Privacy policy

EN — This is a translation provided for convenience. The French version of this document is the binding version: in the event of any discrepancy in interpretation, the French text prevails, save where mandatory law in the Client's country of establishment requires otherwise. The French version is available at https://odres.io/politique-de-confidentialite.

Preamble

This privacy policy (the "Policy") describes the manner in which ODRES GROUP SRL ("Odres") collects, uses, retains, discloses and protects personal data in connection with its website, its commercial activities, its contractual relationship with its professional clients and the operation of the Odres.io software solution (the "Solution").

The Solution comprises six applications: ODRES ERP (back office for owners, managers and accountants), OdStaff (employee application: schedules, time recordings, leave, HR documents, warnings, appraisals, training, announcements), OdKiosk (kitchen and hygiene tablet: HACCP, checklists, cleaning, use-by date labels), OdStock (stock tablet: goods receipts, stocktakes), OdClock (time clock) and OdLabels (iOS application for printing use-by date labels). It is accessible at https://app.odres.io. The showcase website https://odres.io is a separate application, deployed separately.

It is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR") and with the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

In accordance with Article 12 GDPR, the Policy is drafted in clear and plain language. Its purpose is nevertheless to be legally complete: the necessary technical detail appears in the detailed sections, preceded by an accessible summary.

Two distinct regimes coexist and must not be confused:

This Policy does not govern processing activities falling within the second category. A person whose data have been entered into the Solution by a Client — for example a restaurant employee whose working hours are encoded, or an end customer enrolled in a loyalty programme — must address their request to the Client concerned, which is the controller. Section 4 sets out this interaction and the manner in which Odres forwards such requests.

For the remainder, the terms "Flat Fee", "Tier", "Tier Criteria", "Active User", "Price Schedule", "Metered Services", "Processed Accounting Document", "Connected POS", "Storage", "AI Credit", "Included Allowance", "Unit Rate Card" and "Overage" have, for the purposes of this Policy, the meaning given to them by article 1.2 bis of the General Subscription Terms (document no. 06).

Reminder on the pricing model. The Subscription is invoiced as a Flat Fee, determined by two Tier Criteria only — the Pack subscribed to and the Optional Modules activated, on the one hand, and the number of Establishments covered, on the other — increased by a variable portion invoiced on usage in respect of five Metered Services: Active Users, AI Credits, Processed Accounting Documents, Connected POS and Storage. The number of Active Users does not constitute a Tier Criterion: it is measured and invoiced per unit above the Included Allowance. The connection of bank accounts does not constitute a Metered Service: it is subject to no counter, the provider's cost being re-invoiced at cost, on production of supporting documents and without mark-up.

1. Identity and contact details of the controller

For any question relating to this Policy or to the exercise of the rights described in section 11, the contact point is contact@odres.io.

Postal address for written requests: ODRES GROUP SRL, for the attention of the privacy contact point, 20 Place Verte, 6000 Charleroi (Belgium).

2. Data protection officer or privacy contact point

2.1 Current situation

The designation of a data protection officer ("DPO") is mandatory in the three cases set out in Article 37.1 GDPR: public authority or body; core activities consisting of regular and systematic monitoring of data subjects on a large scale; core activities consisting of processing on a large scale of special categories of data or of data relating to criminal convictions.

Whether Odres falls within Article 37.1 depends in particular on the volume of client establishments, the number of persons whose data pass through the Solution and the presence of health data in the HR module (reasons for absence, medical certificates). Since a 360° HORECA management software structurally processes employee time-recording data and may collect reasons for absence, the possibility of large-scale processing of special categories of data must be seriously examined as soon as the installed base reaches a significant size.

Position adopted. Following that analysis, Odres has not designated a data protection officer within the meaning of Article 37 GDPR and has put in place a privacy contact point, the analysis having led it to rule out the designation obligation being documented in an internal note in accordance with the accountability principle (Article 5.2 GDPR). That analysis is reviewed periodically and, in any event, upon any significant change in the volume or the nature of the processing activities.

2.2 Contact details

Privacy contact point. Odres has not designated a data protection officer within the meaning of Article 37 GDPR. A privacy contact point can be reached at contact@odres.io, or by post at ODRES GROUP SRL, for the attention of the privacy contact point, 20 Place Verte, 6000 Charleroi (Belgium), for any question or request relating to personal data. Should the conditions of Article 37 GDPR come to be met, a data protection officer will be designated, their contact details will be published in this Policy and communicated to the Data Protection Authority in accordance with Article 37.7 GDPR.

