Ascrotech BV · Eyzen
How Ascrotech BV handles personal data, and why our software deployment model means we hold far less of it than most software suppliers.
In short. Ascrotech BV builds Eyzen, field-execution software for industrial operations. Eyzen is not delivered as a hosted service: our customers install and run it in their own environment, on their own infrastructure, under their own control. Section 2 explains the model, and what happens in the exception where a customer contracts with us to host on its behalf.
In that standard model the operational data in a running Eyzen system (who did which task, where, and when) sits with the customer, not with us. We have no access to it in the ordinary course, and there is no account to create with us in order to use the software.
The personal data we hold as a controller is limited to the people we deal with directly: visitors to our website, prospective and existing customer contacts, people who raise support requests, job applicants, and supplier and partner contacts. Sections 4 to 6 set that out in full. Section 7 covers the narrow, contractually governed situations in which we touch data inside a customer's own system.
This policy is issued by Ascrotech BV, a company incorporated in Belgium, with registered office at Schuttershof 10, 2070 Zwijndrecht, Belgium and enterprise number 0694.557.315 ("Ascrotech", "we", "us"). Ascrotech is the developer and supplier of the Eyzen software.
It explains what personal data we collect, why we use it, who we share it with, and the rights you have. It applies to:
What this policy does not govern. It does not govern the personal data held inside a customer's own installation of Eyzen. That data is controlled by the customer, and the customer's own privacy notice applies to it. Where we process such data on a customer's behalf, we do so under a written data processing agreement with that customer, not under this policy. Section 7 explains the boundary.
We are the controller for the processing described in sections 4 to 6 and 17. If a different Ascrotech entity or a reseller is your contracting party, the notice they give you applies to their own processing.
Most software privacy policies describe a platform that the supplier hosts and operates. Ours starts elsewhere, because that is not our standard delivery model.
Eyzen is licensed as software that the customer deploys and runs: a containerised backend in the customer's own infrastructure, a control-room application on the customer's Windows workstations, and mobile applications on the customer's Android and iOS devices. The customer chooses where the system runs, who may use it, how it is configured, how it is backed up, and how long records are kept. This is the customer-deployed model, and the rest of this section describes it.
Hosted arrangements. Where a customer instead asks us to host or operate Eyzen on its behalf, we agree that in writing with that customer, and the data processing agreement for that customer sets out our role, where the data is held, which sub-processors are involved and which security measures apply. As at the version date at the top of this policy, we host no customer deployment of Eyzen. If that changes we will say so here, and any customer affected will be told directly.
Licence keys and feature toggles control which modules a customer may activate. These operate on the customer's installation against the licence we have issued; they are not a channel for collecting personal data.
Under the General Data Protection Regulation (GDPR), a controller decides why and how personal data is processed, and a processor processes it on a controller's instructions. Which role we hold depends entirely on the activity.
| Activity | Our role | What governs it |
|---|---|---|
| Our website, marketing, sales, contract administration, billing, account management, recruitment, supplier relationships | Controller | This policy (sections 4 to 6, 17) |
| Support and implementation work in which a customer gives us access to its own environment or data | Processor for that customer (and, where the customer is itself a processor, sub-processor) | The data processing agreement with that customer, not this policy |
| The contact details and role of the individual who raises a support request with us | Controller (we decide to run a support desk and keep its records) | This policy |
| Operational data inside a customer-deployed Eyzen installation, in the ordinary course | Neither. We have no access | The customer's own privacy notice |
| Hosting or operating Eyzen for a customer that has contracted with us for that (section 2) | Processor for that customer | The data processing agreement with that customer, not this policy |
The middle two rows are easy to confuse, so to be plain: we are the controller of the fact that you contacted our support desk and what we recorded about that exchange, and a processor of any customer data you attach to it or expose to us while we diagnose the problem.
