- Effective Date
- Last updated
Introduction
This privacy policy (the “Privacy Policy”) is established by IWD, having its registered office located at 77 rue du Faubourg Saint-Antoine 75011 Paris France, registered under the number 429 080 526 RCS Paris, in its capacity of data controller.
IWD has appointed a data protection officer who can be reached at the following address: gdpr@iwd.io.
Our Privacy Policy explains the data we collect, how we use it, how to manage your privacy controls and your rights in connection with our website and the related mobile application and services (collectively, the “Service”).
This policy was written in English. To the extent a translated version conflicts with the English version, the English version prevails.
Questions or comments about this Privacy Policy may be submitted through our contact form.
Data Processed
The use of the Service implies we collect and process information about you, including information that directly or indirectly identifies you.
Account, Profile, Activity, and Use Information
We collect basic account information such as your name, email address, contact number and profile picture (optional) to provide you with access to our Services.
Activity and use information is collected when you access the Service, in particular login details and navigation data related to the use of the Services or when you contact the support service.
Content you enter in the Service
When you use the Service for your organisation, you enter content such as photos of points of sale, photos answering surveys, survey answers and changes to points of sale. Each item is stored with the email address of the user who created it and of the user who last modified it, the dates, and what it relates to in the Service, such as a point of sale, a campaign or tags.
Point of sale photos are meant to show the point of sale and what it displays: planograms, point-of-sale advertising, in-store events, and the like. Where possible, avoid taking photos in which people can be identified. Photos you upload keep the metadata your camera recorded in them, which can include the location where they were taken.
Location Information
When you use our mobile application, and subject to your prior consent, we collect and process location information when you use the Service for informing you about the nearest shops. We do not track your device location while you are not using the Service.
Third-Party Authentication
The Service allows you to log in using accounts created with third-party products and services, such as Google, Azure and other Authentication Providers (collectively, “Third-Party Accounts”). If you access the Service with Third-Party Accounts we will collect information that you have agreed to make available such as your name and email address. This information is collected by the Third-Party Account providers and is provided to the Service under their privacy policies. You can generally control the information that we receive from these sources using the privacy controls in your Third-Party Account.
Technical Information and Log Files
We collect information from your browser, computer, or mobile device, which provides us with technical information when you access or use the Service. This technical information includes device and network information, cookies, log files and analytics information. Learn more about how we use cookies and manage your preferences by visiting our Cookie Policy.
The information stored in log files includes IP addresses, browser type, internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and number of clicks. This information is used to analyze trends, administer, protect and secure the Service, track user movement in the aggregate, and gather broad demographic information (e.g., country residence) for aggregate use. IP addresses may be linked to session IDs and device identifiers.
Other Information
We may collect information directly from you or through our service providers, such as when we collect your feedback through surveys.
How We Use your Data and for how long
| Purposes | Legal basis | Retention period |
|---|---|---|
|
To provide the Service We use the information we collect and receive to provide the Service |
Contract execution | As long as the account is active, then retention for a 5-year period for evidentiary purposes |
|
To protect you and the Service We use the information we collect and receive to protect users and our service, to monitor usage for Services resources and malicious or fraudulent activity. |
Our legitimate interest in ensuring the proper functioning of the Service and its security | Logging of technical connection logs is kept for a period of 12 months |
|
To assist you with a support request We use the information we collect and receive to provide support in response to your requests and comments. Depending on your request, this may require us to access your account, for example, to troubleshoot or replicate a reported issue. |
Contract execution | As long as the account is active, then retention for a 5-year period for evidentiary purposes |
|
To customize your experience We may use your localisation data to provide you with additional information, in particular the localisation of the nearest shops |
Consent | Data kept for the duration strictly necessary for the result to appear |
|
To communicate with you We may also use the information we collect and receive to promote the Service, including using email, push notifications and website alerts. We may also contact you for feedback or to send proactive customer support messages. |
Our legitimate interest | 3 years from last contact |
|
Pre-litigation and litigation management We use your personal data for litigation and pre-litigation management |
Our legitimate interest | In the context of pre-litigation and litigation management, data is deleted as soon as the dispute has been settled out of court or, failing that, as soon as the corresponding legal action has become time-barred (until all ordinary and extraordinary remedies have been exhausted). |
| To manage your rights | Legal obligation | Data relating to the management of requests for rights are kept for the duration necessary to process the request. It is then archived for the duration of the criminal statute of limitations applicable to intermediate archiving, 6 years. |
How Information is Shared
We do not sell your personal information, we do not share your personal information except when needed to run our business and provide the Service, and where required for legal purposes.
Service Providers
We may share your information with third parties who provide services to the Service such as supporting, improving, promoting and securing the Service. These service providers only have access to the information necessary to perform these limited functions on our behalf and are required to protect and secure your information.
Publicly Available Information
Access to the Service is for authorised users only, data is not made publicly available.
Sharing Information and Activities with the other Services users within your organisation
We share your information and activities within the Service with other Service users, this is strictly limited to companies with which you are associated. Sharing information is fundamental to the Service and consists of but not limited to, Planograms, Exports, Profile Information, Access Logs and Data Auditing.
The content you enter, such as photos and survey answers, is shared with your name or email address as its author with the other users of your organisation, according to their access rights: in the IWD platform, in its exports (such as ZIP and PowerPoint files), and in our applications on their own devices.
Subsidiaries and Acquirors of our Business or Assets
We may share your information with our subsidiaries when they are involved in the provision of the Services.
If the Service becomes involved in a business combination, securities offering, bankruptcy, reorganization, dissolution or other similar transaction, we may share or transfer your information in connection with such transaction.
