company-managed systems remains subject to company governance, security, compliance, operational, and legal requirements.

This Microsoft 365 Privacy, Security & Monitoring Notice works together with other Jadex Strategic Group privacy notices, service terms, and communication policies. Therefore, users should review the related policies below when they apply to a specific service, communication channel, meeting, booking, or Microsoft 365 workflow.

• Website Privacy Policy
• Website Terms and Conditions
• Marketing Preferences Privacy Policy
• Microsoft Bookings Privacy Policy
• Microsoft Bookings Terms and Conditions
• Microsoft Teams Privacy and Security Policy
• SMS Privacy Policy
• SMS Terms and Conditions

Additionally, client-specific agreements, statements of work, confidentiality agreements, acceptable use requirements, or regulatory obligations may apply where Jadex provides services under separate written terms.

Jadex may update this notice periodically to reflect changes in business operations, Microsoft technologies, security requirements, regulatory developments, legal obligations, or operational needs. Accordingly, updated versions supersede prior versions as of the published effective date.

If changes are material, Jadex may provide additional notice through the website, internal communications, client notices, or another appropriate communication channel. In addition, users are encouraged to review this notice periodically to remain informed about current practices.

Questions regarding this notice, Microsoft 365 privacy practices, security monitoring, data retention, or related privacy matters may be directed to Jadex Strategic Group.