Privacy Policy

1. Preamble

This policy describes how personal data is collected, used, shared and protected in connection with the public website wurus.app, sign-up, User accounts, subscriptions, support, billing and use of the WURUS platform, a multi-tenant SaaS business-management solution published by FUTURIZE.

It complements the Terms of Service. It is intended for prospects, Customers, Users of Customer Workspaces, as well as third parties whose data is entered into WURUS by a Customer (e.g. end customers, suppliers, employees, recipients of communications).

2. Scope

This policy applies to:

• browsing on the public site wurus.app and its subdomains;
• sign-up and administration of Customer Workspaces (URLs such as {subdomain}.wurus.app);
• use of WURUS Modules (commerce, inventory, POS, purchasing/sales, e-commerce, light CRM, treasury and expenses, HR, accounting, multi-channel marketing, documents, API, etc.);
• communications with support and the commercial relationship.

3. Roles: controller and processor

3.1 FUTURIZE as controller. For platform account, authentication, subscription contract, billing, security, service communications (incidents, changes, satisfaction surveys), supervision and operation of the infrastructure, FUTURIZE acts as controller (subject to local legal qualification).

3.2 Customer as controller, FUTURIZE as processor. For most business data entered into a Customer Workspace (end customers, prospects, suppliers, inventory, sales, purchases, invoices, HR, payroll, marketing campaigns, messages sent, uploaded documents, etc.), the Customer organization is typically the controller with respect to its employees and its own contacts. WURUS provides the tool and acts as processor on the Customer’s instructions, including under GDPR Article 28 where applicable.

3.3 Individuals’ rights. To exercise rights regarding data hosted on behalf of your employer or another Customer, please contact the administrator of the relevant Customer Workspace first. If no satisfactory answer is received, you may write to [email protected]; we will forward to the Customer if necessary.

4. Categories of data

Depending on context, we may process:

• Identity and contact data: first and last name, job title, company, e-mail, phone, language, salutation.
• Account data: credentials, hashed passwords, roles and permissions, preferences, Customer Workspace subdomain, authentication settings (e.g. two-factor), login history.
• Connection and technical data: IP address (including via X-Forwarded-For header behind reverse proxy / CDN), user-agent, timestamps, pages visited, technical session identifiers, strictly necessary cookies.
• Billing data: legal name, address, tax IDs, history of invoices and payments. Full payment card numbers are not stored by WURUS: they are handled by payment providers (e.g. Stripe, PayPal, Mollie, Razorpay, Authorize.net, as enabled), which return us a token or transaction identifier.
• Business data entered by the Customer: customer / prospect / supplier records, products, inventory, orders, quotes, invoices, credit notes, payments, cash movements, expense reports, expenses, uploaded documents (attachments, images, PDFs).
• HR data (if the Module is used): employee records, contracts, leaves, attendance, birthday and milestone reminders, HR documents. The Customer is responsible for the compliance of such processing (local labor law, applicable consents, etc.).
• Multi-channel communication data: recipient lists and segments, phone numbers, e-mail addresses, message templates, send history (e-mail, SMS, WhatsApp), delivery status, unsubscribes.
• Third-party integration data: API keys or authentication tokens configured by the Customer (stored securely), connector settings.
• Support data: ticket content, e-mails, attachments, screenshots, technical diagnostics.
• Application and audit logs: technical and security traces, access logs, Module events (create, update, delete), API calls, to ensure security, traceability and incident resolution.

5. Purposes

We process personal data to:

• provide, secure, supervise and evolve the Service (account creation, multi-tenant isolation, authentication, access control, logging, backups, anomaly detection);
• perform the subscription contract: billing, collection, suspension management, reminders, internal accounting;
• provide technical and functional support;
• send service communications (incidents, maintenance, changes, updates to Terms or this policy);
• comply with applicable legal and regulatory obligations (accounting, tax, evidence, cooperation with competent authorities where legally required);
• improve security and the product (anti-fraud measures, aggregated and anonymized statistics, performance analysis, regression detection);
• perform B2B marketing where a valid legal basis is met (framed legitimate interest or consent depending on channel), with rights of objection and unsubscribe.

For business data entered by a Customer in its Workspace, purposes are defined by that Customer; FUTURIZE does not use such data for its own purposes, except to provide, secure and improve the Service (including aggregated anonymized statistics) and where required by law.

6. Legal bases (indicative)

Depending on the case, processing relies on:

• Performance of the contract (Terms, Plan, master agreement): account creation, provision of the Service, billing, support;
• Legal obligation: accounting and tax retention, response to legal requests, fraud prevention where required;
• Legitimate interest: Service security, abuse prevention, reasonable product improvement, measured B2B marketing, litigation;
• Consent: where required by law (certain non-essential cookies, certain marketing opt-ins, specific communications);
• Vital interests or public interest: only in limited cases provided by law.

For processing performed on behalf of a Customer (FUTURIZE as processor), the legal basis is the Customer’s as controller.

7. Retention periods

As an indication and subject to the records of processing:

• Active User account: duration of the contractual relationship, then limited archiving for legal obligations and evidence;
• Billing and accounting data: duration imposed by applicable law (typically 10 years in Senegal; 6 to 10 years in many EU countries);
• Security logs and technical traces: a reasonable period set internally (usually a few months to one year);
• Backups: rolling rotation according to the backup policy, with purge at the end of rotation;
• Business data entered by the Customer: duration decided by the Customer as controller within the limits of the law; at contract end, limited retention for security, evidence and legal obligations, then deletion or anonymization;
• Prospecting data: until the person exercises a right of objection and, in any event, within a reasonable period compliant with local law.

