1. Data Controller

The data controller responsible for the processing of personal data is MOFFI, a simplified joint-stock company (SAS), registered with the Lille Trade and Companies Register under number 821 179 843, with its registered office located at 225 rue des Templiers, 59000 Lille, France (hereinafter “We”).

2. Nature of Processed Data

As part of the use of the Waldo solution:

• No direct personal data of end users (such as names or email addresses) is stored within the application
• Only technical identifiers (User IDs) are stored

👉 The mapping between these identifiers and user identities is fully managed by the customer’s identity provider (Microsoft Entra ID / Azure Active Directory).

Similarly, office locations and areas are referenced using technical identifiers only.

3. Administrative Data

For administrative and account management purposes, the following data may be collected and stored:

• First name, last name, and email address of the Waldo administrator
• First name, last name, and email address of the administrative contact
• First name, last name, and email address of the technical contact

This data is strictly limited to service management needs.

4. Data Hosting

Data is hosted on Microsoft Azure, within a secure multi-tenant environment.

By default, data is stored in Microsoft data centers located in:

• Middenmeer (Netherlands)
• Clondalkin (Ireland)

These locations comply with Microsoft 365 European data residency policies.

5. Security and Authentication Model

Waldo relies on an identity-first security model:

• Authentication is fully delegated to an external identity provider (Microsoft Entra ID)
• Use of secure standard protocols (OAuth 2.0 and OpenID Connect)
• No local password management

👉 Access to resources is controlled via secure access tokens issued by the identity provider, ensuring alignment with Zero Trust principles.

6. Data Retention Period

Data retention is fully configurable by the customer.

By default:

• data is retained from the date of Waldo deployment

Customers may configure retention periods as follows:

• 3 months
• 6 months
• 12 months
• 24 months
• 36 months

This setting can be managed via:
Waldo Portal → Global Settings → Data Retention

7. Rights of Data Subjects

As Waldo does not directly store personal data of end users:

• Rights of access, rectification, and deletion are exercised through the customer’s identity provider (Azure Active Directory)

For administrative data:

• data subjects may exercise their rights by contacting the data controller

8. Data Protection Officer (DPO)

We have appointed a Data Protection Officer.

📧 Contact: dpo@moffi.io
📍 Address: Data Protection Officer – 225 rue des Templiers – 59000 Lille – France