Model DPIA: Pipeline with a connected Microsoft mailbox

1. About this model

You own the DPIA. Your organisation is the controller of the mail and meetings Pipeline keeps, so the duty to carry out a DPIA is yours (Art. 35 GDPR). Lyto is your processor. It must help you (Art. 28(3)(f)), and this model is that help.
It describes Pipeline as Lyto builds it. Sections 3 to 6 are the same for every organisation. Section 7 and the decision in section 8 are yours.
It is not legal advice. If your situation differs from the one described here, for example because you are a larger organisation or work with health data, have the DPIA reviewed.
How to use it. Copy this page into your own document, complete it, and sign it before the first mailbox is connected. Review it every year, and when Lyto tells you the processing has changed.

2. Why a DPIA is needed

Pipeline reads the whole Inbox, Sent items and calendar of every member who connects, continuously. That is systematic processing of employees’ email. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) lists both controle werknemers (item 11, including “controle van e-mail”) and communicatiegegevens (item 13) among the processing for which a DPIA is mandatory (Stcrt. 2019, 64418). It also meets several of the European criteria for high risk: systematic monitoring, email as highly personal data, employees as data subjects, and combining datasets (WP248 rev.01). Treat the DPIA as required.

3. The processing

3.1 Purpose

To keep the organisation’s record of its business relationships: the mail and meetings each member has with clients, prospects and other outside companies, on the record of that company and person in Pipeline, so that everyone who works with a client can see the history. Optionally, to let members send email from Pipeline through their own mailbox.

3.2 What Pipeline reads

Whose mailbox: only the mailbox of a member who connects it themselves, one per member. A work mailbox also needs your Microsoft 365 administrator to approve Pipeline once. Shared mailboxes are not offered.
Which folders: Inbox, Sent items and the primary calendar. No other folders or calendars.
How far back: on first connect, the last 12 months of mail and calendar. The calendar is also read 90 days ahead. After that, Pipeline reads new mail every 5 minutes and the calendar every 15 minutes.
Microsoft permissions: openid profile offline_access User.Read Mail.Read Mail.Send Calendars.ReadBasic. Calendars.ReadBasic excludes meeting bodies and attachments. Pipeline cannot change or delete anything in the mailbox.

3.3 What Pipeline keeps

Pipeline reads the headers of each message first and applies its capture rules. Only mail that qualifies has its content fetched.

Item	Kept?	How long
Mail with a company the member has written to, or with a person or company already in Pipeline	Yes: sender, recipients, date, subject, content, attachments	As long as that person or company is in Pipeline, or until removed. The raw message file: 30 days
One-way mail from an unknown company (work mailbox; last 90 days only in the history)	Headers only, as a suggestion: sender, recipients, date, subject	Until accepted, dismissed or 30 days. A dismissed domain stays blocked (the domain alone)
Mail between colleagues, from free-mail providers with no match, newsletters and anything else that does not qualify	Never stored, not even an identifier	Not applicable
Mail marked Private in Outlook	Skipped	Not applicable
Meetings with a person or company in Pipeline (or an attendee whose unknown company becomes a suggestion), with at least one outside attendee, at most 25 attendees, not declined by the member	Title, time, place, organiser, attendees and their replies. Never the body	As long as a linked person or company is in Pipeline, or until removed
Internal meetings, meetings that match no one in Pipeline and make no suggestion, and meetings marked private, personal or confidential	Never stored	Not applicable
Connection: mailbox address, Microsoft identifiers, encrypted refresh token, sync position	Yes	Until the mailbox is disconnected

A personal mailbox (Outlook.com, Hotmail) never adds a company by itself: every new company becomes a suggestion for the member to accept. Messages deleted or archived in Outlook stay in Pipeline, because the kept mail is the organisation’s record. Remove from Pipeline deletes it.

3.4 Who is involved

Data subjects: members who connect a mailbox; colleagues who appear in kept mail or meetings; correspondents and meeting attendees outside the organisation.
Who sees kept mail: members of your organisation in Pipeline. Each member sets their own sharing level: teammates see their mail in full (the default) or only who, when and the subject. A member can mark any thread private or remove it. The admin view of team mailboxes shows whether each mailbox syncs, never its mail.
Contact overview: Pipeline shows how recently and how often each member was in touch with a company (connection strength). Every member sees every member’s level, including for private threads, whose subject is never shown.
Lyto, as your processor, under the processor agreement, which is part of the Lyto terms, and its Pipeline annex (Annex P).
Sub-processors (see the privacy policy): Supabase stores the data in Ireland. Anthropic processes it in the United States, under the Standard Contractual Clauses, only when a member uses an AI feature that reads the record; its inputs are not used for training. Vercel serves the app from Frankfurt and stores none of it.
Microsoft is not a sub-processor of Lyto. It is the source of the data: your own Microsoft service, under your own agreement with Microsoft.

