Privacy policy

1. Data controller

The controller of the data collected through the Prosio website and application is: Salama Forever SRL (commercial brand "Prosio"), registered office at rue du Bon Pasteur 54/1, 1140 Evere (Brussels), Belgium, registered with the CBE under number BE 0711.688.802.

When Prosio acts as a processor on behalf of a customer (dealership, automotive group), that customer is the controller for the prospect data they import and use in the application. The respective obligations are then governed by the data processing agreement (DPA) entered into with the customer.

2. Data protection contact

Single contact point for any request relating to personal data: contact@prosio.be.

Any request is handled within one month in accordance with Article 12 of the GDPR, extendable by two months in case of a complex request (with reasoned notification to the data subject).

3. Scope

This policy applies:

— to the prosio.be marketing website (public pages and contact forms) ; — to the Prosio application accessible upon authentication ; — to exchanges with the Prosio teams (sales, support, security, DPO).

It does not cover third-party websites to which Prosio may refer through hyperlinks.

4. Categories of data collected

Professional identification data: last name, first name, salutation, role, employer, professional email address and phone number.

Account and authentication data: identifier, authentication managed by Supabase, language and appearance preferences, time zone. Tokens for connected Google or Microsoft accounts are encrypted by the application with AES-256-GCM before storage.

Technical data: session information, logs produced by configured services and synchronisation coordination state.

Business data entered, imported or received: companies, contacts, offers, vehicles and configurations, drafts, messages, replies to CRM conversations, signatures, notes, appointments and files. A requested Google preview reads authorised Gmail metadata and Calendar events.

Prosio is intended for professional commercial information. Do not enter sensitive data without defining an appropriate processing framework with your organisation.

5. Sources of the data

Directly from the user: account creation, data entry, CSV/XLSX imports and connecting a Google or Microsoft account.

From the employer customer: account provisioning, imported data and configured access.

From connected services: requested Google previews and replies to CRM conversations, depending on enabled features and granted permissions. Signing in to Prosio does not itself authorise mailbox access; a separate email connection is required.

Hosting and authentication services also produce technical session and logging information.

6. Processing purposes

Provide the service: authentication, commercial data, conversation tracking, tasks, appointments and connected account previews. Enabled features can prepare messages, send messages confirmed by the user and retrieve replies to CRM conversations to update follow-up status and scheduled reminders.

Handle commercial enquiries, contractual relationships and support; protect the service and meet applicable obligations. Customer data must not be reused for a new purpose without an appropriate legal framework and information.

7. Legal bases (Article 6 GDPR)

The legal basis must match each purpose and data subject: performance of a contract where that person is a party, a legal obligation, an assessed legitimate interest, or consent where required. The customer employer determines and documents the basis for processing its CRM contacts.

Technical OAuth authorization from Google or Microsoft is not, by itself, GDPR consent for every email processing activity. The customer must inform users and affected contacts and check the rules for commercial communications. A contact being B2B does not remove these obligations.

8. Retention periods

Account data is retained to provide the service during the active relationship, then only for purposes and periods justified by applicable obligations or the defence of rights. Exact periods must be provided in the service documents before use with real data.

For CRM data, the customer defines archiving and deletion rules in its instructions and DPA. Log and backup retention depends on enabled services. This page does not attest to automatic deletion or a complete end-of-contract export.

Removing a Google or Microsoft connection deletes the tokens stored in Prosio; it does not delete data already imported into the CRM or messages held by the provider. Also revoke authorization with that provider.

9. Recipients

Within Salama Forever SRL: product, support, security, accounting teams, on a need-to-know basis.

Within the employer customer: authorised administrators and users access data according to their role and dealership scope. Access relies on application controls and database rules.

From sub-processors: see section 10.

From public authorities: upon Belgian or European judicial requisition based on a legal ground.

Prosio does not sell or rent personal data to third parties.

10. Sub-processors

Vercel hosts the production site prosio.be. Supabase provides the database and authentication services used by the application. Any file, transactional email and orchestration services depend on the enabled features.

