Privacy Policy

Scope. This policy applies to all Innoway Solutions websites and services: the VIA ERP website and application, and the Odoo Apps catalogue published by Innoway Solutions. It is also the policy referenced by the cookie consent banner shown on each of those sites.

1. Data Collection

Innoway Solutions collects personal data you provide during registration, use of our services, or when contacting us: name, email, phone, company name, and usage data.

2. Use of Data

Your data is used to:

• Deliver and improve our VIA ERP services
• Send you transactional communications about your account (trial status, expiry or renewal reminders, invoices, security alerts) — these are necessary to provide the service and are not subject to separate marketing consent
• Send you marketing or win-back communications (for example after a cancellation), only with your consent where required, with the ability to unsubscribe at any time
• Ensure platform security

3. Hosting & Security

Your data is hosted on DigitalOcean's secure cloud servers (Frankfurt, Germany). We use SSL/TLS encryption, each user can turn on two-factor authentication, and we back up every day.

4. Data Sharing

We do not sell or share your personal data with third parties, except as required by law, with your explicit consent, or when you yourself enable a third-party integration (sections 8 and 10) — in which case only the data that integration needs is exchanged with the provider concerned. Our technical service providers (including the hosting described in section 3 and e-mail delivery) process data on our behalf, solely to provide that service.

5. Data Retention

Your data is retained for the duration of your subscription. After cancellation or after your free trial expires, your account remains available in read-only mode for 90 days so that you can export your data; access to customer data is then disabled. Data is retained only for applicable operational, legal, security and backup purposes, and is deleted or anonymised according to our retention schedules. Billing data is retained in accordance with Tunisian legal obligations. Verified deletion requests are processed separately, without waiting for these schedules (section 11).

Lead-acquisition data (website forms, Facebook and Instagram Lead Ads, WhatsApp Business — section 10) is also subject to shorter, category-specific periods while the subscription is active:

• the raw technical payload received from the provider: deleted after 30 days;
• form answers, the per-submission field-mapping results and the text of WhatsApp messages (including imported history and messages sent from the WhatsApp Business app), captions, file names and reactions: deleted after 24 months; the inbox record is then anonymised — only attribution data remains (channel, campaign, form, date and status), with no name, email address, phone number, answer or message;
• WhatsApp conversations with no message for 24 months: anonymised (name, number and message preview removed);
• files received and sent on WhatsApp (images, documents, audio, video): deleted after 12 months; the message stays as an entry without content (direction, status, time);
• the WhatsApp Business app address book: kept while the number is connected; a contact removed in the app is deleted; all entries are deleted when the business disconnects the number in VIA ERP, when the business or Meta removes the connection, or when the account's post-cancellation period ends.

The configuration a business sets up (for example how a Facebook form's questions map to CRM fields) is kept while it is in use, until it is changed, disconnected or deleted. Leads and contacts created in the CRM are the customer business's data and follow the subscription retention above. When an account's post-cancellation period ends, its lead-acquisition data is deleted without waiting for these periods, and a verified deletion request (section 11) is carried out immediately.

6. Your Rights

In accordance with Tunisian law and GDPR, you have the right to access, rectify, delete, and port your data. Contact us at info@innoway-solutions.com.

7. Cookies

We use essential cookies for platform operation and analytics cookies (with your consent) to improve our services.

8. Email and Calendar Integrations (Google & Microsoft)

These integrations are optional. They are only active once you connect your own Google or Microsoft account from VIA ERP, and some are only available when they are included in your company's plan and enabled by your company. For Google, each permission is requested separately: sending when you connect your account, and calendar access only when you turn on calendar synchronisation. Connecting an Outlook account requests, in a single consent, all the mailbox permissions listed in section 8.2 — including reading your messages — even if your company does not use mailbox synchronisation; Outlook calendar access is requested separately, only when you turn on calendar synchronisation. The Google or Microsoft consent screen shows you exactly what is being requested.

8.1 Gmail (Google) — sending only

• Permissions requested: send email on your behalf (gmail.send), plus your email address and Google profile name (userinfo.email, userinfo.profile) to identify the connected account.
• No access to your Gmail mailbox: VIA ERP requests no Gmail read permission. It does not read, sync, or store the contents of your Gmail inbox.
• Emails sent from VIA ERP: when you send an email from VIA ERP, its recipients, subject and content are recorded in VIA ERP and linked to the relevant CRM record, so that your company keeps a history of it.

8.2 Outlook / Microsoft 365 — sending and optional mailbox synchronisation

• Delegated permissions requested (Microsoft Graph): User.Read (your profile), Mail.Send (send on your behalf), Mail.Read (read messages for mailbox synchronisation) and offline_access (keep the connection without asking you to sign in again).
• Sending: as with Gmail, emails sent from VIA ERP are recorded (recipients, subject, content) and linked to the relevant CRM record.
• Mailbox synchronisation (optional, when enabled for your company): VIA ERP retrieves messages from your Outlook mailbox — the inbox by default, or the folders and keywords set by an administrator of your company — and stores them in VIA ERP: sender and recipients, subject, content, dates, thread information and attachments (attached files are downloaded and stored in VIA ERP). Messages are linked to existing contacts and leads whose address matches. An unknown sender only becomes a lead if the mailbox owner has turned that option on (it is off by default).
• Who can see these messages: messages synchronised from your personal mailbox are private by default and visible only to you in VIA ERP; administrators have no automatic access to them. Messages from a shared mailbox that your company has connected, and emails sent from VIA ERP, are visible to authorised users of your company according to their rights on the relevant record.

