01Scope of this page
This page covers the iotill information website, its form and the handling of related requests. Retailers’ customer data used in the POS solution is a separate processing activity.
IOTILL publishes the website. ORION, a French SARL registered with the Grenoble Trade and Companies Register under number 810 146 761, with its registered office at 68 bis rue Abbé Grégoire, 38000 Grenoble, is the controller for commercial requests submitted through the website. It trades as Vendoris and B2BPOS. Its team receives requests in Intercom, prepares responses and follows up on projects.
02Form data
The form requests the business activity, contact name, email address, phone number, business name, and project town and postcode. Submission is refused without these fields.
The form language is sent with your request to help our team handle it.
Turnover may be left unspecified. The form also allows visitors to specify the solution sought, preferred callback time, number of locations and a free-text message.
The transmitted context includes the request type, source page, button used, referring domain when available, and campaign parameters present in the link: utm_source, utm_medium and utm_campaign. The server assigns a reference to the submission.
03Use of information
The information is used to understand the project, prepare a response and contact the person about their request. The form does not subscribe contacts to a newsletter.
A technical log limits repeated submissions, prevents duplicates and tracks transmission results. It contains request identifiers, technical hashes, dates, status and, when available, Intercom contact and conversation identifiers. The full form content and plain-text IP address are not stored in this log.
04Purposes and legal bases
ORION processes requests on the following bases. Preparing a quote or contract requested by an individual on their own behalf constitutes pre-contractual measures. Where a contact acts on behalf of a business, handling the professional request relies on the legitimate interest in responding to that business and following up the project.
Preventing abuse and duplicates relies on the legitimate interest in protecting the form. Retaining records required by law is based on a legal obligation; archives needed to defend legal rights rely on legitimate interest. The form does not subscribe the contact to a newsletter.
05Recipients and service providers
Website requests are intended for ORION’s Vendoris team and sent to Intercom to manage contacts and communications. Data needed for iotill assistance is also processed through central support.
Support uses Intercom and Fin, its artificial intelligence agent. Depending on how the request is handled, messages and relevant information may be analysed by this agent to prepare a response. This automated assistance is not a commitment to an immediate human response.
The cloud solution uses Firebase/Google hosting in Germany. Intercom publishes its subprocessor list on its website.
06Retention policy
The following periods form ORION’s retention policy for the purposes described on this page. They do not apply indiscriminately to all data.
Prospects and sales follow-up: no more than three years after collection or the last contact initiated by the prospect, unless they object earlier. This is a CNIL-recommended benchmark for direct marketing, not a uniform legal retention period for all messages. A follow-up sent by the business does not, by itself, extend this period.
Customers and support: relevant data is retained while handling the request or during the contractual relationship. Afterwards, only information needed as evidence or to defend rights should remain in a restricted-access archive. The v4 service terms template provides for up to five years after the relationship; this benchmark must be adapted to the applicable limitation period. Article 2224 starts that period when the facts enabling an action become known, not automatically when a support ticket closes.
Invoices and accounting records: ten years from the end of the relevant financial year. This obligation concerns accounting documents and does not justify keeping all Intercom conversations for ten years.
Objections to direct marketing: retain only the information needed to honour the refusal, for at least three years according to CNIL guidance. This information is no longer used to market to the person.
Form technical log: references, hashes, statuses and dates are cleaned using the mechanism described below. This log does not determine how long Intercom conversations are retained.
For each new valid request, the code deletes up to 100 log records older than seven days. Cleanup depends on new submissions: it does not guarantee deletion on day seven and deletes nothing in Intercom.
07Locations and transfers
The iotill.com website is hosted by OVH in France. iotill Cloud solution data is hosted in Firebase in Germany. The Intercom account used for requests and support is currently hosted in the United States. Messages and contact details sent to Intercom are therefore processed outside the European Economic Area.
Intercom publishes a data processing agreement describing its transfer mechanisms, including standard contractual clauses where applicable. That agreement and its public subprocessor list are available on Intercom’s website. For details of how your data is processed and the applicable safeguards, contact dpo@iotill.com.
08Your rights
Subject to GDPR conditions, you have rights of access, rectification, erasure and restriction. The right to object applies in particular to processing based on legitimate interests; portability applies in the cases specified in Article 20. Where consent is the processing basis, it may be withdrawn.
The GDPR response period is one month, with a possible two-month extension for complex or numerous requests, provided the person is informed within the first month. You may lodge a complaint with the CNIL.
To exercise your rights or ask about your data, email dpo@iotill.com. This monitored address is the data protection contact point. For technical assistance, central support remains available at support@iotill.com.
09Data processed by retailers
Under the supplied contracts, retailers are responsible for their own customers’ personal data processed in the solution. The distributor acts as processor and IOTILL as subprocessor under the distribution contract. These contractual roles do not automatically determine the controller for website prospects.
10Audience measurement with Google Analytics
With your consent, ORION uses Google Analytics 4 and an OVH-hosted performance tool to understand journeys and improve the site. The tool measures displayed pages, sections and buttons, clicks, form steps and error categories, without recording entered values. Events are retained for 90 days and use a pseudonymous session identifier in browser session storage (30 minutes of inactivity, four hours maximum). Measurement is disabled on the private preview. On iotill.com, refusing measurement prevents loading this tag and collecting browsing journeys. Withdrawal deletes the performance session identifier from the browser. Requests actually sent to sales are tracked separately using their reference, business type, solution and qualification for 365 days to manage and evaluate commercial requests. Linking to a browsing journey occurs only with consent and is removed after 90 days. Reports, administrative actions and closed proposals are retained for 365 days; technical backups for seven days; access is restricted to authorised people. With the same consent, we may compare two button labels to improve the site. The variant remains stable during a session; its exposure and link to a confirmed request are retained for no more than 90 days. Aggregated results and decisions are retained to avoid repeating completed experiments. Withdrawing consent stops participation and restores the usual label. No session video recording or form-field capture takes place.
Google Analytics processes visit data and technical information about the browser and device. Events added by this website do not contain form names, emails, phone numbers or messages. URL parameters and fragments are excluded from the page addresses sent by this integration.
Advertising personalisation and Google Signals are disabled in the tag configuration. Measurement relies on your consent, which you can withdraw through “Manage my cookies”. Cookie and choice retention periods are detailed on the Cookies page.
Google receives measurement data and may process it outside the European Economic Area, including in the United States. Information about its processing and safeguards is available at policies.google.com. For questions about your data, contact dpo@iotill.com.