Privacy policy

This policy explains what personal data Iwana collects, why, on what legal bases, with whom it is shared, how long it is retained and how to exercise your rights. It applies to the professionals who use Iwana as well as to the end clients whose data is entered into the service.

Data controller

The data controller is [À COMPLÉTER: legal name], 28 rue d'Estienne d'Orves, 92120 Montrouge, France. For any question relating to your data: [email protected].

When a professional enters the data of their own clients into Iwana, that professional is the data controller and Iwana acts as a processor within the meaning of Article 28 of the GDPR.

Data protection officer (DPO): [À COMPLÉTER: contact details, where applicable].

Data we collect

Depending on how you use the service, we process the following categories:

• Account data: name, email address, telephone number, profile photo, date of birth, language and time zone.
• Authentication data: password (stored in encrypted/hashed form) and, if enabled, two-factor authentication.
• Professional data entered into the service: clients, sites, equipment, appointments, interventions, quotes, invoices, messages, notes.
• Location data: approximate travel position (professional application), only during active use and with your authorisation.
• Photos and documents that you upload (job-site photos, avatars, attachments).
• Technical data: connection logs, device identifiers, diagnostic and audience-measurement data (see the Cookie policy: /cookies).

Purposes and legal bases

• Provision of the service, account and subscription management — performance of the contract (Article 6(1)(b) GDPR).
• Billing, accounting and tax obligations — legal obligation (Article 6(1)(c)).
• Account security, fraud prevention, service improvement and diagnostics — legitimate interest (Article 6(1)(f)).
• Non-essential cookies, audience measurement and marketing communications — consent (Article 6(1)(a)), revocable at any time.

Recipients and processors

Your data is never sold. It is shared only with processors acting on our instructions, in particular:

• Hosting and database: [À COMPLÉTER: hosting provider name], within the European Union.
• Technical monitoring and error reporting: Sentry.
• Mapping and geocoding: Google Maps.
• Address suggestions: what you type is passed through our API to Google (geocoding) and, as a fallback, the Base Adresse Nationale (api-adresse.data.gouv.fr, a French public service); nothing is logged or retained.
• Sending transactional emails and SMS: Brevo.
• Payment provider: [À COMPLÉTER: provider name].

When a processor handles data outside the European Union, that transfer is governed by appropriate safeguards (the European Commission's standard contractual clauses).

Retention period

Account data is retained for the duration of the contractual relationship. Accounting documents (invoices, quotes) are retained for up to ten (10) years in accordance with the French Commercial Code, then deleted or anonymised. Diagnostic data is retained for a limited period.

Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set out directives concerning the fate of your data after your death.

From your account, you can export all of your data (portability, Article 20) and request the deletion of your account and your data (erasure, Article 17). You can also write to us at [email protected].

You have the right to lodge a complaint with the CNIL: https://www.cnil.fr.

Security

We implement appropriate technical and organisational measures: encryption of communications (HTTPS), password hashing, optional two-factor authentication, access control and logging.