We collect your personal data for the purposes set out below. Failure to provide your personal data when requested may prevent us from being able to carry out these tasks and/or comply with our legal obligations.

1. To administer your employment contract, offer letter or other commitments we have made to you.

We collect and use your personal data primarily for the purposes of managing our employment or working relationship with you, and to fulfill our obligations under your employment contract, or applicable Microsoft policies, including on-boarding, payroll, benefits and equity compensation administration, pension and retirement administration, managing vacation and other types of leave, tax reporting, and the like. A few examples include: your employment contract, your offer letter (e.g., so we can on-board you), promotion history and performance reviews (e.g., so we can manage our employment relationship with you), and your bank account and salary details (e.g., so we can pay you or provide HR benefits).

2. Other overriding and legitimate business purposes

We also may collect and use your personal data when it is necessary for other legitimate purposes, such as general HR administration, maintaining our global directory of employees and external staff, general business management and operations, disclosures for auditing and reporting purposes, measuring employee sentiment, internal investigations, management of network and information systems security, administration of business applications and systems, business operations, workplace analytics, corporate workplace policy compliance, security, life safety, building management, space planning and allocation, provision and improvement of employee services and facilities, physical security and cybersecurity, data protection, for global diversity and inclusion initiatives, to protect the life and safety of employees and others and in connection with the sale, assignment or other transfer of all or part of our business. We also use business data and other workplace usage, device and content data for organizational and individual analytics and data insight purposes to improve Microsoft business operations, manager capability, and the employee experience. We may also use special applications and systems that record employee performance metrics, such as sales related or code databases for business operations purposes as well as for the purposes of reviewing, rewarding and coaching employees on their performance and for administration and assessment of training. We may also process your personal data to investigate potential violations of law or violations of our internal policies.

Additionally, we may process your personal data to conduct scientific research, without your additional consent, when viewed as in the public interest and/or where there is a clear attempt for contributions to generalizable knowledge. In these cases, we will ensure appropriate technical and organizational controls are in place to protect your personal data, such as anonymizing and aggregating data to help protect your identity, ensuring use of your personal data is subject to our privacy standards and conducting ethics and compliance reviews prior to using your personal data.

As Microsoft enables AI supported experiences in its products, your data may also be processed by AI to facilitate certain features and experiences deployed on the Microsoft tenant – including AI co-pilot features such as chatbot features, summarization features, and the like. Microsoft’s processing of your data will comply with its commitment to responsible AI.

3. Legally required purposes

We may also use your personal data when necessary to comply with laws and regulations, including collecting and disclosing personal data as required by law (e.g., for minimum wage, working time, tax, health and safety, anti-discrimination laws, global migration, whistleblowing procedures, and data subject rights), under judicial authorization, or to exercise or defend Microsoft’s legal rights.

4. Other uses of your data (where permissible and in accordance with applicable laws and consultation requirements)

We also may collect your internal usage data of Microsoft products, services and internal applications and tools, including business data created by employees and external staff, to measure and improve these products and for product research including human and machine review of data to train AI models and improve machine learning for Microsoft products and services. Additionally, your internal usage data may be combined with other business data, including workplace, device, usage, and content data, for product improvement purposes or to conduct aggregate analyses to improve internal tools and processes, business operations, manager capability, and employee experience. Where required by law, we will seek your consent for such usage; and where your consent is sought, we will ensure your consent is informed, voluntary, and that you suffer no adverse consequence from any decision to withhold or revoke your consent.

For eligible employees (i.e., part or full-time employees, interns, apprentices, or visiting researchers) who enroll in Microsoft Give, with your consent, we collect and use your personal data to enable voluntary personal donations of money, Microsoft products, volunteer hours to eligible organizations (i.e., certain non-profits or non-governmental organizations), and to inform you of the benefits and opportunities available through Give. Give is a voluntary benefit program from which participants can opt-out and revoke their consent at any time; however, opt-outs and revocations do not affect previous processing of personal data. Further information on Microsoft Give is available here.

Last updated: June 2024

This addendum applies to the Microsoft Data Program (MDP) and the business-related data processed by MDP for purposes of debugging, testing, developing, and improving new and existing products and services (“MDP Data”). MDP data may be used for scientific research purposes and to train AI and machine learning models. MDP and the terms of this addendum apply to Microsoft employees only, including former employees if they were employed at the time the data is extracted. External staff, guests and candidate data are specifically excluded from the scope of MDP. More information about the specific terms and scope of MDP can be found at the Learn More page. Employees may opt-out to limit their participation in the program at any time, without adverse consequence by clicking here http://aka.ms/MDPOptOut.

MDP is aimed primarily at the processing of data or information that is transmitted, created, exchanged or stored by Microsoft employees using Microsoft internal systems, software, services, and assets within the scope of their employment. Microsoft will make reasonable efforts to implement controls to exclude nonbusiness-related data from the scope of MDP, where possible. While those controls are intended to limit the scope of MDP to processing Microsoft business-related data (as described further at the Learn More page), MDP may incidentally process certain personal content for employees that is created, stored or transmitted in Microsoft owned or provided systems and resources. When that occurs, Microsoft will continue to make reasonable efforts to refine its controls to better exclude such data in the future. At all times, MDP’s processing of data will comply with the stated requirements for MDP, as well Microsoft’s internal policies (including the Responsible Use of Technology Policy), as well as local law.

Sources of MDP data include, but are not limited to, emails and calendar information in Exchange, files stored in OneDrive for Business, content of meeting recordings, voice collected on work devices, messages in Viva Engage (formerly known as Yammer) and Teams, content on SharePoint sites, diagnostic data from work devices, search data, product and services feedback data, and internal line of business applications such as those applications developed to support sales processes (e.g., MSX). These are representative and non-exhaustive examples of the types of Microsoft business-related data from which MDP may process data. Up-to-date information concerning MDP can be found at the Learn More page.

In addition to content-related data from the above sources, Microsoft may also process various additional kinds of data from the above sources in support of MDP including (but not limited to):

• Basic Demographic Data, including, for example, your name and alias, etc.;

• Meta-data associated with the applicable content, such as time and date information, signals related to authorship and modification of data, document and meeting titles, etc.; and

• Telemetry data, such as data related to product and feature usage, associated with the above content types and services, or machine-related data such as software version history, machine type, operating system version, etc.

Microsoft’s use of MDP data is premised on Microsoft’s legitimate interest in using its own business data for business-related purposes, as that use strongly exceeds our employee’s individual interest in the privacy of such business-related data. Microsoft may process certain MDP data based on employee consent, to the extent: (1) an individual’s privacy interest would exceed Microsoft’s interest in the processing; and (2) local law requires Microsoft to obtain consent prior to such processing. Where consent constitutes the primary basis for processing data under MDP, Microsoft will in all cases ensure consent is voluntary and informed and will also ensure employees suffer no adverse consequence for refusing to give or later revoking such consent, and gain no specific benefit from choosing to participate or contribute data to MDP.