8.3 Calendar synchronisation (Google Calendar and Outlook calendar) — optional, one-way

• How it works: when this feature is available for your company and you turn it on for your connected account, VIA ERP copies your own VIA activities (appointments, visits and scheduled tasks assigned to you) into a dedicated calendar named “VIA CRM” that VIA ERP creates in your account. Events are marked private and have no attendees: no invitation is ever sent.
• Google Calendar: the calendar.app.created permission only, which lets VIA ERP create its secondary calendar and manage the events of that calendar alone. VIA ERP cannot read or change your other calendars or events.
• Outlook calendar: the delegated Calendars.ReadWrite permission. VIA ERP uses it only to find or create its “VIA CRM” calendar and to create, update and delete the events that correspond to your activities in it; it does not read the events of your other calendars.
• Event content: the activity's title and type, its date and time, and a link to the activity in VIA ERP. The activity's internal notes are not copied.
• One-way: VIA ERP does not read changes made in your calendar; it replaces the event with the state of the activity in VIA ERP. An activity that is cancelled, deleted or reassigned to someone else is removed from your calendar.

8.4 Background processing

Once an integration is turned on, some operations run without action on your part: scheduled synchronisation of Outlook mailboxes (on the schedule set by your company), updating your “VIA CRM” calendar after each change to your activities, and renewing access tokens. This processing uses only the permissions described above and stops as soon as you turn the feature off or disconnect the account.

8.5 Security, isolation and authorisation

• The OAuth tokens issued by Google and Microsoft are stored encrypted and are never exposed in your browser.
• Data is isolated per customer company and subject to the access rights defined in VIA ERP. Every feature is checked on the server: a feature that is not included in, or is switched off for, your company does not run.
• We do not sell this data, do not use it for advertising and do not share it with third parties, other than the technical service providers described in section 4, which process it on our behalf.

8.6 Consent, disconnection and revocation

• You can turn off calendar synchronisation or disconnect an account at any time from the email integration settings in VIA ERP. Disconnecting deletes the stored access tokens and stops all synchronisation; for a Google account, VIA ERP also revokes the access with Google.
• You can also remove the access directly with the provider: Google (Google Account → Security → Third-party apps & services) or Microsoft (myapps.microsoft.com, or your organisation's administrator in Microsoft Entra).
• Turning calendar synchronisation off stops all writing to your calendar; events already created remain in the “VIA CRM” calendar, which you can delete at any time from Google Calendar or Outlook.

8.7 Retention and deletion

Disconnecting an account stops all future synchronisation and deletes the access tokens held by VIA ERP. It does not automatically delete data already recorded: emails sent from VIA ERP and Outlook messages already synchronised, with their attachments, remain in VIA ERP as your company's data and follow the retention periods and deletion arrangements described in section 5. You can exercise your rights of access, rectification and erasure at any time (section 6) and request the deletion of your data (section 11); where these messages are part of a customer company's data, we handle your request together with that company.

The technical data of calendar synchronisation (the identifier of the “VIA CRM” calendar and the link between activities and events) is deleted when a Google account is disconnected; for a Microsoft account it is kept with the disconnected account and follows section 5. Events already in your calendar are not removed from it (section 8.6).

8.8 Google data: User Data Policy and Limited Use

VIA ERP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data received from Google:

• is used only to provide the features you have turned on (sending email, the “VIA CRM” calendar);
• is transferred to third parties only as necessary to provide those features, to comply with applicable law, for security purposes (such as investigating abuse) or, with your explicit prior consent, as part of a merger, acquisition or sale of assets;
• is not sold, not transferred to advertising platforms or data brokers, and not used for advertising, to determine creditworthiness or for lending purposes, or to develop, improve or train artificial-intelligence or machine-learning models;
• is not read by any person unless you have given explicit consent for specific items, for security purposes, to comply with applicable law, or when it has been aggregated and anonymised for internal operations.

Access to Microsoft data through Microsoft Graph is governed by your consent and limited to the delegated permissions described above.

9. Data collected through our advertising campaigns

When you complete an Innoway Solutions advertising form on Facebook or Instagram, we may collect your name, company, email address, phone number, and answers to our questions.

We use this information to respond to your enquiry, contact you and arrange a VIA ERP demonstration, as well as to follow up on our commercial discussions.

This information may be processed using our sales-management tools and technical service providers, in accordance with this policy.

You may request access to, correction of, or deletion of your data by writing to info@innoway-solutions.com.

