Lead Routing Agent: Privacy Policy

This Privacy Policy explains how the Lead Routing Agent processes information when used within Microsoft Dynamics 365 and Microsoft Power Platform. The agent evaluates lead information and automatically assigns leads to the appropriate team based on predefined business rules and routing criteria. It should process information only to the extent necessary for lead routing.

Depending on configured routing rules, the agent may process lead name and contact information, company information, location or territory, industry, product or service interest, lead source, lead status and qualification information, and other fields specifically configured for routing. The exact information processed depends on the organization's Dynamics 365 configuration.

Lead information is processed to determine the appropriate team, automatically assign leads according to business rules, support lead distribution, reduce manual assignment activities, improve consistency, and support related business operations. Information unnecessary for routing should not be processed.

Access to lead information is controlled through Microsoft Dynamics 365, Dataverse, and Power Platform security and permissions. Only authorized users, teams, applications, flows, and services should have access to information required for the agent's operation.

Reasonable technical and organizational measures should be used to protect lead information against unauthorized access, modification, disclosure, or loss. These may include Dynamics 365 security roles, Dataverse permissions, team-based access, environment security, authentication, authorization, monitoring, and auditing where enabled.

The agent does not intentionally share lead information with unauthorized third parties. Information may be processed by Dynamics 365, Dataverse, Power Automate, Copilot Studio, or other services configured by the organization. Connected services should be reviewed for privacy and security compliance.

Lead information is retained according to the organization's Dynamics 365 and Dataverse data-retention policies. The agent does not independently establish a separate retention period unless specifically configured to do so.

Users and administrators are responsible for maintaining accurate and up-to-date information in Dynamics 365. Incorrect, incomplete, or outdated lead information may result in incorrect routing decisions.

The agent may make automated routing decisions based on configured business rules and information available on the lead. The organization is responsible for reviewing the routing logic and ensuring that automated processing is appropriate for its business requirements. Where required, appropriate human review should be incorporated.

The agent should follow data-minimization principles. Only necessary lead information should be used for routing, access should be limited to authorized users and services, unnecessary personal information should not be included in routing criteria, and rules and permissions should be reviewed periodically.

Users must use lead information only for authorized business purposes, follow organizational privacy and security policies, avoid unauthorized sharing or export, maintain confidentiality, and report suspected unauthorized access or data exposure to the appropriate administrator or support team.

Administrators are responsible for configuring security roles and permissions, maintaining routing rules, reviewing agent access, monitoring integrations, reviewing audit information where applicable, removing unnecessary access, and ensuring that the agent configuration meets organizational privacy requirements.

The agent may depend on Dynamics 365, Dataverse, Power Automate, Copilot Studio, and other configured services. Third-party connectors or external services should only be enabled when authorized and appropriately reviewed.

Suspected unauthorized access, disclosure, modification, or loss of lead information should be reported immediately to the organization's designated security, privacy, Dynamics 365, or Power Platform administrator. The organization should follow its established incident-response procedures.

This Privacy Policy may be updated when there are significant changes to the agent, data processing, routing functionality, Power Platform configuration, organizational privacy requirements, or applicable laws and regulations.

The organization is responsible for determining and maintaining compliance with applicable privacy, data-protection, regulatory, and contractual requirements. The agent should be configured and used in accordance with organizational policies and applicable laws.

For questions regarding privacy, data processing, security, or access to information processed by the agent, users should contact the organization's designated Privacy, Security, Dynamics 365, or Power Platform administrator.