3. Guiding principles

Odres applies the principles of Article 5 GDPR to the processing activities for which it is the controller:

1. Lawfulness, fairness, transparency: each processing activity rests on a legal basis identified in section 5 and is brought to the attention of the data subjects.
2. Purpose limitation: data are not further processed in a manner that is incompatible with the initial purpose.
3. Data minimisation: only data that are adequate, relevant and limited to what is necessary are collected.
4. Accuracy: inaccurate data are rectified or erased without delay.
5. Storage limitation: the periods set out in sections 5 and 10 apply.
6. Integrity and confidentiality: the measures described in section 9 are implemented.
7. Accountability: Odres maintains a record of processing activities in accordance with Article 30 GDPR and is able to demonstrate its compliance.

4. Interaction between the role of controller and the role of processor

4.1 Processing activities covered by this Policy

Odres acts as controller where it alone determines the purposes and means of the processing. This is the case in particular for:

• the management of the website https://odres.io and of the relationship with its visitors;
• commercial prospecting and the handling of demonstration or trial requests;
• the management of the professional contacts of Clients and prospects (contact persons, signatories, technical and accounting referents);
• recruitment and the management of applications;
• the creation and management of User accounts and authentication to the Solution, in so far as this relates to the security of and access control to the Odres platform;
• Odres's invoicing, collection of payment, debt recovery and accounting;
• technical support and the handling of assistance requests;
• technical logs, monitoring, incident detection and the security of the Solution;
• product improvement on the basis of aggregated data and usage measurements;
• direct marketing to professionals;
• the management of legal obligations and the defence of Odres's rights.

4.2 Excluded processing activities — Odres as processor

Odres acts as processor where it hosts and processes, on behalf of a Client, the Client Data entered into the Solution, in particular:

• the data of the Client's employees (identity, contracts, working hours, schedules, time recording, absences and, where applicable, reasons for absence or medical certificates);
• the data of the Client's end customers (loyalty, bookings, named orders, preferences, marketing consents), including data relating to participation in the prize wheel and the online reviews published by those persons on the Client's establishment listing;
• the payment collection data attached to the Client's transactions with its own end customers;
• the data of the Client's suppliers and operational contacts;
• the Client's bank account and transaction data that may be imported by means of the bank account connection feature, including the data of the counterparties to the transactions — suppliers, workers paid, end customers — some of whom are natural persons with no contractual relationship with Odres. This feature is not active: no account information service provider has been designated to date (see section 7.3, line 13). When it is, the connection will be carried out through a third-party provider authorised or registered within the meaning of Directive (EU) 2015/2366 (PSD2), to which the Client will give its consent directly; Odres is neither a payment institution nor an authorised account information service provider, and does not access the Client's bank access credentials;
• the sales data returned by the Client's third-party point-of-sale (till) system, retrieved by API for display in the Solution — turnover, tickets, average basket. Odres is not a till system: the point-of-sale system remains that of the Client, which alone assumes responsibility for its compliance;
• the files, photographs and documents uploaded to the Solution by the Client or its Users (checklists, quality controls, HR documents, accounting records, logos, time-recording selfies, attachments, PDFs), stored with Cloudinary in a European data centre of the provider;
• the data appearing on the accounting documents imported by the Client and submitted to automated character recognition and extraction processing, which concern in particular the Client's suppliers, workers and end customers. The document recognition provider has not yet been identified: no automated processing of this kind is implemented before its entry in Annex 2 to the DPA and prior information of the Client;
• the data submitted to the artificial intelligence features of the Solution — content of the queries, documents and extracts transmitted, outputs produced. These processing activities are carried out by Anthropic Ireland Limited / Anthropic PBC, a sub-processor listed in section 7.3 (line 6), whose application programming interface is hosted in the United States. Only two functions call upon it: the ODRES assistant of the back office and the assistance with replying to online reviews of the Reputation module; no other function of the Solution uses artificial intelligence, and usage is capped in volume per User and overall per month. Client Data may not be used to train, fine-tune or evaluate a model, under the conditions of article 18 quinquies of the DPA. The following are never transmitted to the artificial intelligence: passwords, PIN codes, bank details, time-recording selfies, and any data of an establishment to which the User does not have access.

For these processing activities, the Client is the controller. It determines the purposes, the retention periods, the information of the data subjects and the legal bases. Odres acts only on the documented instructions of the Client, under the conditions of the DPA (document no. 10), which contains all the particulars of Article 28.3 GDPR as well as the annexes relating to processing activities, sub-processors, technical and organisational measures and international transfers.

A distinction not to be missed. The collection of the sums that the Client owes to Odres in respect of its subscription is a processing activity for which Odres is the controller (section 5.5); it is carried out by Stripe Payments Europe, Limited, established in Ireland, and relates to no data of the Client's employees, end customers or suppliers. The payments that the Client collects from its own end customers are, by contrast, Client Data for which Odres is the processor.