Legal Requirements
We may preserve and share your information with third parties, including law enforcement, public or governmental agencies, or private litigants, within or outside your country of residence, if we determine that such disclosure is allowed by the law or reasonably necessary to comply with the law, including to respond to court orders, warrants, subpoenas, or other legal or regulatory process. We may also retain, preserve or disclose your information if we determine that this is reasonably necessary or appropriate to: (1) prevent any person from death or serious bodily injury; (2) address issues of national security or other issues of public importance; (3) prevent or detect violations of usage or fraud; or (4) protect our operations or our property or other legal rights, including by disclosure to our legal counsel and other consultants and third parties in connection with actual or potential litigation.
Exercising Your Rights
You have the following rights:
- Right of access
You may obtain the confirmation that your personal data are or are not processed by us and, when your data are processed, you may obtain access to such personal data and to a number of information items.
- Rectification right
You may obtain the rectification of those of your personal data that are inaccurate, and you may obtain that any incomplete data concerning you be supplemented.
- Right to erasure (“right to be forgotten”)
Under the conditions and within the limits provided for by applicable regulations, you may obtain the erasure of your personal data.
- Right to restriction of processing
Under the conditions and within the limits provided for by applicable regulations, you may obtain the limitation of the processing of your data.
- Right to data portability
Under the conditions and within the limits provided for by applicable regulations, you may receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller.
- Right to object
When the processing of your personal data is necessary for our legitimate purposes, you may, within the limits provided for by applicable regulations, object at any time to such processing. You may also at any time object to the processing of your personal data for canvassing purposes.
- Right to withdraw your consent
When the processing of your personal data is based on your consent, you may withdraw your consent at any time.
- Right to give instructions on the handling of your data after your death
You may define and communicate to us specific instructions concerning the conservation, erasure and communication of your personal data after your death.
Some of these rights may directly be exercised. In particular:
- You may access, correct, amend or update profile or account information at any time by adjusting that information in your account settings.
- You can choose to stop receiving certain email notifications by indicating your preferences within Execute and the IWD App.
For exercising your other rights, please submit your request at gdpr@iwd.io.
If, after contacting us, you consider that your rights are not complied with, you may send a complaint to the competent national authority.
Deleting your account and data
Your IWD account is the same in all our applications: deleting it deletes it everywhere. To ask us to delete your account and data:
- Email gdpr@iwd.io from the email address of your IWD account, with “Data deletion request” as the subject and the name of your organisation.
- We confirm your request and, since your organisation gives you access to the Service, we inform it. We reply within one month.
We delete your account: we deactivate it, delete your name, phone number, job, company, notes, profile picture and settings, and remove your email address from it.
We keep:
- the content you entered for your organisation, such as photos and survey answers, with your name or email address as its author. It belongs to your organisation, which can delete it in the IWD platform;
- logs, until they expire, within 12 months;
- the record of your request, for 6 years;
- backup copies of our servers, kept to restore the Service after an incident, until they are overwritten, within 6 months.
Network Briefcase
We also delete:
- the copy of your briefcase and of its logs on our synchronisation server;
- the record of your devices: installation identifier, device model and operating system version.
To delete the data stored on your device, uninstall Network Briefcase. Synchronise first if the content you entered must reach your organisation.
How We Protect your Data
We implement technical, physical, and organizational measures and controls to safeguard and protect the transmission and storage of the data we collect. We employ reasonable protections for your information that are appropriate to its sensitivity.
Please be aware that despite our efforts, we cannot guarantee absolute security of your account or information. In addition, you can take steps to protect your account and information such as creating a unique password for the Service that is not easily guessed and that you don’t use anywhere else, not sharing your password with others, and promptly reporting suspicious activity or unauthorized account access.
Cross Border Data Transfers
The Services are operated from the EU and the United States. If you are located outside of these zones and choose to use the Service or provide information to us, you acknowledge and understand that your information will be transferred, processed and stored within these zones, as it is necessary to provide the Service.
Whenever we transfer personal data internationally, we use legal mechanisms to ensure data transfers comply with applicable law. In particular, we use the appropriate legal mechanisms like the European Commission’s Standard Contractual Clauses specially designed for this type of transfer and take all necessary measures and guarantees to secure such transfers according to applicable law.
Privacy Policy Updates
IWD reserves the right to modify this Privacy Policy at any time. Please review it occasionally. If IWD makes changes to this Privacy Policy, the updated Privacy Policy will be posted in a timely manner. If we make changes we deem to be material, we will provide a prominent notice. If you object to any changes to this Privacy Policy, you should stop using the Services and delete your account.
Network Briefcase
Network Briefcase is the mobile application, published by IWD (developer name “IWD team” on Google Play), through which users of the IWD platform collect field data at points of sale, offline, and synchronise it with the platform. This section supplements the rest of this Privacy Policy for Network Briefcase. Where they differ, this section prevails for Network Briefcase.
Application logs
Network Briefcase records how it is used and sends these records to IWD when it synchronises: the screens you open and the actions you take, the searches you run on points of sale, the answers and field values you enter, your email address, errors, diagnostics (free disk space, synchronisation errors), the identifier of the installation, the device model, the operating system version and the user agent. We use them to secure the Service, handle support requests and fix defects, and keep them for up to 12 months. They are not shared with the other users of your organisation.
Location
Network Briefcase does not access your device’s location: “Location Information” and the purpose “To customize your experience” do not apply to it. Versions after 32.0.0 remove the location and the other metadata from photos before sending them, except what is needed to display them correctly. Versions 32.0.0 and earlier send photos with the location the device’s camera may have recorded in them. We keep these photos as they were sent, location included, for as long as your organisation keeps them in the IWD platform.