Prospect data is retained for a period appropriate to its purpose.

For this data, Innoway Solutions is the data controller. This section covers only the advertising forms Innoway Solutions publishes to present VIA ERP; it does not cover the Meta integrations that VIA ERP customer businesses enable in their own workspace (section 10).

10. Meta Integrations (Facebook, Instagram and WhatsApp)

VIA ERP offers optional integrations with the platforms of Meta Platforms, Inc., operated through Innoway Solutions' Meta app "VIA ERP Connect": Facebook Lead Ads (lead-form ads on Facebook and Instagram) and WhatsApp Business. These integrations are active only when an administrator of a VIA ERP customer business connects that business's own accounts through Facebook Login for Business (including WhatsApp Embedded Signup).

Data we receive from Meta:

• Connecting account and assets: the ID and name of the Facebook user who makes the connection, the list of Facebook Pages and business accounts they administer and choose to connect, and the access tokens Meta issues for those assets.
• Forms and leads (Lead Ads): the list of lead forms of the connected Pages and their questions; for each lead, the answers entered in the form (for example name, email, phone, company, city, custom answers), the submission time, the consent disclaimers accepted, and the IDs of the originating campaign, ad set, ad and form, together with their names where available and authorized.
• WhatsApp Business — connection: the connected business WhatsApp number, its WhatsApp Business account, whether the number is also used in the WhatsApp Business app, and the state of its synchronisation; message-template statuses.
• WhatsApp messages: the messages the number receives and sends after it is connected, including the messages the business sends from the WhatsApp Business app on its phone (shown in VIA ERP so that the conversation is complete; they are never sent again). This includes text, captions, media, files and reactions, together with delivery and read statuses, timestamps, message identifiers, and edits and deletions for everyone.
• People who write to the business: their phone number, their WhatsApp profile name and the identifier WhatsApp assigns to them for that business.
• Optional message history: only if an administrator of the business chooses it when connecting (the option is off by default) and the business also approves it in the WhatsApp Business app on its phone, VIA ERP receives once the conversations of the last 180 days before the connection.
• WhatsApp Business app address book: the names and phone numbers of the contacts saved in the business's WhatsApp Business app, with later changes.

Supported fields may keep synchronising from Meta for as long as the number stays connected.

Use: this data is used solely to provide the customer business with the features it has enabled: creating or updating its leads and contacts in its VIA ERP CRM, attributing each lead to the campaign that generated it, assigning it to a salesperson, and displaying and replying to WhatsApp conversations from VIA ERP. We do not sell or rent this data, do not use it for advertising, profiling or model training, and do not share it with other customers or with data brokers.

WhatsApp specifics:

• WhatsApp data is used for conversation management, customer support and CRM context (linking a conversation to an existing lead or contact).
• Imported history is read-only context for the business's staff. It creates no inbox item, assignment, notification or CRM automation.
• The address book is used only to show the right name on WhatsApp conversations. It never creates or updates CRM contacts or leads, and is not used for acquisition, marketing, routing or notifications.
• Reactions are stored on the message they react to. They never trigger a notification or an automation, and they are not analysed or used for marketing.
• Files the business sends to a customer through VIA ERP are stored in VIA ERP and transmitted as a file to Meta, which keeps an uploaded file for up to 30 days under its own rules, and which delivers it to the recipient. No public link to the file is created.
• When the sender edits a message, or deletes it for everyone, VIA ERP applies the change to its copy: an edit replaces the text; a deletion removes the text and any attached file. If VIA ERP created a lead from that message, the change is also applied to that lead and to an opportunity converted from it, only as long as their text is still exactly the text VIA ERP wrote. Once a person of the business has modified it, the record is left unchanged.

Roles: for lead and WhatsApp contact data, the VIA ERP customer business is the data controller; Innoway Solutions acts as a processor, only on its instructions. If you filled in an ad form or messaged a business on WhatsApp, that business is your first point of contact for exercising your rights — you may also write to us directly. Ad forms published by Innoway Solutions itself to present VIA ERP are covered by section 9.

Security and retention: Meta access tokens are stored encrypted and are never exposed in the browser; data is hosted in the European Union (section 3) and isolated per customer business. When a business disconnects the integration, the access tokens are deleted and VIA ERP immediately stops collecting; the WhatsApp Business app address book received for that number is deleted; leads and conversations already imported remain in that business's CRM and follow the retention periods in section 5, unless deleted earlier by the business or at your request.

Revocation and deletion: you can remove access at any time from VIA ERP (disconnect the integration) or from Facebook (Settings & privacy → Settings → Business integrations → remove "VIA ERP Connect"). To request deletion of your data, follow our data deletion instructions.

Our use of data received from Meta complies with the Meta Platform Terms and Developer Policies, and with the WhatsApp Business Policy.

11. Data Deletion

You may request deletion of your personal data at any time, including data received through Facebook, Instagram or WhatsApp. The procedure is described on our Data Deletion Instructions page.

12. Contact

For any questions regarding this policy, please contact: info@innoway-solutions.com