DRAFT — NOT APPROVED FOR PUBLICATION. Prepared for internal review. The Teams service is not yet live.

Privacy notice

This draft covers the proposed Hal Teams integration and its supporting information pages. The service is intended for authorised 24x7 staff. It is not yet a final or approved privacy notice.

Who is responsible

24x7 Ltd operates the internal Hal service. For privacy questions or requests about your information, contact info@24x7ltd.co.uk. The organisation must confirm the remaining data-protection arrangements before publication.

Information processed

• Messages, replies, attachments you choose to provide, and relevant conversation context.
• Microsoft identity and conversation metadata needed to authenticate users and restrict access, such as user, tenant, team and channel identifiers.
• Device and operational information relevant to an authorised task, which may include device names, account names, health alerts, technical logs, IP addresses and action results.
• Approval decisions, timestamps, errors and security or diagnostic records.

Why it is processed

The intended purposes are internal IT support, diagnosis, requested administration, access control and security or operational investigation. The organisation must confirm and document the applicable lawful basis for each purpose before launch. Employee use must not be treated as blanket consent to all processing.

Where information goes

Microsoft Teams processes messages and associated metadata under the organisation's Microsoft 365 arrangements. Hal runs on an organisation-controlled computer using Hermes Agent. Relevant prompts, conversation context and tool results may be sent to the configured AI provider to produce responses. The current profile is configured to use OpenAI through the openai-codex provider; the organisation must review the applicable account terms and data controls before launch.

Requests to connected management services, including NinjaOne, may transmit task-relevant identifiers and authorised commands to those services. The planned Cloudflare hosting and tunnel would process web requests and bot traffic under the organisation's Cloudflare arrangements. Encrypted transport does not imply that content is hidden from every processing provider.

Hosting locations, international transfers, safeguards, provider retention and any use for model improvement must be confirmed from the actual contracts and settings. This draft makes no promise that processing stays in the UK or EU, or that providers never retain or use data for training.

Records and access

The current Hal profile has conversation storage, session and log directories, and enabled memory and user-profile features. Conversation content, operational results and selected reusable information may therefore persist beyond a single request. Data may also remain in Microsoft 365, connected services, provider systems or backups under their respective arrangements.

Channel members may see channel conversations. Authorised service administrators may be able to access stored records. Access must be limited according to role and business need.

Approved draft local-retention periods

24x7 Ltd has approved the following draft periods for implementation assessment. They are not yet enforced and must not be read as a promise that automatic deletion is active.

• Conversation history and attachments: 30 days.
• Routine diagnostic logs and health snapshots: 30 days.
• Administrative action audit records: 12 months, limited to the details needed to establish who approved what and the outcome.
• Reusable runbooks and configuration: while needed, without credentials or unnecessary personal information.

Documented exceptions may apply to an active incident or legal obligation. The retention clock, safe deletion process, memory handling and backup treatment require implementation review before these periods take effect. Microsoft Teams, AI providers, Cloudflare, NinjaOne and other external systems have separate retention arrangements; removing a local copy does not remove their records.

Information-page visitors

These draft static pages contain no forms, analytics scripts or client-side cookie-setting code. If published, the hosting provider may process request information such as IP address, browser details and timestamps. Any hosting analytics or other additions require review and an updated notice.

Your choices and rights

Keep unnecessary personal information and secrets out of chat. Use the established internal support channel to ask the 24x7 IT team about access, correction, deletion, retention or a concern, and request the organisation's privacy contact. Applicable data-protection rights may include access, rectification, erasure, restriction and objection, subject to the relevant law and exemptions. Requests require assessment and do not guarantee deletion of every audit record or backup.

Where UK data-protection law applies, individuals may complain to the Information Commissioner's Office at ico.org.uk. The organisation must confirm the appropriate supervisory authority and final contact details.