8. Recipients and sub-processors

Data may be accessible, on a need-to-know basis, to:

• FUTURIZE’s internal teams (development, operations, security, support, administration, billing) bound by confidentiality obligations;
• Users of the relevant Customer Workspace, according to their roles and permissions;
• technical sub-processors, including, indicatively: cloud hosting (e.g. AWS, Hetzner), protection and CDN (e.g. Cloudflare), object storage (S3 / MinIO), managed database (PostgreSQL), cache and queues (Redis), PDF generation (e.g. Gotenberg), transactional and marketing e-mail delivery, SMS delivery, messaging (e.g. WhatsApp Business platform), payment processing (Stripe, PayPal, Mollie, Razorpay, Authorize.net, as configured), monitoring and observability (e.g. Sentry, logs and metrics solutions), anti-spam and anti-fraud;
• competent public authorities, where required by law (valid judicial or administrative requests);
• advisors (lawyers, accountants, auditors) and, where applicable, an acquirer in case of reorganization, merger, sale or audit, under confidentiality obligations.

Sub-processors are selected based on adequate technical and organizational guarantees and are bound by contractual commitments (confidentiality, security, use limitations). FUTURIZE may update its list of sub-processors; where law so requires, reasonable notice is provided.

9. International transfers

Depending on Customers and sub-processors, data transfers outside the data subject’s country may be necessary (e.g. to data centers in Europe or the United States). Where applicable law so requires (in particular GDPR / UK GDPR), FUTURIZE relies on appropriate safeguards: Standard Contractual Clauses, encryption and minimization measures, transfer impact assessments and supplementary measures, or use of providers certified under applicable frameworks. Further information may be provided on request.

10. Security

FUTURIZE implements reasonable technical and organizational measures appropriate to the sensitivity of data, in particular:

• internal and external access control, granular roles and permissions, logging of sensitive actions;
• logical isolation of Customer Workspaces (multi-tenant);
• encryption of communications (HTTPS / TLS) and encryption at rest depending on the configuration of cloud services used;
• passwords stored in salted-hashed form; password complexity policy and protection against brute-force attacks;
• regular backups, monitoring, alerting, recovery plan;
• vulnerability and security incident management, with notifications within legal time frames (e.g. 72 hours to the regulator for GDPR-covered breaches).

However, no system is infallible. Users must choose strong passwords, not share them, enable recommended security features (two-factor authentication where available) and promptly report any anomaly.

11. Cookies and trackers

The public site and the WURUS applications may use:

• strictly necessary cookies (session, CSRF security, language preference, load balancing) which do not require consent;
• analytics cookies and, where applicable, personalization or marketing cookies, subject to consent where required by law.

A consent banner may supplement this policy in production. You can configure your browser to refuse or delete cookies; Service operation may be impaired for necessary cookies. Customers who deploy their own trackers on their workspaces must handle their own compliance (information, consent, opt-out management).

12. Your rights

Subject to applicable law (e.g. GDPR / UK GDPR, Senegal Law No. 2008-12 on the protection of personal data):

• right of access to your data;
• right of rectification of inaccurate or incomplete data;
• right to erasure (“right to be forgotten”) in legally defined cases;
• right to restriction of processing;
• right to data portability where conditions are met;
• right to object, in particular to direct marketing;
• right to withdraw consent at any time when it is the legal basis;
• right to define post-mortem directives where applicable;
• right to lodge a complaint with a competent supervisory authority (e.g. Commission des Données Personnelles — CDP in Senegal, CNIL in France, or the authority in your country of residence).

To exercise your rights, write to [email protected] with subject “Personal data request”, specifying your request and attaching proportionate identity verification. Response time: typically one month, extendable as permitted by law.

Where data is hosted on behalf of a Customer (e.g. your employer), you must address your request to the administrator of that Workspace, who acts as controller.

13. Prospecting and recipients’ consent

When you use marketing and multi-channel communication Modules (e-mail, SMS, WhatsApp), you remain solely responsible for the lawfulness of recipient lists, for collecting and keeping their consent where required by law, for mandatory mentions, and for compliance with operator and platform rules. WURUS provides tools to manage unsubscribes and objections; you must use them and act on them without delay.

14. Children

The Service targets professional use. We do not intend to process children’s data outside legitimate employment contexts managed by the employer-Customer (e.g. apprentices), with all applicable legal safeguards under the Customer’s responsibility.

15. Automated decision-making and profiling

WURUS does not, to date, perform fully automated decisions producing legal or significant effects on data subjects within the meaning of the GDPR. Some features may include decision-support tools (e.g. anti-fraud filters, low-stock alerts, marketing segmentation) which remain subject to human control by the Customer.

16. Data breaches

In case of a data breach under our responsibility presenting a risk to data subjects, we will take reasonable steps to contain the incident, assess its impact, notify the competent authority and, where applicable, data subjects, in accordance with applicable law (e.g. 72 hours under GDPR). Where acting as processor, we inform the Customer controller as soon as possible.

17. Changes to this policy

This policy may be updated to reflect changes in the Service, sub-processors, regulation or practices. The date above is updated accordingly. Material changes will be communicated by appropriate means (e-mail, account notification) where required by law.

18. Contact and relation to the Terms

For any question about this policy or data protection:

• e-mail: [email protected]
• phone: +221 78 110 54 54

The Terms of Service complement this document for the contractual use of WURUS. In case of conflict on a data-protection point, this policy and, where applicable, the Data Processing Agreement, prevail.