4.3 Requests addressed to Odres in error

Where Odres receives a request to exercise rights which manifestly relates to data for which a Client is the controller, it:

1. does not respond to it on the merits and discloses no data directly to the data subject;
2. forwards the request to the Client concerned within five (5) Business Days, unless the Client instructs otherwise;
3. informs the data subject of that forwarding and of the identity of the controller, in so far as such information does not prejudice the rights of third parties or Odres's confidentiality obligations.

4.4 User account: dual characterisation

A User's account gives rise to two overlapping processing activities which must be distinguished:

• Odres is the controller of the processing of the identification and authentication data necessary for the security of the platform, the prevention of unauthorised access, the traceability of logins, the measurement of the number of Active Users and invoicing (login identifier, professional e-mail address, password hash, login logs, second authentication factor where applicable).
• The Client is the controller of the decision to open, modify or close an access, of the level of authorisation granted, as well as of all the business data entered by the User or concerning the User in the modules of the Solution.

5. Table of processing activities for which Odres is the controller

Retention periods run from the triggering event indicated. On expiry of the active period, the data may be kept in intermediate archiving with restricted access for the sole duration of the applicable statutory limitation periods, before definitive deletion or anonymisation.

5.1 Website, visitors and audience measurement

5.1 bis Website assistant (OdBot)

Do not enter sensitive data or data about third parties in the assistant: it is meant for general information about Odres. For a personal request, please use the Website's contact form.

5.2 Prospects, demonstration and trial requests

5.3 Job applicants

Reminder. In the context of recruitment, Odres neither requests nor retains data falling within Article 9 GDPR (health, opinions, beliefs, origin, trade union membership, sexual orientation) nor data relating to criminal convictions, save where the law expressly requires this for a particular position.

5.4 Clients' contacts, contractual relationship and User accounts

Password. Odres never retains passwords in clear text. Only a cryptographic hash derived from an appropriate derivation function is stored; passwords and PIN codes are stored only in hashed form (PBKDF2-SHA256) and are never readable.

5.5 Invoicing, collection of payment, debt recovery and accounting

Capacity of Odres in respect of the measurement data. For the records of Metered Services, Odres acts as controller, solely for the purposes of invoicing the variable portion of the price, justifying it and evidencing it in the event of a challenge, on the basis of Articles 6.1.b and 6.1.c GDPR. These records are made available to the Client on an ongoing basis from its Account. Odres does not use them for any other purpose and, in particular, does not use them either to analyse the Client's economic activity or to profile its Users. The measurement of Active Users rests on a simple monthly activity indicator and involves no analysis of the behaviour, connection time, productivity or content of the User's actions; it cannot form the basis of any individual assessment. The business data appearing in the documents and queries thus counted remain, for their part, Client Data for which Odres is the processor, in accordance with section 4.2.

Means of payment and card data. Payments are made by direct debit (SEPA direct debit) or by payment card, through the payment service provider mandated by Odres, currently Stripe Payments Europe, Limited, established in Ireland. The Parties may also agree on a direct bank domiciliation. Odres does not collect, store or process any complete payment card data: entry takes place directly with the provider, on pages hosted by it, in an environment compliant with the PCI DSS standard; Odres receives only truncated data and transaction references, and never sees or stores a card number or a complete IBAN.

Characterisation of the payment service provider. A payment service provider generally presents itself as an independent controller for the processing activities that it implements under its own obligations — fraud prevention, anti-money laundering, prudential obligations — and as a processor for the collection operations alone carried out on the instructions of the principal. In accordance with the provider's terms, Stripe acts as an independent controller for payment data, under its regulatory obligations, and on the basis of a data processing agreement for the collection operations carried out on behalf of Odres. The characterisation thus adopted is recorded in Annex 2 to the DPA. The collection of payment is located in Ireland, within the European Union; certain functions of the Stripe group are, however, carried out from the United States by Stripe, LLC, and are framed under the conditions of section 8.

Change of provider. Odres may change payment service provider, or revert to a direct bank domiciliation, subject to thirty (30) days' prior information to the Client, in accordance with article 21.5 of the General Subscription Terms. No charge connected with that intermediation is re-invoiced to the Client.

5.6 Technical support and assistance

Warning to be brought to the attention of Users. Attachments sent to support may contain Client Data (extracts from schedules, lists of end customers). Odres invites Users to transmit only the elements strictly necessary for diagnosis and to anonymise extracts where possible. The processing of such attachments then falls under the DPA and not under this Policy.

Support access to a Client's account. Any intervention by Odres's support on a Client's account takes the form of an assistance session limited in time, read-only by default, recorded in the audit log and notified to the Client.