We collect only what we need for the relationship in question. We do not buy personal data from data brokers, and we do not build behavioural profiles for advertising.
| Who you are | What we collect |
|---|---|
| Website visitor | Pages viewed, referring page, approximate location derived from IP address, device and browser type, and the date and time of your visit. IP addresses are processed by our hosting provider in server logs for security and availability. Where we use analytics or similar technologies, they run only with your consent, in line with section 9. |
| Enquirer or prospect | Name, business email address, telephone number, employer, job title, the content of your enquiry, and our record of the correspondence, meetings, demonstrations and proposals that follow. |
| Customer contact (the people who work for our customers) |
Name, business contact details, job title and role in the relationship (for example commercial contact, project sponsor, security or data protection contact, escalation contact, or a named person appointed under a contract), plus correspondence, meeting notes, and records of contracts, orders and invoices. |
| Support requester | Your support portal account (name, business email address and organisation), your employer and site, and the content of your ticket: your description of the problem, our correspondence with you, and whatever you choose to attach. Attachments may contain personal data belonging to your employer; section 7 applies to that. Section 8 describes the portal in full. |
| Training or implementation participant | Name, business contact details, role, attendance records, and any acceptance or sign-off you give on your employer's behalf. |
| Event or webinar attendee | Name, business contact details, employer, and your registration and attendance record. |
| Job applicant | See section 17. |
| Supplier or partner contact | Name, business contact details, role, and the records needed to manage the relationship and pay or be paid. |
Special category data. We do not seek out special category data (such as health, biometric or trade-union data) in any of the relationships above, and we ask you not to send it to us unsolicited. If you volunteer it (for example an accessibility requirement for an on-site visit or an event), we use it only for that purpose and delete it once the purpose has passed.
We do not collect personal data from a customer-deployed Eyzen installation. Data reaches us from that direction only when a customer sends or exposes it to us for support or implementation work.
We rely on one of the following lawful bases under Article 6(1) GDPR for each purpose.
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry and providing information about Eyzen | Legitimate interests (responding to a request made to us), or steps at your request before entering a contract |
| Demonstrations, proposals, pricing and contract negotiation | Contract (steps before entering it) and legitimate interests in developing our business |
| Delivering what we have agreed: licensing, implementation, training, support and account management | Contract with your employer, and our legitimate interests in performing it and keeping proper records |
| Running the support desk: logging, triaging, diagnosing and resolving tickets, and quality assurance on how we handled them | Legitimate interests in operating and improving a support function, and in evidencing that we met our service commitments |
| Security of our own systems, fraud prevention, and keeping our website available | Legitimate interests in protecting our business, and legal obligation where security law applies |
| Invoicing, accounting, tax and statutory record-keeping | Legal obligation, and contract |
| Marketing communications and event invitations | Consent where required, otherwise legitimate interests in marketing to business contacts (section 10) |
| Analytics or any other non-essential cookies, if we introduce them (section 9) | Consent |
| Improving Eyzen: understanding how the software behaves in the field, and what customers need next | Legitimate interests. This works from defect reports, feedback and conversations, not from access to customer data (section 7) |
| Recruitment | Legitimate interests in assessing candidates, and steps at your request before an employment contract |
| Establishing, exercising or defending legal claims, and complying with regulatory or court requirements | Legal obligation, and legitimate interests in protecting our position |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms, and we will provide the balancing assessment on request. Where we rely on consent, you may withdraw it at any time; that does not affect processing carried out before the withdrawal.
This section applies to the customer-deployed model described in section 2. Because those customers host Eyzen themselves, we do not process the data in it as a matter of course. There are, however, defined situations in which a customer opens a route for us so that we can do the work it has asked for. In every one of them the customer is the controller (or, where the customer runs a site for its own client, the client is), and we act as processor under a written data processing agreement.
If you use Eyzen at work and want to know what is recorded about you, or want a record corrected or erased, your employer holds that data and answers those requests. Contact your employer's privacy or data protection contact. We cannot act on such a request ourselves: we would have to ask your employer for access to its own system, and we will not do that without its instruction. If you contact us anyway, we will tell you so and, where we can identify the organisation, point you to it.
We run our support channel on Jira Service Management, a cloud service provided by Atlassian. The portal is the one place where you actively hand us information, rather than us observing it, so it is worth setting out separately what happens to what you submit.
Who gets an account. Portal accounts are issued only to the contacts a customer nominates for support, not to everyone who uses Eyzen. That follows how the service is contracted: a customer runs its own first line and logs requests with us through the notified support channel, and we provide the escalated support behind it. It also keeps the data small, since we then hold contact details for a handful of named people at each customer rather than for its whole workforce. It narrows nobody's entitlement: a defect is covered wherever it affects a licensed user of the software, whoever reports it.
