OnboardPoint
Menu

Home Privacy

Legal

Privacy notice

How Apps 365 Ltd handles personal data for OnboardPoint: this website, the app's licence check-in, and the optional pre-start portal that new starters reach by a private link.

Last updated: 1 November 2026

Who we are

OnboardPoint is made by Apps 365 Ltd, a company registered in England and Wales (number 13955007), 20-22 Wenlock Road, London N1 7GU, United Kingdom. Contact: info@apps365ltd.com. Apps 365 Ltd is a UK company and is not affiliated with apps365.com.

For this website and the licence check-in we are the controller. For the pre-start portal, the employer that sent you the link is the controller and we are its processor.

This website

We use no analytics, advertising or tracking, load nothing from other websites and set no cookies on the public pages. Our web server keeps standard access logs (internet address, time and the address requested) for a short time for security and troubleshooting.

The pre-start portal

If your new employer uses it, HR sends you a private link from their own mailbox. We never see your email address or phone number, and we never send you email.

  • What passes through us. The first name HR chose for the welcome, the answers you give in forms (which may include your National Insurance number, date of birth, emergency contact or other details your employer asks for), the name you type when you acknowledge a document, and the details of files you upload. They go straight to your employer's own Microsoft 365, in the same request, and we do not keep them: no database, file or queue on our server holds them.
  • Files you upload go from your device directly to your employer's SharePoint. We check their size and first bytes afterwards to make sure the file is the type it claims to be, and keep nothing of them.
  • Your session. While you use the pages, one cookie (op_session, strictly necessary, sent only to the portal pages) holds a random session ID. Our server keeps, for at most two hours, only which employer's portal it is, the number of your invite, a journey reference and a fingerprint of your link, so the pages know it is you. It is deleted when you finish, leave or the session ends.
  • Logs. For 30 days we keep a line for each page request: the time, the type of request, the address without your link (it is replaced by [token]), the result, how long it took and your employer's SharePoint address. These lines hold no names, answers or links. Our web server's own access log also records your internet address for a short time, as for the rest of this website.

To see, correct or delete what you sent, contact your employer: they hold it. We will help them answer. Your employer's privacy notice explains why they collect it and how long they keep it.

The OnboardPoint app's licence check-in

At most once a day from each browser, the OnboardPoint app sends the Apps 365 Licence Manager (licences.apps365.pro) your Microsoft 365 tenant ID, the addresses of the OnboardPoint site and its site collection, the app version, the licence state and plan, and the licence ID it uses. It never sends names, onboarding records or keys. We use it to support your licence; our lawful basis is our legitimate interest in supporting the licences we issue. The Licence Manager keeps no IP address. A site owner can switch the check-in off in OnboardPoint's Settings; licence keys keep working without it.

Organisations that use OnboardPoint

Onboarding records are kept in the organisation's own SharePoint lists. Apps 365 Ltd does not keep a copy. For the pre-start portal we keep the portal site's identifiers (tenant ID, SharePoint address, site and list IDs and a connection code), with no personal data. Payments for licences are handled by Apps 365 Ltd's online shop under its own privacy notice.

How we protect data

Everything travels over HTTPS. The portal reaches an organisation's Microsoft 365 only through the five lists its administrator grants, and signs in with a certificate, never a password. The security page lists every permission and control.

Who else handles data

Our hosting provider in the United Kingdom runs the server. Microsoft holds each organisation's onboarding records under the organisation's own agreement with Microsoft. We do not sell personal data or share it for marketing.

Your rights

You can ask us for a copy of the personal data we hold about you, and ask us to correct or delete it, or to restrict or object to its use. Contact info@apps365ltd.com. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

We will update this notice when what we do changes, and change the date at the top.