5.7 Technical logs, monitoring and security

Security logs are subject to restricted access and are, as far as possible, protected against modification. They are not used for the purposes of individual monitoring of Users by Odres.

5.8 Product improvement and usage statistics

Odres does not use the business content of Client Data for product improvement purposes without an explicit contractual basis set out in the DPA and, where applicable, an instruction from the Client.

5.9 Direct marketing

Each communication contains a functioning unsubscribe link. The withdrawal of consent or the objection takes effect as soon as possible and at the latest within five (5) Business Days.

Applicable framework: Article XII.13 of the Belgian Code of Economic Law and Royal Decree of 4 April 2003 on the sending of advertising by electronic mail. In Belgium, sending advertising by electronic means to a natural person in principle requires prior, freely given, specific and informed consent, subject to the exception applicable to existing customers for similar products or services. The functional and impersonal contact addresses of a legal person (for example info@ or contact@) benefit from a separate regime.

5.10 Legal obligations, disputes and defence of rights

6. Sources of the data

Odres collects data:

1. Directly from the data subject: website forms, commercial exchanges, account creation, support tickets, job applications, newsletter subscription.
2. From the Client: where a Client provides Odres with the professional contact details of its employees in order to open access to the Solution for them or to designate a contact person. The Client warrants to Odres that it has informed those persons in accordance with Articles 13 and 14 GDPR.
3. Automatically, when the website or the Solution is used: technical logs, cookies and similar technologies (see the Cookie policy), usage measurements.
4. From publicly accessible sources: public registers (CBE, Belgian Official Gazette), professional websites, professional social networks, strictly within the framework of B2B prospecting and subject to the information required by Article 14 GDPR. Whether recourse will be had to third-party prospecting data providers has not been settled; failing such recourse, this statement is without object.
5. From the Client's online review platform: where the Client activates the Reputation module, the reviews published on its Google Business Profile establishment listing are read by the Solution (public name of the author, rating, text). Those data are published by their author themselves on the recipient's platform; Odres processes them on behalf of the Client, which is the controller.

Where data are collected indirectly, Odres provides the information required by Article 14 GDPR within a reasonable period and at the latest one (1) month after obtaining the data, or at the time of the first communication with the data subject if that occurs earlier.

7. Recipients and sub-processors

7.1 Principles

Data are neither sold, nor rented, nor exchanged. They are disclosed only to the recipients necessary for the achievement of the purposes described, within the limits of what is useful to them, and subject to appropriate confidentiality undertakings.

7.2 Categories of recipients

• Authorised personnel of Odres, on a least-privilege and need-to-know basis.
• Processors of Odres, acting on Odres's documented instructions, bound by a contract compliant with Article 28 GDPR.
• Independent providers acting as controllers for their own purposes: accountant, lawyer, auditor, payment service provider, banking institution, insurer, online review platform and video distribution platform.
• Public authorities, solely by virtue of a legal obligation or an enforceable court decision.
• Acquirer or transferee, in the event of a merger, demerger, transfer of business or similar transaction, subject to prior information of the data subjects and the maintenance of an equivalent level of protection.

7.3 Named list of providers

List as at 14 October 2026. It corresponds to Annex 2 to the DPA (document no. 10), whose numbering it reproduces. Providers not listed here have access to no data.

odres.io showcase website. For its own processing activities only (sections 5.1, 5.1 bis, 5.2, 5.3 and 5.9), and without access to any Client Data, the Website relies on: Vercel Inc. — 440 N Barranca Avenue #4133, Covina, CA 91723, United States — for hosting and delivering the Website, its server functions running in Frankfurt (European Union) and its static content being delivered from the point of presence closest to the visitor; Neon (line 2), for the Website's database — register of requests, applications and consents —, in Frankfurt; Mailjet (line 4), for the Website's e-mails and mailing list; Anthropic (line 6), for the Website's assistant.

Fonts, icons and libraries. The typefaces, the icon library and the display libraries used by the pages of the Solution are local copies served by the platform itself, hosted in the European Union. No page loads any resource from a third-party content delivery network, and the visitor's IP address is transmitted to no such network. The only third-party resources loaded are the video players of the Training module (lines 11 and 12), and only when a User starts a video.

Planned integrations, not activated. The following integrations exist in the Solution but are not activated to date: no access key is configured, no call is issued, no data are transmitted. They are announced as of now in order to obtain the Client's general authorisation provided for in article 8 of the DPA: Ibanity / Ponto (Isabel Group, Belgium — bank connection); e-invoice.be (Belgium — Peppol electronic invoicing); Meta WhatsApp Business (Meta Platforms Ireland Ltd., Ireland — messages to suppliers and employees); Twilio (Twilio Inc., United States — sending of SMS); Perplexity (Perplexity AI Inc., United States — alternative artificial intelligence provider). Their activation will give rise to an update of this section and of Annex 2 to the DPA, and to prior information of the Client.

