What personal data we process, why, how long we keep it and which rights you have.
Some company details in this document are still being completed and are marked as such.
The controller for the processing described in this policy is PPS — Practical Programming Systems ("PPS", "we", "us"), [to be completed: street address], registered with the Kamer van Koophandel (KvK) under number [to be completed: Chamber of Commerce (KvK) number].
For every privacy question or request, contact us at info@ppserp.com. We have not appointed a Data Protection Officer because we are not legally required to; the privacy contact above handles all data-protection matters.
PPS as controller. This policy covers personal data we process for our own purposes: visitors of our website, people who contact us, users of the PPS ERP accounts we provide, billing contacts, and recipients of our emails.
PPS as processor. Our customers use PPS ERP to manage their own business: their customers and leads, suppliers, employees, orders from marketplaces (such as bol.com, Amazon or Shopify) and invoices. For that data the customer is the controller and PPS processes it only on the customer's documented instructions under our Data Processing Agreement. If you are, for example, an employee of a PPS customer or a buyer who ordered from a shop that uses PPS, please contact that company to exercise your rights; we will support them in handling your request.
| Activity | Personal data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Visiting the website | IP address, browser and device data, requested pages, timestamps | Deliver the website securely, prevent abuse | Legitimate interest (Art. 6(1)(f)) — operating a secure website | Short-lived technical logs at our hosting and network providers |
| Cookie choices | Random visitor ID, chosen categories, policy version, shortened IP address, browser type | Remember and prove your cookie choice | Legal obligation (Art. 6(1)(c) with Art. 7(1)) | Choice valid 12 months; proof kept 1095 days |
| Website analytics (Google Analytics 4) | Online identifiers in cookies, pages viewed, approximate location, device data | Understand and improve website use | Consent (Art. 6(1)(a)) — only after you opt in | Cookies up to 13 months; analytics data 2 months |
| Advertising measurement (Google Ads) | Online identifiers in cookies, ad clicks, sign-up conversions (no names or emails) | Measure the effectiveness of our advertising | Consent (Art. 6(1)(a)) — only after you opt in | Cookies up to 90 days |
| Contact requests (form, email, WhatsApp) | Name, email, company, message, and phone number if you use WhatsApp | Answer your question, prepare an offer | Steps prior to a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) | 365 days after the last contact, unless a contract follows |
| Sign-up and email verification | Name, work email, company name, chosen plan, country, language, password (stored only as an Argon2 hash), IP address and browser at the moment of acceptance | Create your workspace, verify your email address | Contract (Art. 6(1)(b)) | Unverified sign-ups 3 days; unverified accounts 30 days |
| "Continue with Google" | Name, email address, Google account identifier, email-verified flag | Sign in without a separate password, at your request | Contract (Art. 6(1)(b)) | For the life of the account |
| Using your PPS account | Name, email, phone (optional), role and permissions, language, time zone, last login time and IP address | Provide the service, access control | Contract (Art. 6(1)(b)) | For the life of the account, then as described in section 6 |
| Security and fraud prevention | Login attempts, IP address, browser data, lockouts, bot-protection (Cloudflare Turnstile) results, audit trail of critical actions | Protect accounts and data, detect incidents | Legitimate interest (Art. 6(1)(f)) and security obligation (Art. 32) | Audit trail 730 days |
| Billing and invoices | Company name, billing contact, billing address, VAT number, plan, invoices, payment status; card details are entered directly at our payment provider and never reach our servers | Invoicing, payment collection, bookkeeping | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) — tax law | Invoices 2555 days (fiscal retention), then pseudonymised |
| Service emails | Email address, name, email content and delivery status | Account, security, billing and trial messages | Contract (Art. 6(1)(b)) | Delivery records 90 days |
| Marketing emails | Name, email address, consent record | Product news and offers | Consent (Art. 6(1)(a)) — withdraw at any time via the link in every email or your settings | Until you withdraw consent |
| Support and support access | Your messages; for support sign-ins: staff member, stated reason, time, IP address | Help you; resolve issues in your workspace | Contract (Art. 6(1)(b)) | Support-access records 730 days |
| Privacy requests | Name, email, request details, correspondence | Handle and document your rights requests | Legal obligation (Art. 6(1)(c)) | 1095 days after completion |
Providing the data marked as necessary during sign-up is required to conclude the contract; without it we cannot provide an account. Everything else is optional.
Our support staff can only sign in to a customer workspace when the customer has enabled support access in its settings. Every support session requires a written reason, is limited to 15 minutes, is shown to users in a visible banner and is recorded in the customer's audit trail, where administrators can review it.
We do not sell personal data. We share it only with service providers that process it on our behalf under a data processing agreement, and with authorities where the law requires it. Our current providers — hosting, network and security, payments, email delivery, Google sign-in, analytics and advertising — are listed with their location and transfer safeguards on our sub-processor page.
Integrations you connect. When a customer connects a marketplace or shop (bol.com, Amazon, Shopify) or another integration, data is exchanged with that platform on the customer's instruction. Those platforms are independent parties that process data under their own terms and privacy policies; they are not our sub-processors.
We keep personal data only as long as necessary for the purposes in section 3. Retention is enforced automatically by a scheduled deletion job. When a customer ends its subscription, the workspace becomes read-only so data can still be exported; after 30 days it is archived, and after a further 60 days the workspace data is permanently erased. Records we must keep by law, such as invoices, are pseudonymised rather than deleted and are removed once the statutory period has passed. Backups are overwritten on a rolling schedule.
Our platform is hosted in the European Union (EU/EEA). Some providers are established in, or may access data from, the United States. Where that is the case, transfers are based on the EU–U.S. Data Privacy Framework for certified providers and/or the European Commission's Standard Contractual Clauses, supplemented by additional measures where needed. The safeguard per provider is listed on the sub-processor page.
We protect personal data with technical and organisational measures that match the risk, described on our security page. They include encryption in transit, strict separation of each customer's data, role-based access control, login protection, encryption of integration secrets, audit logging and automatic removal of personal data from technical logs.
You have the right to:
Signed-in users can download their data and submit requests directly under Settings → Privacy. You can also email info@ppserp.com. We respond within one month; if we need to verify your identity we will ask only for what is necessary. Requests are free of charge unless they are manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority — in the Netherlands the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl), or the authority in the EU country where you live or work.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Our services are intended for businesses and are not directed at children under 16. We do not knowingly process their personal data.
Where the Turkish Personal Data Protection Law No. 6698 (KVKK) applies, PPS — Practical Programming Systems is the data controller (veri sorumlusu). We process personal data for the purposes and on the legal grounds described in section 3, which correspond to Article 5 KVKK (performance of a contract, legal obligations, legitimate interests and explicit consent). Personal data is transferred abroad — to the European Union (EU/EEA) and the providers on our sub-processor page — on the basis of Article 9 KVKK, including standard contracts or your explicit consent where required. Under Article 11 KVKK you may ask whether your data is processed, request information, learn the purpose, know the recipients in Türkiye or abroad, request correction or deletion, object to results arising exclusively from automated analysis, and claim compensation for unlawful processing. Send your request to info@ppserp.com; we respond within 30 days.
We update this policy when our processing changes. The version number and effective date appear at the top of this page, and previous versions remain available. We inform account holders of material changes by email or in the application before they take effect.
Questions about this policy?
Contact us at info@ppserp.com.