Privacy statement
1. Who are we?
[COMPANY NAME], [LEGAL FORM], registered office at [ADDRESS], company number [CBE NUMBER] ("we"). We are the makers of SalesOnIPad and Launch ERP. Questions: [PRIVACY-EMAIL].
2. Two roles: controller and processor
For the data of visitors to this website and of our own customers (accounts, billing, support) we are the controller.
For the data our customers keep in their own CRM environment — their customers, contacts, quotations, orders and invoices — we are only the processor: our customer decides, we process solely on their instructions under the data processing agreement that forms part of our terms. If you are a customer of one of our customers and wish to exercise your rights, contact that company; we assist them technically.
3. What data, and why
Contact form on this website. Name, e-mail, company, message. Purpose: answering your request. Basis: pre-contractual steps (art. 6.1.b GDPR) and legitimate interest. Retention: [12 months] after the last contact.
Customer accounts (Launch ERP). Name, e-mail, language, credentials (passwords hashed), roles and permissions, and an audit log (who changed what — security and accountability). Basis: performance of the contract. Retention: lifetime of the account + [30 days] before permanent deletion.
Billing and payments. Billing data (kept for the statutory accounting retention period — as a rule 7 years under Belgian law) and payments through our partners Stripe and Mollie. We never see or store card or account details.
System e-mails. The CRM keeps a dispatch log of document e-mails (to whom, when, which document).
4. What we do not do
- No advertising, no tracking, no third-party analytics scripts (see the cookie statement).
- No selling or renting of data.
- No automated decision-making with legal effects.
5. Recipients and sub-processors
- [HOSTING PROVIDER, e.g. Hetzner — EU] — hosting;
- Stripe — subscription payments (transfer outside the EEA under standard contractual clauses);
- Mollie (EU) — online invoice payment, when a customer enables it;
- [E-MAIL SERVICE] — system e-mails;
- [PEPPOL ACCESS POINT] — delivery of e-invoices, once active.
6. Security
Data of different customers is strictly separated and that separation is tested automatically with every software change. Passwords are hashed; API keys and other secrets are stored encrypted and masked in logs. Role-based access; audit trail; daily backups; https connections.
7. Your rights
Access, rectification, erasure, restriction, portability and objection: e-mail [PRIVACY-EMAIL]; we reply within one month. Data on issued invoices cannot be erased while the statutory retention obligation runs.
You can lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be), our lead supervisory authority, or with the supervisory authority of your own country.
8. Changes
If this statement changes, the date at the top is updated; account holders are informed directly of substantial changes.