Data protection

Privacy notice for the Project2Planner add-in

As of: 19 October 2026

1. Controller

Holert GmbH
Luise-Ullrich-Straße 20
80636 Munich
Germany
E-mail: info@holert.com
Phone: +49 89 599974700

Data protection officer: Dr. Jochen Notholt (lawyer), Lindwurmstr. 10, 80337 Munich, Germany, e-mail: inbox@comp-lex.de

2. Scope

This notice covers the Project2Planner add-in for Microsoft Project. Visiting www.holert.com is covered by the general privacy policy.

3. Sign-in and synchronisation

The user signs in with their Microsoft 365 account. Task data goes directly from the user's computer to Microsoft Planner in the customer's own Microsoft 365 tenant, using the delegated permissions User.Read, User.ReadBasic.All and Tasks.ReadWrite. Holert receives none of this data. For data in Microsoft 365, the customer is the controller and Microsoft its processor.

4. Licence check

After sign-in, the add-in downloads the licence file of the customer's tenant from a storage account of Holert in Microsoft Azure and compares the user's sign-in name with it on the user's computer. The licence file holds the customer's name, the expiry date and one-way hashes of the licensed users, no mail addresses. The result is cached on the user's computer, encrypted for that user. Purpose: performance of the licence agreement (Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR towards the users of the customer).

5. Usage and error data

The add-in sends usage and error data to Microsoft Azure Application Insights, operated for Holert in the region Germany West Central:

  • tenant id, domain of the sign-in name, a pseudonymised user id (one-way hash of the Entra object id), add-in version, licence state and sync mode;
  • which action a user starts (create/update, refresh, delete) and, per run, how many tasks were created, updated, deleted, skipped or failed, and why;
  • technical error information (error type, message, program location);
  • time stamp and the country and city derived from the IP address; the IP address itself is not stored.

No names, mail addresses, task names or other project content are sent. Purposes: invoicing per licensed user, detecting unlicensed use, error analysis and improving the add-in. Legal basis: Art. 6(1)(b) and (f) GDPR. Retention: 365 days.

6. Log files

The add-in writes log files on the user's computer and deletes them after 90 days. They are transmitted only if the user sends them to support.

7. Licence request

The add-in can open a prepared mail to sales@holert.com with the user, the customer and the licence state. The mail is only sent if the user sends it.

8. Recipients and transfers

Microsoft Ireland Operations Ltd. processes the licence files and usage data on Holert's behalf as processor. A transfer to Microsoft Corporation in the USA cannot be ruled out; it is based on the EU-US Data Privacy Framework and the standard contractual clauses of Microsoft's data protection addendum.

9. Your rights

Data subjects have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). In addition, they may lodge a complaint with a supervisory authority pursuant to Art. 77(1) GDPR, in particular in the EU member state of their residence, their place of work or the place of the alleged infringement. The authority responsible for Holert is the Bavarian State Office for Data Protection Supervision (BayLDA). Because the user id is pseudonymised, Holert can only assign data to a person if the person provides their Entra object id.