Privacy Policy
This policy explains how Werisco processes personal data. It complies with Regulation (EU) 2016/679 (GDPR) and applicable French data protection law.
1. Data controller
For data processed on its own behalf (user accounts, billing, prospecting), the data controller is Werisco (contact: contact@werisco.com).
Important distinction. For the ERP data you entrust to us (your product, inventory and supplier data, etc.), Werisco acts as a processor within the meaning of Article 28 GDPR, and you (the customer) are the controller. This relationship is governed by the Data Processing Agreement (DPA).
2. Data we process (as controller)
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account | name, email, hashed password, role, organization | Create and secure access | Performance of the contract (Art. 6.1.b) |
| Login / usage | logs, IP addresses, timestamps | Security, abuse prevention, debugging | Legitimate interest (Art. 6.1.f) |
| Billing | business name, address, subscription history | Billing and accounting obligations | Contract + legal obligation |
| Prospecting | business email, company | B2B commercial contact | Legitimate interest, with opt-out |
Payments are processed by Stripe; we do not store card numbers, which are handled by the payment provider.
3. Recipients and processors
Your data may be processed by sub-processors strictly necessary to the service (hosting, payment, email delivery, error monitoring). The current list is set out in the DPA annex. We do not sell or rent your data.
4. International transfers
By default, data is hosted in the United States (Railway); an EU region can be selected on request. Where data is transferred outside the European Union, such transfers are covered by appropriate safeguards (European Commission Standard Contractual Clauses, Art. 46 GDPR). Our goal is EU-based hosting.
5. Retention
- Account: for the duration of the subscription, then deleted or anonymized within 30 days of termination (unless a legal obligation applies).
- Billing data: 10 years (French accounting obligation).
- Security logs: 6 to 12 months.
- Prospecting: until objection, then 3 years maximum after the last contact.
6. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability. To exercise them: contact@werisco.com. We respond within one month. You may lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).
7. Security
We implement appropriate technical and organizational measures: encryption of ERP credentials at rest, hashed passwords, encryption in transit (HTTPS/TLS), role-based access control, logging and backups. Details are in Annex 3 of the DPA.
8. Cookies
The service uses only strictly necessary storage (a single authentication token kept in the browser) to operate the session. No advertising cookies or third-party trackers are used, and no consent-requiring cookies are set.
9. Changes
This policy may be updated; the date shown in the service prevails. In the event of a material change, users are informed by email or through the service.