Updating of the list. Any entry, replacement and removal is recorded in this section and in Annex 2 to the DPA. Clients are informed thereof at least thirty (30) days before the provider concerned accesses Client Data, and have a right of reasoned objection under the conditions of article 8.2 of the DPA.

Scope of the list. Lines 1 to 4, 6 to 12 and 13 to 14 concern, in whole or in part, Client Data for which Odres is the processor; the corresponding safeguards are set out in detail in articles 18 quater and 18 quinquies of the DPA. Line 5 concerns processing of Odres's own (section 5.5) and relates to no data of the Client's employees, end customers or suppliers. As at the above date, no other provider is listed, in particular in respect of back-up and archiving, support and ticketing, or monitoring and security. The tools that Odres will use for its own processing activities — customer relationship management, ticketing, audience or usage measurement, applicant management — have not been settled to date: they are identified as such in section 5 and will be named as soon as they are brought into service.

Changes made in version 5.0. Seven providers that are actually active have been listed, which did not appear in the list in version 4.0: Anthropic (artificial intelligence functions), Google LLC — Business Profile (online reviews), Google LLC — Firebase Cloud Messaging, Apple and Mozilla (push notifications), Vimeo and Google LLC — YouTube (videos of the Training module). The slot left open in version 4.0 for the artificial intelligence model provider is accordingly filled (line 6). The slots relating to the bank connection provider and to the document recognition service remain open (lines 13 and 14) and the corresponding features are not available.

Point-of-sale systems. The third-party till system to which the Solution connects by API is chosen and contracted for by the Client; it is not a sub-processor of Odres and does not appear in this list.

8. Transfers of data outside the European Economic Area

8.1 Position as at 14 October 2026

The application, the database and the files — including HR documents and attachments — are hosted in the European Union. Three ancillary functions involve providers established in the United States: the delivery of push notifications, the reading of and replying to online reviews, and the artificial intelligence functions. These transfers are based on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) and, where the provider is certified thereunder, on the EU–US Data Privacy Framework.

odres.io showcase website. The Website's server functions run in Frankfurt (European Union) and its data is kept with Neon, in Frankfurt. Two elements nevertheless relate to the United States: the Website's host, Vercel Inc., has its registered office there (section 8.4), and the messages typed into the Website's assistant are processed by Anthropic (section 8.2).

As at the date of this version, the processing chain is as follows:

• application hosting is provided by Railway, whose processing is located in the European Union — Netherlands (Europe-West region), with a network entry point in Brussels;
• business data are kept in a PostgreSQL database managed by Neon, hosted on AWS infrastructure in the European Union — Germany, Frankfurt (eu-central-1 region);
• files, images and documents, including HR documents, time-recording selfies and attachments, are stored with Cloudinary, in a European data centre of the provider;
• transactional and notification e-mails are delivered by Mailjet, in the European Union;
• the collection of the sums owed by the Client is carried out by Stripe Payments Europe, Limited, established in Ireland, a Member State of the European Union; certain functions of the Stripe group are, however, carried out from the United States;
• the fonts, icons and libraries of the pages are static files served by the platform itself, in the European Union: no third-party resource is loaded and the visitor's IP address is transmitted to no content delivery network.

Transfers actually carried out to the United States. In addition to the three ancillary functions referred to above, two further transfers must be reported: the video players of the Training module (Vimeo and YouTube in cookie-free mode), activated only when a User starts a video, and the functions of the Stripe group carried out from the United States. The data in the database and the files do not leave the European Union.

Two points on the proportionality of these transfers. First, push notifications carry no data from the database: only the notification text and the device token are transmitted, which confines the transfer to what is strictly necessary. Second, online reviews are public data: the public name of the author and the text of their review are published by the author themselves on the recipient's platform.

No bank connection provider has been designated and the corresponding feature is not active. The provider ultimately selected must be authorised by or registered with a competent authority of an EEA Member State.

Data are encrypted in transit (HTTPS/TLS) and at rest.

Odres verifies at least annually, and upon each change to its processing chain, the accuracy of this position as well as the continued existence of the processing agreements and of the listing of the providers concerned in the official register of the EU–US Data Privacy Framework. Any change is recorded in section 7.3 and in Annex 2 to the DPA, and Clients are informed thereof in advance under the conditions of that section.

8.2 Transfers by recipient

The agreements and certifications set out above were recorded from the providers' official pages and are verified, together with the listing in the official register of the EU–US Data Privacy Framework, upon each revision of this Policy.