4. Lawful basis, necessity and proportionality

Lawful basis: your legitimate interest in keeping a complete record of your business relationships (Art. 6(1)(f)). Employees’ consent is not the basis: at work, it is rarely freely given. A member’s own choice to connect, and their ability to disconnect, mark private and remove, are safeguards.
Balancing test: the interest is real and specific (the client history otherwise lives in separate inboxes). The impact on members and contacts is limited by the measures in section 5: business mail with outside companies only, private items skipped, everything else never stored. Members and contacts can reasonably expect a firm to keep its client correspondence, provided they are told (see below).
Necessity: the less intrusive alternative is the capture address, where a member forwards or copies each message by hand. It remains available. It misses history, meetings and any mail the member forgets, which is why the mailbox connection is offered. Each member can still choose not to connect.
Minimisation and retention: section 3.3. The history window is fixed at 12 months, not all history.
Transparency: before the first mailbox is connected, you tell your team (Pipeline gives you a copyable message) and update your own privacy statement for your contacts (Pipeline gives you the paragraph, covering mail and meetings synced from team members’ mailboxes). Each member sees what Pipeline does with their mailbox before connecting.
Rights of data subjects: Pipeline can export what it holds about a person, erase a person or company, and remove single threads and meetings.
Transfers outside the EEA: only to Anthropic, when an AI feature is used, under the Standard Contractual Clauses.

5. Risks and measures

The likelihood and severity below are Lyto’s assessment for a small professional-services firm, after the measures. Change them where your situation differs.

Risk to the people involved	Measures	Residual risk
A member’s private mail ends up in the CRM or is seen by colleagues	Only mail with outside companies the member wrote to, or already in Pipeline, is kept; free-mail and internal mail are not; Outlook-private mail and private meetings are skipped; a personal mailbox only suggests; Mark private and Remove; sharing level per member	Low
Members feel monitored: who they mail, how often, how quickly	The purpose is the client record, not performance; admins never see mail through the admin view; members set their own sharing level; the team is told beforehand; connecting is the member’s own action. Contact counts per member are visible to all members, which you should mention in your team message	Medium: decide in section 8 whether you accept it
Contacts do not know their mail is kept	Your privacy statement paragraph; only business correspondence is kept; access and erasure on request	Low
Special categories (health, for example) appear in mail	Not sought out; private items skipped; Remove and erasure delete it; access limited to your organisation	Low to medium, depending on your clients
Unauthorised access to mail or to the mailbox connection	EU hosting; encryption in transit and at rest; refresh tokens encrypted again in the application and replaced at every refresh; access tokens only in memory; row-level isolation per organisation; multi-factor authentication for Lyto’s administrative access; breach notice to you within the agreed time	Low
Too much kept, for too long	Non-qualifying mail never stored; a 12-month history window; suggestion headers deleted after 30 days; raw message files after 30 days; disconnecting deletes the connection and every unqualified item at once	Low
Data used for other purposes	The processor agreement forbids it: no advertising, no AI training, no use for Lyto’s own purposes. The Microsoft APIs Terms of Use also forbid any advertising or marketing use	Low
Mail stays after a member leaves or disconnects	It is your organisation’s record and stays by design; the member can choose Remove what only my mailbox brought in when disconnecting; leaving deletes the connection, drafts and signature	Low

6. Disconnecting and ending

A member disconnects in Pipeline. An admin can disconnect any member’s mailbox. Pipeline disconnects automatically when a member leaves, after 90 days of a broken connection, and when Lyto switches the feature off for your organisation.
Every disconnect deletes at once the tokens, the sync position and every suggestion’s headers. Kept mail and meetings stay unless the member chooses to remove what only their mailbox brought in.
Revoking Pipeline at myapps.microsoft.com (work) or account.live.com/consent/Manage (personal) stops all reading at once.
When your organisation closes its Lyto account, everything is deleted within 90 days, and backups rotate out within 30 days after that.

7. Your organisation

Fill this in.

Organisation: [name, KvK number]
Number of people, and how many will connect a mailbox: [number]
Work or personal mailboxes: [Microsoft 365 / Outlook.com]
Kinds of clients, and whether their mail is likely to contain special categories of data: [description]
Works council or staff representation: [none / consulted on date, outcome]
Team informed: [date, how]
Privacy statement updated for contacts: [date, link]
Processor agreement with Lyto: [the standard agreement, accepted with the Lyto terms on date / a copy signed on date]
Data protection officer, if you have one, consulted: [name, advice]
Anything that differs from sections 3 to 6: [description]

8. Decision

Residual risk: [acceptable / not acceptable], because [reason].
Prior consultation: if a high risk remains after the measures, consult the Autoriteit Persoonsgegevens before you start (Art. 36). For the processing described here, with the measures applied, Lyto does not expect that to be needed.
Decided by: [name, role], on [date].
Next review: [date, at most a year from now].

Questions about this model: lytoapp@gmail.com.