Anonymized customer data human review notice

Microsoft Corporation ("Microsoft") is pleased to work with you (the "Customer" named below) to develop and/or improve Microsoft online services through use of your anonymized Customer Data identified in Exhibit A of this notice ("Engagement Customer Data"). The project described in this notice and in the attached Exhibit A is referred to as the "Engagement." You can opt out of the Engagement at any time by giving Microsoft 30 days' advance notice at the email address in the signature block below.

This notice and the Engagement are subject to the Microsoft Online Services Terms ("OST") and all other Microsoft volume licensing agreement(s) applicable to your use of Microsoft online services ("VLA"), as well as the Non-Disclosure Agreement executed between you and Microsoft and attached to this notice as Exhibit B ("NDA"). Any capitalized terms not otherwise defined in this notice will have the meaning given to them in the OST, your VLA, or the NDA, as applicable.

The purpose of this notice is to provide you with transparency around Microsoft's use of the Engagement Customer Data during the Engagement Period specified in Exhibit A. The Engagement will involve direct human review of the Engagement Customer Data by engineers and data scientists from Microsoft, and from subprocessors identified on the Microsoft Online Services Subprocessor List ("Subprocessors"), for the purpose of building, improving, and validating Microsoft's machine learning models for the Microsoft online services specified in Exhibit A or other current or future Microsoft products, services, or technologies ("Improvements"). In order to proceed with the Engagement, you agree to provide us with access to the Engagement Customer Data during the Engagement Period.

As between you and Microsoft: (a) all Engagement Customer Data remains yours and (b) all Improvements, and any work product or developments (such as coding or documentation) resulting from Microsoft's use of Engagement Customer Data, will be owned by Microsoft subject to any underlying rights of yours in the Engagement Customer Data. In addition, all Engagement Customer Data will remain your Confidential Information and all Improvements will remain Microsoft's Confidential Information.

During the Engagement, you can provide Microsoft with Feedback to help with the Improvements. Providing Feedback to Microsoft is voluntary and Microsoft is under no obligation to post or use any of your Feedback. By providing Feedback to Microsoft, you (and anyone providing Feedback through you or on your behalf) irrevocably and perpetually grant to Microsoft and its Affiliates, under all of its (and their) owned or controlled intellectual property rights, a worldwide, non-exclusive, fully paid-up, royalty-free, transferable, sub-licensable right and license to make, use, reproduce, prepare derivative works based upon, distribute, publicly perform, publicly display, transmit, and otherwise commercialize the Feedback (including by combining or interfacing products, services, or technologies that depend on or incorporate Feedback with other products, services, or technologies of Microsoft or others), without attribution in any way and for any purpose. You warrant that (a) you won't provide Feedback that is subject to a license requiring Microsoft to license anything to or from third parties because Microsoft exercises any of its rights in the abovementioned Feedback, and (b) you own or otherwise control all of the rights to such Page 2 of 4 Microsoft Confidential Feedback and that no such Feedback is subject to any third-party rights (including any personality or publicity rights).

Any suspension or opt-out of the Engagement doesn't affect your applicable VLA or your subscription of Microsoft online services. The Engagement will be without charge to, or fees or reimbursement from, the other party and each party will bear its own expenses.

We look forward to working with you. Thank you.

Exhibit A

Online Services: Dynamics 365 Customer Insights - Journeys and Power Platform applications

Engagement Period: From date of opt-in until Customer opts out of, or Microsoft terminates, the Engagement ("Engagement Period")

Reason for human review

Direct access to your anonymized Engagement Customer Data is required to build, validate, and improve AI related features of the Online Service. None of your Engagement Customer Data will be contained in any of the resulting ML models.

Engagement summary and purpose

Engineers and data scientists from Microsoft and/or from Subprocessors will perform direct human review of your Engagement Customer Data for the purpose of building, improving, and validating machine learning (ML) models. The desired outcome is an improved customer experience with better ML model implementations. As part of the Engagement, you consent to permit Microsoft representatives to contact your system administrator periodically with questions about your experiences with the Engagement and our services. If you would like to opt out of being contacted, you can do so at any time by opting out in the settings page.

Description of engagement customer data

Microsoft and/or Subprocessors will access your Engagement Customer Data includes:

1. Your contact information and marketing activity data (for example, email content, forms, webpages, events, customer journey) stored in Dataverse, and contact behavioral data stored in Dynamics 365 Customer Insights - Journeys Interaction Data Blob Storage. (Collectively, "Customer Insights - Journeys Data")
2. Your users' queries from Dynamics 365 Customer Insights - Journeys and Power Platform applications querying Dataverse data, related telemetry, and returned results of the queries (collectively, "Query Data"); and
3. Dataverse database schema, which includes table names and column names, but no data associated with the tables and columns ("Data Schema"). For example, if you have a field called "Customer name," with various customer names in the field, Data Schema includes the term "Customer name," but it doesn't include the customer names themselves.

Access and use

1. Customer Insights - Journeys Data and Query Data – We'll make copies of your Customer Insights - Journeys Data and Query Data into a Microsoft-owned Azure storage and then purge such copies after 30 days. The copies will (a) maintain proper tagging to handle Data Subject Rights requests, and (b) remain in the same geo location as your Customer Insights - Journeys Data and Query Data – partitioned by tenant and not shared outside of your environment. Access will be restricted to no more than the minimal number of individuals from Microsoft and/or Subprocessors, via secure access workstations, as reasonably needed for the Engagement. We'll access and use your Customer Insights - Journeys Data and Query Data only for the purposes of this Engagement.
2. Data Schema – Microsoft will copy the Data Schema from your tenant, store it in the United States for up to 12 months, and use it for the purposes of the Engagement, including combining it with other customers' schemas. Data Schema may be stored, accessed, or processed on systems that don't meet Microsoft's standard security commitments. None of the Data Schema will include Personal Data.

What are the benefits of opting in?

Sharing your data can benefit you in two ways:

1. Existing AI features in the Dynamics 365 Customer Insights - Journeys product (such as Spam Checker and Automated Scheduler) will be more effective for you, as the models learn from and adapt to aggregate patterns observed in your data.
2. We can derive new models that power new AI features in the product. Your marketing team(s) can use these AI features to deliver more effective marketing campaigns and increase their productivity.

How do I opt out?

A user with administrator privileges can opt out by going to Settings > Feature switches > Copilot and setting the "Global data sharing consent" toggle to Off.

What happens when I opt out?

You own your data. Microsoft will use your Customer Data only to provide the services we've agreed upon and for the purposes that are compatible with providing those services. Your data remains yours and we don't share it. If you leave this program, we take the necessary steps to ensure the continued ownership of your data.

Who has access to my data?

Access to anonymized customer data is strictly controlled; only the minimal number of individuals required, with Microsoft authorized access, have permission to view your data. Access control follows a process that ensures that the individual requesting access to these systems has met the eligibility requirements, including background screening, security training, and access approval. In addition, the access levels are actively monitored to ensure that only users who have appropriate business justification have access to the system.

What about data privacy?

All proper tagging to handle DSRs is maintained. You can contact your Dynamics 365 Customer Insights - Journeys product team representative with any DSRs under various privacy laws and regulations.

Have more questions?

Learn more: Microsoft Privacy Statement.