We are the controller of the ticket record itself: who reported what, when, and how we handled it. We hold it to run the support desk and to evidence that we met our service commitments (section 6), for the period in section 13. We are a processor for your employer in respect of any personal data inside what you describe or attach, and section 7 governs that.
A defect can almost always be diagnosed without it. Before you attach a file, remove or mask what is not needed to reproduce the problem: operator names and identifiers, photographs of people, and location records. If a full or unmasked export is genuinely necessary, say so in the ticket instead of uploading it, and we will agree a route with your organisation.
Tickets are visible to our support personnel, who are bound by confidentiality and work on a need-to-know basis, and to the people your organisation has authorised to see its own tickets. We do not show a ticket to any other customer.
Jira Service Management is a cloud service. Any processing outside the EEA takes place under Atlassian's data processing addendum incorporating the Standard Contractual Clauses, as described in section 12. Atlassian is named as a sub-processor in the data processing agreement we hold with each customer, and any change of sub-processor is notified in advance under that agreement.
Tickets are retained for the period in section 13. Attachments and diagnostic material containing customer data are deleted once the ticket is resolved and any related quality assurance is complete, under the rules in section 7.
Our website uses only strictly necessary cookies: the ones that make the site work, keep it secure, and remember a choice where you make one. These do not require your consent, because the site cannot function without them.
We set no analytics, preference or marketing cookies. We run no advertising or cross-site tracking technologies, we do not build profiles of visitors, and we do not share visitor data with advertising networks. That is why you are not asked to accept anything when you arrive: there is nothing to accept.
Most browsers let you block or delete cookies in any event; blocking the strictly necessary ones may stop parts of the site working.
If we later introduce analytics or any other non-essential technology, we will ask for your consent first, through a banner that lets you refuse as easily as accept, and we will update this section and publish a new version of this policy before that technology goes live.
The Eyzen software itself. The installed applications do not set advertising or analytics cookies and do not carry third-party trackers. Any session or authentication tokens they use are handled within the customer's own environment.
We may send business contacts occasional information about Eyzen: product news, releases, events and technical briefings. Where the law requires consent, we ask for it first; otherwise we rely on legitimate interests in marketing to people in a professional capacity, and always tell you how to stop.
Every marketing message carries an unsubscribe link, and you can also opt out at any time by writing to us at the address in section 23. Opting out of marketing does not stop service messages: security advisories, release and end-of-support notices, incident notifications, invoices, and messages about a live support ticket. Those go with the contract, and we will keep sending them while it lasts.
We do not sell personal data, and we do not share it for anyone else's marketing. We disclose it only as follows.
| Recipient | Why |
|---|---|
| Service providers acting on our instructions | Website hosting, email and collaboration, the support ticketing system (Jira Service Management, provided by Atlassian, section 8), CRM and marketing tools, accounting and invoicing, and IT and security services. Each is bound by a written contract that limits them to our instructions. |
| Professional advisers | Lawyers, auditors, accountants and insurers, where they need it to advise us. |
| Your employer | Where you act for a customer, prospect, supplier or partner, we may report to that organisation on the dealings we have with you in that capacity. |
| Authorities and courts | Where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims. We assess each request, disclose no more than is required, and tell the affected customer or individual unless we are legally prohibited from doing so. |
| An acquirer | If we reorganise, or sell part of our business, personal data may transfer as part of it, subject to this policy or a notice at least as protective. |
Our current service providers for the activities in which we act as a controller are listed on our sub-processor and service provider page. Where we act as a processor for a customer, that customer's data processing agreement governs sub-processors, including advance notice of any change and the right to object.
We are based in Belgium and we keep personal data in the European Economic Area (EEA) wherever we reasonably can. Some of the tools we use are cloud services whose provider may support or store data outside the EEA.
Where personal data leaves the EEA, we rely on one of the transfer mechanisms permitted by Chapter V GDPR: an adequacy decision of the European Commission, or the Commission's Standard Contractual Clauses together with any additional technical and organisational measures the transfer requires. You may ask us for a copy of the mechanism that applies to a particular transfer, and we will provide it, redacted where it contains commercial terms.
