Legal
Privacy Policy
Last updated: May 2026 · MSP Dashboard is operated by Cloudworks Services Ltd, a company registered in England and Wales.
1. Who we are and how to contact us
MSP Dashboard is a SaaS product operated by Cloudworks Services Ltd. For any questions about this policy or to exercise your data protection rights, please contact us at:
Email: privacy@mspdashboard.io
Subject line: Data Protection Enquiry
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
2. Our role: controller and processor
MSP Dashboard acts in two distinct capacities depending on the data involved:
- → Data controller for the personal data of people who create accounts and log in to MSP Dashboard using Microsoft 365 — for example, your email address, display name, and view history.
- → Data processor acting on your organisation's behalf for all data pulled from your connected ticketing system (such as HaloPSA). In this role, your organisation is the data controller and we process the data on your documented instructions.
3. What personal data we collect and why
Account and identity data
When you sign in with Microsoft 365 we receive your email address, email domain, and display name from your Microsoft account. We use your email domain to associate your account with your organisation's dashboard.
Lawful basis: Contract — this data is required to provide the service you have signed up for.
Dashboard usage data
We record a display name (derived from your email address) and timestamp each time your account opens a dashboard. This view history is visible to admin-level users in your organisation and is limited to the most recent 50 entries within the last 12 months.
Lawful basis: Legitimate interests — this gives your organisation accountability over who is accessing its data. You can object to this processing by contacting us.
Ticketing system data
Once you connect your ticketing system, we retrieve and store aggregated operational data on your behalf. This includes technician names, ticket counts by client and agent per month, agent hours worked, client names, and calendar/appointment data. This data is processed solely to generate your dashboard and related reports. Individual ticket details (subject, description, assigned agent) are fetched live on demand and are never stored by us.
Lawful basis: Legitimate interests of your organisation as data controller. We rely on your organisation's lawful basis for processing this data. Your acceptance of our Data Processing Agreement documents this arrangement.
Shared reports
When you generate a shareable report it is stored as a file accessible via a unique link. Reports may contain technician names, performance figures, and client names. Report links do not require login — anyone who receives the link can view the report. Reports expire after the period you select (default 30 days) and the file is deleted at expiry. You should only share report links with intended recipients.
Lawful basis: Contract and legitimate interests — you initiate report generation as part of the service.
API credentials
Your ticketing system Client ID and Client Secret are stored in Azure Key Vault using encryption at rest. They are accessed only to retrieve data for your dashboard and are never logged or exposed in plain text.
Lawful basis: Contract — required to deliver the service.
Operational telemetry
We use Microsoft Azure Application Insights for error logging and performance monitoring. Telemetry data is retained for 90 days and is not used for marketing or profiling.
Lawful basis: Legitimate interests — we have a genuine interest in maintaining a secure and reliable service.
4. How long we keep your data
| Data category | Retention period |
|---|---|
| Account email and domain | For as long as your organisation has an active subscription, then deleted within 30 days of cancellation. |
| Dashboard view history | Last 50 entries within 12 months, on a rolling basis. |
| Ticketing system data (aggregated) | Retained while your subscription is active. Deleted within 30 days of cancellation. |
| API credentials | Retained while your subscription is active. Deleted from Key Vault within 30 days of cancellation. |
| Shared reports | Deleted automatically at the expiry date you choose when generating the report (maximum 90 days). |
| Setup session records | Deleted immediately after successful dashboard provisioning. |
| Application Insights telemetry | 90 days. |
5. Who we share your data with
We do not sell your data or share it with advertisers. We use the following sub-processors to operate the service:
- →Microsoft Azure — cloud infrastructure (storage, functions, authentication). Data is processed in UK data centres. Covered by Microsoft's Data Processing Agreement.
- →Microsoft Graph — used to send shared report emails on your instruction. Only triggered when you explicitly choose to email a report.
We will notify you at least 14 days in advance of any change to our sub-processors.
6. International transfers
Your data is processed and stored on Microsoft Azure infrastructure in the United Kingdom (UK South / UK West regions). We do not transfer your personal data outside the UK except where covered by Microsoft's standard contractual safeguards under their Data Processing Agreement.
7. Your rights under UK GDPR
You have the following rights in relation to your personal data:
- →Access — request a copy of the personal data we hold about you.
- →Rectification — ask us to correct inaccurate data.
- →Erasure — request deletion of your data where we no longer have a lawful basis to retain it.
- →Restriction — ask us to pause processing of your data in certain circumstances.
- →Portability — receive your data in a structured, machine-readable format.
- →Object — object to processing based on legitimate interests (including view tracking). We will stop unless we have compelling legitimate grounds.
To exercise any of these rights, email privacy@mspdashboard.io. We will respond within 30 days. We may ask you to verify your identity before acting on a request.
Note for technicians and employees of MSP customers: if your employer uses MSP Dashboard, they are the data controller for your performance data. Please contact your employer in the first instance — they are responsible for handling your subject access requests in relation to that data.
8. Security
We implement appropriate technical and organisational security measures in line with Article 32 of UK GDPR. These include encryption of API credentials at rest using Azure Key Vault, authentication required for all dashboard data endpoints, per-user capability controls, CSRF protection on administrative functions, and brute-force lockout on login. In the event of a personal data breach that poses a risk to individuals, we will notify the ICO within 72 hours and inform affected customers without undue delay.
9. Cookies and local storage
MSP Dashboard uses browser session storage to temporarily cache verified API credential results during your setup session. This data is cleared when you close your browser tab. We use browser local storage only for UI preferences such as theme and display settings — no personal data is stored there. We do not use advertising cookies or third-party tracking.
10. Changes to this policy
We may update this policy from time to time. If we make material changes we will notify you by email (using the address associated with your account) or by displaying a prominent notice in the product before the changes take effect. The date at the top of this page shows when the policy was last updated.