8.3 Transfer mechanisms applied

The transfers described in section 8.2 are governed by the mechanisms of Chapter V GDPR, actually applied and not merely provided for by way of reference:

1. Standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Article 46.2.c), with the appropriate module according to the capacity of the parties — module 1: controller to controller; module 2: controller to processor; module 3: processor to processor; module 4: processor to controller. This mechanism constitutes the primary basis of each transfer for which it is available.
2. Certification under the EU–US Data Privacy Framework, relied upon as an additional safeguard where the recipient is listed thereunder, and not in substitution for the standard contractual clauses. That order is deliberate: a position based on the standard contractual clauses survives any invalidation of the framework, whereas the converse is not true. Apple and Mozilla are not listed under that framework: for those two recipients, the transfer rests on the standard contractual clauses declared by the provider alone.
3. Adequacy decision of the European Commission (Article 45), where applicable coupled with a certification of the recipient where the adequacy depends on it. Such is the case of Israel, where Cloudinary Ltd. has its registered office, under Decision 2011/61/EU — it being recalled that the processing of the files takes place in a European data centre of the provider.
4. Approved binding corporate rules (Article 47), which Odres does not use to date.
5. Failing that, and exceptionally, one of the derogations of Article 49, of which Odres makes no structural use.

8.4 Registered office of providers outside the European Union

Railway, Neon and Cloudinary have their registered offices outside the European Union, even though the processing that they carry out for Odres takes place within the Union — respectively in the Netherlands, in Germany and in a European data centre of the provider. Railway Corporation and Neon, LLC are established in the United States; Cloudinary Ltd. is established in Israel and is a subsidiary of Cloudinary Inc., established in the United States. Vercel Inc., the Website's host, is also established in the United States; the Website's server functions run in Frankfurt, and Vercel states that it bases its transfers on the standard contractual clauses, while also being certified under the EU–US Data Privacy Framework.

A provider subject to the law of a third country remains subject to the orders of that law, whatever the location of the server. This point is not neutralised by the European location of the processing: it is expressly taken into account in the transfer impact assessment annexed to the DPA (document no. 10), and the processing agreements of Railway and of Neon incorporate, for that reason, the standard contractual clauses for any access from the United States.

8.5 Transfer impact assessment

In accordance with the judgment of the Court of Justice of the European Union of 16 July 2020 (Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, C-311/18) and with Recommendations 01/2020 of the European Data Protection Board, each transfer based on the standard contractual clauses is the subject of a documented transfer impact assessment, annexed to the DPA and covering in particular:

• the precise description of the transfer (data, purposes, recipients, processing chain, actual location, remote access from a third country);
• the transfer mechanism selected and the applicable module of clauses;
• the analysis of the legislation and practices of the country of destination, in particular the access powers of public authorities and the existence of effective remedies;
• the case of the provider whose registered office is located outside the Union while the processing takes place within the Union (section 8.4);
• the identification of supplementary technical measures (encryption with retention of the keys in the EEA, pseudonymisation, fragmentation, end-to-end encryption of notifications), contractual measures (obligation to notify access requests, undertaking to challenge them, transparency policy) and organisational measures;
• the reasoned conclusion as to the essentially equivalent nature of the protection, and the decision to proceed with, suspend or make the transfer subject to measures;
• the review date.

A copy of the safeguards put in place, including the transfer impact assessment, may be obtained upon written request addressed to contact@odres.io, subject to the redaction of elements that are confidential or covered by trade secrets.

9. Data security

9.1 Undertaking

Odres implements appropriate technical and organisational measures in order to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of individuals.

9.2 Measures

The measures actually implemented by Odres are described in Annex 3 to the DPA (document no. 10).

Established measures. The following are already in place: the encryption of communications by HTTPS/TLS, with HSTS and preloading; the encryption of data at rest, provided by the hosting providers of the database and of the files; application hosting with Railway, whose processing is located in the Netherlands (European Union); the keeping of business data in a PostgreSQL database managed by Neon on AWS infrastructure in Frankfurt (Germany, eu-central-1 region); the storage of files with Cloudinary in a European data centre of the provider, in private mode for files containing personal or confidential data, served by a signed link expiring after four (4) hours; the delivery of transactional e-mails by Mailjet in the European Union; the collection of payment by Stripe Payments Europe, Limited in Ireland; two-factor authentication (TOTP), mandatory for the Odres team having access to the back office and available to all Client Users; the temporary blocking after five (5) failed logins within five (5) minutes; the hashing of passwords and PIN codes (PBKDF2-SHA256); the segregation by company and by establishment; the signature verification of incoming webhooks; and the absence of any access by Odres to the Client's bank access credentials. The data in the database and the files do not leave the European Union; the ancillary transfers actually carried out to the United States are described in section 8.