For customer-deployed installations the position is simpler: the software runs where the customer puts it, and we do not move that data anywhere. For any hosted arrangement, the data processing agreement with that customer states where the data is held and which transfer mechanism applies.
We keep personal data only as long as we need it for the purpose we collected it for, and then delete it or irreversibly anonymise it. Our standard periods are below; a longer period applies where the law requires it, or where the data is relevant to a claim that is live or reasonably foreseeable.
| Record | Retention |
|---|---|
| Enquiries that do not lead to a relationship | 24 months from the last contact |
| Prospect and marketing records | Until you opt out or we see no engagement for 24 months, after which we delete or suppress |
| Customer contact and relationship records | For the term of the contract and 7 years after it ends |
| Support tickets and their correspondence | 36 months from closure, for defect history and service-level evidence |
| Support artefacts containing customer data (logs, dumps, diagnostic exports) | Deleted once the ticket is resolved and related quality assurance is complete; never retained as a standing copy |
| Contracts, orders and invoices | Statutory retention, which in Belgium is generally 7 years for accounting records |
| Website server logs | 90 days |
| Analytics data | 14 months, in aggregated form |
| Unsuccessful job applications | 12 months, or longer with your consent if we keep you on file |
We apply technical and organisational measures appropriate to the risk, including:
No measure removes risk entirely. If you believe you have found a vulnerability in Eyzen or in our systems, please report it to security@ascrotech.com; we will acknowledge it and keep you informed while we investigate.
We maintain an incident-response procedure covering detection, containment, assessment, notification and review.
Where we act as a processor and become aware of a personal data breach affecting data we process for a customer, we notify that customer without undue delay and in any event within 72 hours of becoming aware, and give the information the customer needs to meet its own obligations. The customer, as controller, decides on notification to the supervisory authority and to individuals.
Where we act as a controller and a breach is likely to result in a risk to individuals, we notify the Belgian Data Protection Authority within 72 hours, and we tell affected individuals directly where the risk is high.
We do not make decisions about you by automated means that produce legal effects or similarly significant effects, as described in Article 22 GDPR. Decisions about proposals, contracts, support priority and recruitment are made by people.
We use AI-assisted tooling internally, for example to help analyse diagnostic material. Two limits apply, and we hold to them in our customer contracts as well as here:
If you apply to work with us, we collect your CV and covering letter, contact details, work history, education and qualifications, our interview notes and assessment records, your right-to-work status where relevant, and references where you have agreed we may take them. We use it to assess your application, to communicate with you, and to comply with employment and equality law.
We rely on steps taken at your request before a contract, and on our legitimate interests in running a fair recruitment process. We keep unsuccessful applications for the period in section 13, and we ask separately if we would like to keep you on file for longer. If you join us, your data moves into your employment record, covered by a separate employee privacy notice.
Eyzen is software for industrial operations, and our website is aimed at businesses. Neither is directed at children, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.
Our website and documentation may link to third-party sites and services that we do not control, such as a partner's website, a standards body or a hosting provider's documentation. This policy does not apply to them. Read their own privacy notices before giving them personal data.
Where we act as a controller, you have the following rights under the GDPR. Some are conditional, and we will tell you if a condition is not met.
To exercise a right, write to us at the address in section 23. We respond within one month, and may extend by two further months for complex or multiple requests, telling you why. We may ask for enough information to confirm who you are; we ask for no more than that, and we do not charge a fee unless a request is manifestly unfounded or excessive.
If your request concerns data inside a customer's Eyzen installation, please see the note in section 7: the customer holds that data and answers the request.
If you are unhappy with how we have handled your personal data, tell us first at the address in section 23 and we will try to put it right.
You also have the right to lodge a complaint with a supervisory authority, in the EU Member State of your residence, your place of work, or the place of the alleged infringement. Our lead authority is:
We update this policy when our processing, our tooling or the law changes. The version number and date at the top of the page show the current edition, and previous versions are available on request.
Where a change materially affects how we use personal data about you, we tell you directly (for example by email to customer contacts) before it takes effect, and we obtain fresh consent where the law requires it.