Privacy notice for Theia Prozessportal

1. Scope

This notice applies to the app “Theia Prozessportal” by Theia Solutions AG. The app is a solution for SharePoint Online (SharePoint Framework) that your organisation installs in its own Microsoft 365 tenant. Our general privacy policy applies to our website, enquiries, bookings and support.

2. Where the data is stored

• The app runs as a web part in your SharePoint Online.
• It stores all portal content in lists and libraries of the site on which your organisation sets up the app: processes, versions, BPMN models, documents, change requests, comments, history, roles, KPIs, actions and settings.
• The app reads and writes only through the SharePoint interface of this site, with the permissions of the signed-in person. It requests no API permissions.
• The app's code and images come from the package in your organisation's app catalogue, not from a Theia server.

3. Nothing is sent to Theia, no tracking

The app sends no data to Theia and calls no services other than SharePoint Online. It contains no analytics, tracking or advertising functions and sets no cookies of its own. Theia runs no server for the app and has no access to your tenant or your data through the app.

4. Personal data in the portal

Personal data is also entered in the portal, for example names and email addresses of process owners and role members, who submitted, reviewed or approved a change request and when, comments, and questions to the AI assistant. Your organisation is responsible for this data. The permissions of your SharePoint site determine who can see and change it.

Input and results of the AI module (keywords and drafts, pre-checks of change requests, questions and answers) can be read by everyone with access to the portal. The app points this out for AI drafts and in the AI assistant.

5. Optional flows: notifications and reviews

Notifications via Microsoft Teams and Outlook and the daily reminder of reviews that are due are optional flows in Power Automate. They are not part of the app package. If your organisation sets them up, they run in your Power Platform environment, with connections and a service account of your organisation. The flows read entries of the portal site and send messages to the recipients the portal enters. A message contains title, comment and link, plus change request and stage where available.

6. Optional AI module

The AI module is off by default. If your organisation turns it on, the app creates each AI job as an entry in a list of the portal site. A flow in your Power Platform environment sends the input to a prompt in AI Builder, a Microsoft service, and writes the result back to the list.

Depending on the function, the input consists of keywords for a draft, a change request with its model, or a question together with approved portal content. If this content contains personal data, it is sent to AI Builder as well. Processing in AI Builder is governed by your organisation's contract with Microsoft. Where Microsoft processes the input depends on the region of your environment and on your admins' settings; Microsoft describes this on Microsoft Learn. Theia receives neither input nor results.

7. Microsoft 365

SharePoint Online, Power Automate, AI Builder, Microsoft Teams and Outlook are Microsoft services. Microsoft is responsible for processing data in these services under your organisation's contracts with Microsoft; Microsoft's privacy terms apply. Theia is not involved in this processing.

8. When you contact Theia

When you contact us for support, an introduction or a call, for example through the booking page or by email, our general privacy policy applies. If Theia gets access to your tenant or to portal data as part of an agreed introduction or agreed support, we set this out in the separate agreement with your organisation.

9. Contact

For questions about data protection, please contact info@theiasolutions.ch.

10. Changes

We update this notice when the app or the legal requirements change. The version on this page applies.