Personal data we collect
Microsoft collects data from you, through our interactions with you and through our products. You provide some of this data directly, and we get some of it by collecting data about your interactions, use, and experiences with our products. The data we collect depends on the context of your interactions with Microsoft and the choices you make, including your privacy settings and the products and features you use. We also obtain data about you from third parties.
If you represent an organisation, such as a business or school, that utilises Enterprise and Developer Products from Microsoft, please see the Enterprise and developer products section of this privacy statement to learn how we process your data. If you are an end user of a Microsoft product or a Microsoft account provided by your organisation, please see the Products provided by your organisation and the Microsoft account sections for more information.
You have choices when it comes to the technology you use and the data you share. When we ask you to provide personal data, you can decline. Many of our products require some personal data to provide you with a service. If you choose not to provide data required to provide you with a product or feature, you cannot use that product or feature. Likewise, where we need to collect personal data by law or to enter or carry out a contract with you, and you do not provide the data, we will not be able to enter into the contract; or if this relates to an existing product you’re using, we may have to suspend or cancel it. We will notify you if this is the case at the time. Where providing the data is optional, and you choose not to share personal data, features like personalisation that use such data will not work for you.
How we use personal data
Microsoft uses the data we collect to provide you with rich, interactive experiences. In particular, we use data to:
• Provide our products, which includes updating, securing, and troubleshooting, as well as providing support. It also includes sharing data, when it is required to provide the service or carry out the transactions you request.
• Improve and develop our products.
• Personalise our products and make recommendations.
• Advertise and market to you, which includes sending promotional communications, targeting advertising, and presenting you with relevant offers.
We also use the data to operate our business, which includes analysing our performance, meeting our legal obligations, developing our workforce, and doing research.
In carrying out these purposes, we combine data we collect from different contexts (for example, from your use of two Microsoft products) or obtain from third parties to give you a more seamless, consistent, and personalised experience, to make informed business decisions, and for other legitimate purposes.
Our processing of personal data for these purposes includes both automated and manual (human) methods of processing. Our automated methods often are related to and supported by our manual methods. For example, our automated methods include artificial intelligence (AI), which we think of as a set of technologies that enable computers to perceive, learn, reason, and assist in decision-making to solve problems in ways that are similar to what people do. To build, train, and improve the accuracy of our automated methods of processing (including AI), we manually review some of the predictions and inferences produced by the automated methods against the underlying data from which the predictions and inferences were made. For example, we manually review short snippets of voice data that we have taken steps to de-identify to improve our speech recognition technologies. This manual review may be conducted by Microsoft employees or vendors who are working on Microsoft’s behalf.
Reason we share personal data
We share your personal data with your consent or to complete any transaction or provide any product you have requested or authorised. We also share data with Microsoft-controlled affiliates and subsidiaries; with vendors working on our behalf; when required by law or to respond to legal process; to protect our customers; to protect lives; to maintain the security of our products; and to protect the rights and property of Microsoft and its customers.
How to access and control your personal data
You can also make choices about the collection and use of your data by Microsoft. You can control your personal data that Microsoft has obtained, and exercise your data protection rights, by contacting Microsoft or using various tools we provide. In some cases, your ability to access or control your personal data will be limited, as required, or permitted by applicable law. How you can access or control your personal data will also depend on which products you use. For example, you can:
• Control the use of your data for interest-based advertising from Microsoft by visiting our opt-out page.
• Choose whether you wish to receive promotional emails, SMS messages, telephone calls and postal mail from Microsoft.
• Access and clear some of your data through the Microsoft privacy dashboard.
Not all personal data processed by Microsoft can be accessed or controlled via the tools above. If you want to access or control personal data processed by Microsoft that is not available via the tools above or directly through the Microsoft products you use, you can always contact Microsoft at the address in the How to contact us section or by using our web form. We provide aggregate metrics about user requests to exercise their data protection rights via the Microsoft Privacy Report.
Cookies and Similar Technologies
Cookies are small text files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie. We use cookies and similar technologies for storing and honouring your preferences and settings, enabling you to sign-in, providing interest-based advertising, combating fraud, analysing how our products perform and fulfilling other legitimate purposes. Microsoft apps use additional identifiers, such as the advertising ID in Windows described in the Advertising ID section of this privacy statement, for similar purposes.
We also use “web beacons” to help deliver cookies and gather usage and performance data. Our websites may include web beacons, cookies, or similar technologies from third-party service providers.
You have a variety of tools to control the data collected by cookies, web beacons, and similar technologies. For example, you can use controls in your internet browser to limit how the websites you visit are able to use cookies and to withdraw your consent by clearing or blocking cookies.
Products Provided by your organisation – notice to end users
If you use a Microsoft product with an account provided by an organisation you are affiliated with, such as your work or school account, that organisation can:
• Control and administer your Microsoft product and product account, including controlling privacy-related settings of the product or product account.
• Access and process your data, including the interaction data, diagnostic data, and the contents of your communications and files associated with your Microsoft product and product accounts.