Target standard. The following measures constitute Odres's security standard, set out in detail and with a measure-by-measure status in Annex 3 to the DPA:

• the encryption of communications and the encryption of data at rest;
• the segregation of data between Clients in a multi-tenant environment;
• the management of identities, access and authorisations, with enhanced authentication for administration access;
• the logging of access and of sensitive actions;
• regular back-ups and restoration tests;
• vulnerability management and the application of security patches;
• secure development practices and the separation of environments;
• staff awareness-raising and confidentiality undertakings;
• a documented procedure for the management of incidents and personal data breaches.

Statement of candour. With the exception of the measures expressly described as established above, the measures listed describe the standard targeted by Odres and must be confirmed line by line by the technical team before publication. Odres holds no certification to date: neither ISO/IEC 27001, nor SOC 2 Type II, nor any other. No certification will be announced until it has actually been obtained and a certificate that is in force can be produced.

9.3 Personal data breach

In the event of a personal data breach liable to give rise to a risk to the rights and freedoms of individuals, Odres notifies the Data Protection Authority as soon as possible and, if feasible, within seventy-two (72) hours after having become aware of it, in accordance with Article 33 GDPR. Where the breach is liable to give rise to a high risk, the data subjects are informed thereof in accordance with Article 34.

Where the breach concerns Client Data for which Odres acts as processor, Odres informs the Client thereof without undue delay and at the latest within forty-eight (48) hours, under the conditions of article 13 of the DPA, it being for the Client, as controller, to assess the notification obligation.

10. Retention periods — general rules

1. The periods applicable to each processing activity for which Odres is the controller are set out in the table in section 5.
2. On expiry of the active use period, the data are deleted, anonymised, or placed in intermediate archiving with restricted access where a legal retention obligation or the defence of a right in legal proceedings justifies it.
3. The data appearing in the back-ups are deleted in accordance with the back-up rotation cycle, the duration of which is ninety (90) days; those back-ups are provided by the database provider within the European Union, with point-in-time restoration. A deletion requested in the active database is applied to the back-ups at the end of that cycle, with no subsequent restoration of the deleted data.
4. Anonymous Aggregated Data are not subject to a retention period, the anonymisation being irreversible.
5. The periods may be extended where the law requires it or where retention is necessary for the establishment, exercise or defence of a right in legal proceedings.
6. The periods applicable to Client Data, for which the Client is the controller, are set by it and are set out in the DPA. The following technical purge mechanisms are already in place in the Solution: time-recording selfies, automatically deleted twenty-four (24) hours after being taken; proof photographs (checklists, cleaning, use-by date labels, goods receipts), seven (7) days by default, a period adjustable by the Client; business data (time recordings, schedules, HR, HACCP, stock, invoices) kept for the duration of the contract, then thirty (30) days of read-only access for export after termination, before blocking and deletion, subject to data covered by a legal retention obligation — payroll, invoicing, food traceability — kept for the time required by Belgian law, in anonymised form where possible; conversations with the assistant and evidence of having taken note of the information banner, kept for the duration of the contract then deleted with the account; browser local storage keys erased after twelve (12) months without a visit.

11. Rights of data subjects

11.1 Scope of the rights

Every data subject has, under the conditions and within the limits laid down by the GDPR, the following rights:

11.2 How to exercise the rights

Requests are to be addressed by electronic mail to contact@odres.io, or by post to ODRES GROUP SRL, privacy contact point, 20 Place Verte, 6000 Charleroi (Belgium). The request specifies, as far as possible, the right exercised, the processing concerned and the elements enabling the person to be identified.

Identity verification. Where Odres has reasonable doubts as to the identity of the requester, it may request the additional information necessary (Article 12.6 GDPR). Odres does not systematically require a copy of an identity document; where such a copy is indispensable, it is recommended that unnecessary particulars be redacted (photograph, national register number), and the copy is deleted as soon as the verification has been carried out.

Response time. Odres responds within one (1) month of receipt of the request. That period may be extended by two (2) months having regard to the complexity and the number of requests; the data subject is informed thereof within one month of receipt of the request, together with the reasons for the extension.

No charge. The exercise of rights is free of charge. In the event of manifestly unfounded or excessive requests, in particular because of their repetitive character, Odres may charge a reasonable fee taking account of administrative costs, or refuse to act on the request, stating the reasons for its decision.

Refusal. Any refusal is reasoned and accompanied by information on the possibility of lodging a complaint with a supervisory authority and of seeking a judicial remedy.

