Privacy policy
What personal data we process, why, where it is kept and for how long. The short version: very little, and never your D365 data.
Who is responsible
PW Scan IT BV, Pantserstraat 1, 8800 Roeselare, Belgium, enterprise number BE 1003.139.851, RPR Gent, afdeling Kortrijk is the controller for the personal data described here. Questions and requests: privacy@pwscanit.com.
This website
This website sets no cookies, has no analytics or tracking, loads no third-party scripts or fonts, and has no forms. Our hosting provider, Cloudflare, processes the technical data any web request carries (such as IP address and browser type) to deliver the pages and protect them against abuse.
The extensions
Data the extensions read from Dynamics 365 (orders, items, customers, vendors, configuration) is processed only in your browser. We never receive it. Settings are stored in your browser. The extensions send no telemetry.
Because we never receive that data, we are neither controller nor processor for it. Your organisation remains the controller of its D365 data, also when its users view, export or share it with the extensions.
Licences and trials
To start a trial, issue and check licences, we process:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Trial, licence key and sign-in emails; linking a licence to its owner | Contract |
| Licence key (stored only as a hash) | Activating a licence | Contract |
| Install id, optional user hash, D365 environment name, extension version | Enforcing the number of browsers or users in a plan; one trial per environment | Contract and legitimate interest (preventing misuse) |
| IP address | Rate limiting against abuse, kept about an hour | Legitimate interest (security) |
The user hash is a one-way hash of the D365 user id with a random value that never leaves your browser; we cannot work out who it belongs to. The exact list of fields is on our security page.
Payments
Purchases are handled by Link (Stripe) as merchant of record. Link processes your payment and billing details under its own privacy policy. We receive from Stripe your name, email, company name and VAT number if given, and the subscription details, to issue and manage the licence. We never see full card details.
When you email us
When you write to one of our addresses (hello@, support@, privacy@ or licences@), we process your email address, name and what you write, to answer you and follow up. The legal basis is our legitimate interest in answering questions, or the contract when it is about your licence. Please do not send customer data or other D365 data that we do not need; see the support page.
Who helps us
| Provider | For | Where |
|---|---|---|
| Cloudflare | Website and licence server hosting | Global network; EU–US Data Privacy Framework and standard contractual clauses |
| Neon | Licence database | EU (Frankfurt) |
| Resend | Sending licence and sign-in emails | EU (Ireland) |
| Cloudflare Email Routing | Receiving and forwarding email sent to our addresses | Global network; EU–US Data Privacy Framework and standard contractual clauses |
| Google (Gmail) | The mailbox where we read and answer email | EU and US; EU–US Data Privacy Framework |
| Stripe / Link | Payments, as merchant of record (independent controller for payment data) | EU and US; Data Privacy Framework and standard contractual clauses |
How long
- Licence and trial records: as long as the licence or trial exists, and up to 2 years after it ends, so a trial cannot be restarted and support questions can be answered.
- Browser activations not seen for 30 days stop counting; their records are removed with the licence.
- Sign-in codes: 15 minutes. Rate-limit records: about an hour.
- Emails: as long as needed to answer and follow up, and at most 3 years after the last contact, unless the law requires longer or the email is part of a contract or invoice.
- Accounting records are kept by Stripe as merchant of record, for the periods the law requires.
Your rights
You can ask for access to, correction or deletion of your personal data, object to processing based on legitimate interest, and ask for a copy in a portable format. Email privacy@pwscanit.com; we answer within a month. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be).