If you lose access to your work or school account (in event of change of employment, for example), you may lose access to products and the content associated with those products, including those you acquired on your own behalf, if you used your work or school account to sign into such products.
Many Microsoft products are intended for use by organisations, such as schools and businesses. Please see the Enterprise and developer products section of this privacy statement. If your organisation provides you with access to Microsoft products, your use of the Microsoft products is subject to your organisation’s policies, if any. You should direct your privacy enquiries, including any requests to exercise your data protection rights, to your organisation’s administrator. When you use social features in Microsoft products, other users in your network may see some of your activity. To learn more about the social features and other functionality, please review documentation or help content specific to the Microsoft product. Microsoft is not responsible for the privacy or security practices of our customers, which may differ from those set forth in this privacy statement.
Account
When you use a Microsoft product provided by your organisation, Microsoft’s processing of your personal data in connection with that product is governed by a contract between Microsoft and your organisation. Microsoft processes your personal data to provide the product to your organisation and you, and in some cases for Microsoft’s business operations related to providing the product as described in the Enterprise and developer products section. As mentioned above, if you have questions about Microsoft’s processing of your personal data in connection with providing products to your organisation, please contact your organisation. If you have questions about Microsoft’s business operations in connection with providing products to your organisation as provided in the Product Terms, please contact Microsoft as described in the How to contact us section. For more information on our business operations, please see the Enterprise and developer products section.
For Microsoft products provided by your K-12 school, including Microsoft 365 Education, Microsoft will:
• not collect or use student personal data beyond that needed for authorised educational or school purposes.
• not sell or rent student personal data.
• not use or share student personal data for advertising or similar commercial purposes, such as behavioural targeting of advertisements to students.
• not build a personal profile of a student, other than for supporting authorised educational or school purposes or as authorised by the parent, guardian, or student of appropriate age; and
• require that our vendors with whom student personal data is shared to deliver the educational service, if any, are obligated to implement these same commitments for student personal data.
Collection of data from children
With a Microsoft account, you can sign in to Microsoft products, as well as those of select Microsoft partners. Personal data associated with your Microsoft account includes credentials, name and contact data, payment data, device and usage data, your contacts, information about your activities, and your interests and favourites. Signing in to your Microsoft account enables personalisation and consistent experiences across products and devices, permits you to use cloud data storage, allows you to make payments using payment instruments stored in your Microsoft account and enables other features.
There are three types of Microsoft account:
• When you create your own Microsoft account tied to your personal email address, we refer to that account as a personal Microsoft account.
• When you or your organisation (such as an employer or your school) create your Microsoft account tied to your email address provided by that organisation, we refer to that account as a work or school account.
• When you or your service provider (such as a cable or internet service provider) create your Microsoft account tied to your email address with your service provider’s domain, we refer to that account as a third-party account.
If you sign into a service offered by a third party with your Microsoft account, you will share with that third party the account data required by that service.
When a Microsoft product collects age, and there is an age in your jurisdiction under which parental consent or authorisation is required to use the product, the product will either block users under that age or will ask them to provide consent or authorisation from a parent or guardian before they can use it. We will not knowingly ask children under that age to provide more data than is required to provide for the product.
Once parental consent or authorisation is granted, the child’s account is treated much like any other account. The child can access communication services, like Outlook and Skype, and can freely communicate and share data with other users of all ages. Learn more about parental consent and Microsoft child accounts.
Parents or guardians can change or revoke the consent choices previously made, and review, edit or request the deletion of the personal data of the children for whom they provided consent or authorisation. As the organiser of a Microsoft family group, the parent or guardian can manage a child’s information and settings on their Family Safety page and view and delete a child’s data on their privacy dashboard.
Productivity and communications products
Productivity and communications products are applications, software, and services you can use to create, store, and share documents, as well as communicate with others.
Search, Microsoft Edge, and artificial intelligence
Search and artificial intelligence products connect you with information and intelligently sense, process, and act on information—learning and adapting over time.
Windows is a personalised computing environment that enables you to seamlessly roam and access services, preferences, and content across your computing devices from phones to tablets to the Surface Hub. Rather than residing as a static software programme on your device, key components of Windows are cloud-based, and both cloud and local elements of Windows are updated regularly, providing you with the latest improvements and features. In order to provide this computing experience, we collect data about you, your device, and the way you use Windows. And because Windows is personal to you, we give you choices about the personal data we collect and how we use it. Note that if your Windows device is managed by your organisation (such as your employer or school), your organisation may use centralised management tools provided by Microsoft or others to access and process your data and to control device settings (including privacy settings), device policies, software updates, data collection by us or the organisation or other aspects of your device. Additionally, your organisation may use management tools provided by Microsoft or others to access and process your data from that device, including your interaction data, diagnostic data, and the contents of your communications and files. For more information about data collection in Windows, see Data collection summary for Windows. This statement discusses Windows 10 and Windows 11 and references to Windows in this section relate to those product versions.