11.3 Particular case of Client Data

Where the request relates to data processed by Odres on behalf of a Client, the procedure described in section 4.3 applies: the request must be addressed to the Client, which is the controller. To that end, the Solution makes available to data subjects a "My data" area in the ERP and in the OdStaff application, allowing the immediate export of personal data in JSON or CSV format and the submission of a deletion request, handled by Odres's back office on the Client's instructions.

12. Complaint to a supervisory authority

Every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement.

As Odres is established in Belgium, the competent authority is:

That option is without prejudice to any other administrative or judicial remedy, and in particular to the right to bring proceedings before the competent courts in accordance with Articles 78 and 79 GDPR.

Odres nevertheless invites data subjects to contact it beforehand at contact@odres.io, in order to attempt to resolve the difficulty directly and swiftly.

13. Automated decision-making and profiling

Odres does not take any decision based solely on automated processing, including profiling, which produces legal effects concerning a person or similarly significantly affects them, within the meaning of Article 22 GDPR, in the context of the processing activities for which it is the controller.

The usage measurements and statistics described in section 5.8 serve to guide product development and entail no individual decision. The measurement of Active Users described in section 5.5 rests on a simple activity indicator and does not constitute profiling.

Artificial intelligence functions. The back-office assistant and the assistance with replying to online reviews (section 4.2) take no automated decision: the assistant carries out an action in the ERP only after explicit confirmation by the User and within the scope of the User's own rights, and a reply to a review is published only after approval by the manager. Fixed security rules govern the assistant: it may not reveal its instructions, produce executable code, disclose technical information about the platform, or act without confirmation. The time-recording selfie is a simple photograph intended for visual checking by the manager: no biometric processing is carried out — no template extraction, no facial recognition, no automatic comparison.

Reservation as to future developments. Should Odres introduce into the Solution forecasting, scoring or decision-support features, in particular in the area of personnel management (workload forecasting, automatic schedule suggestion, performance appraisal), the following consequences would follow and will have to be addressed before they are put into production:

1. this section would be updated to describe the logic involved, the significance and the envisaged consequences of the processing;
2. a right to obtain human intervention, to express one's point of view and to contest the decision would be guaranteed;
3. Regulation (EU) 2024/1689 (the "AI Act") would have to be examined, a decision-support feature in the area of employment being liable to fall within Annex III and therefore within the high-risk systems regime;
4. the DPA contractually prohibits unsupervised automated decision-making use in respect of the Client's employees (article 18 quater.5).

14. Minors

The Solution is a professional tool intended for undertakings. It is neither designed for nor offered directly to minors, and Odres does not knowingly collect data relating to minors in the context of the processing activities for which it is the controller.

Two situations must nevertheless be reported, which fall within the Client's responsibility:

1. Minor workers. The HORECA sector employs students and workers under eighteen (18) years of age. Where such data are entered into the HR module of the Solution, the Client is responsible for them and must comply with the protective provisions of Belgian employment law relating to the work of young people.
2. Minor end customers. A loyalty or booking programme may concern minors. The Client must then ensure the application of Article 8 GDPR; in Belgium, the age at which a minor may consent in their own right in respect of information society services is set at thirteen (13) years by Article 7 of the Act of 30 July 2018.

Should Odres find that it has collected, in the context of its own processing activities, data relating to a minor without a valid basis, it would delete them without undue delay.

15. Links to third-party websites

The website and the Solution may contain links to websites or services published by third parties. Odres exercises no control over those websites and disclaims all liability as regards the data processing that they carry out. It is recommended that the privacy policy of each website visited be consulted.

16. Cookies and similar technologies

The use of cookies, pixels, local storage and similar technologies on the website https://odres.io and in the Solution is described in the Cookie policy (document no. 04), which forms an integral part of this Policy.

The Solution places no advertising or audience measurement cookie. The only third-party Trackers liable to be placed are those of the video players of the Training module (Vimeo, YouTube in cookie-free mode), and only when a video is started by the User; they are declared in the Cookie policy and entail a transfer to the United States under the conditions of section 8.

17. Amendments to this policy

This Policy may be amended in order to take account of changes in legislation, case law, the recommendations of the supervisory authorities, or changes in the processing activities implemented by Odres.

The applicable version is the one published on https://odres.io as at the date of consultation. The date of the last update appears at the head of the document.

In the event of a substantial amendment — that is to say one affecting the purposes, the legal bases, the categories of recipients, the transfers outside the EEA or the rights of individuals — Odres informs the data subjects thereof by an appropriate means (banner on the website, notification in the Solution or electronic mail) thirty (30) days before the new version enters into force, save where the amendment results from a legal obligation of immediate application.

A version history is maintained and may be provided upon request.