Depending on enabled connections, Google and Microsoft provide authentication and mailbox services. An authorized mailbox can send confirmed messages from Prosio and retrieve replies in known CRM conversations on request or periodically according to enabled features. Gmail and Calendar previews are separate. Without a connected mailbox, sending uses the configured business workflow; no silent fallback occurs after a send attempt.

Configured n8n workflows may use a delivery service and an AI provider, such as Anthropic, to prepare a draft. The transmitted context may include professional contact details and message content. The providers’ processing, retention and data-use terms must be checked for the service actually subscribed to; no zero-retention arrangement is assumed.

The providers actually used, their regions and applicable safeguards must be described in the service documents and DPA for the environment concerned. Contractual notification and objection terms remain those of the applicable DPA.

11. International transfers

Processing regions and possible transfers depend on the providers actually enabled and their terms. They must be identified for the Customer’s environment; a provider’s European establishment does not guarantee the absence of transfers.

Transfers outside the European Economic Area must be covered under GDPR Chapter V, for example by an adequacy decision or appropriate safeguards such as standard contractual clauses, with additional measures where necessary. Countries, applicable mechanisms and ways to obtain the safeguards must be specified in service documentation. This page does not prove that this documentation has been completed for your environment.

12. Security measures

Prosio uses authentication and access controls based on roles and dealership scope. Connection tokens for email services are encrypted by the application before storage. The Security page explains these mechanisms and the elements that depend on hosting configuration. Applicable contractual guarantees are set out in the documents agreed with the customer.

13. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

— access to your data and obtaining a copy ; — rectification of inaccurate data ; — erasure ("right to be forgotten") where the conditions are met ; — restriction of processing in the event of contestation of the accuracy of the data ; — portability of the data provided in a structured and machine-readable format ; — objection to processing based on legitimate interest or prospecting ; — withdrawal of consent at any time when the processing is based thereon ; — not to be subject to a decision based solely on automated processing producing legal effects.

14. Exercise of your rights

Requests may be sent to contact@prosio.be or by post to Salama Forever SRL, rue du Bon Pasteur 54/1, 1140 Evere (Brussels). For CRM data managed by your organisation, that organisation remains the controller; Prosio may forward the request so it can respond with the agreed assistance.

Additional information necessary to confirm identity may only be requested where there are reasonable doubts, in accordance with GDPR Article 12.6.

The GDPR provides for a response within one month of receipt, with a possible two-month extension depending on the complexity and number of requests, informing the person of the reasons within the first month. Rights apply subject to their respective conditions; manifestly unfounded or excessive requests may fall under GDPR exceptions.

15. Complaint with a supervisory authority

You have the right to lodge a complaint with the Belgian Data Protection Authority:

Data Protection Authority (DPA) Rue de la Presse 35, 1000 Brussels Tel.: +32 (0)2 274 48 00 contact@apd-gba.be autoriteprotectiondonnees.be

You may also refer the matter to the supervisory authority of your habitual place of residence or work.

16. Automated decisions and profiling

Prosio uses available sales information to suggest priorities and next actions. Configured AI workflows may receive sales context, including conversation content, to prepare drafts. Results can be inaccurate; users must check them before relying on them or sending a message.

These features must not be used on their own to make decisions with legal or similarly significant effects on a person. The AI provider, transmitted data and retention conditions must be documented. A logo, signature or public figure alone does not confirm a contact’s identity, authority or creditworthiness.

Connected accounts: Microsoft Entra and Google

Signing in to Prosio through Microsoft Entra or Google identifies the user through Supabase. It does not automatically grant mailbox access.

The separate Microsoft 365 connection requests openid, profile, email, offline_access, Mail.Send and Mail.ReadWrite as delegated permissions. Prosio creates a traceable draft and sends it after confirmation of the recipient, sender account and content. Mail.ReadWrite is used to create the draft and read replies to CRM conversations. No Microsoft calendar access is requested. Tenant policy may require IT approval.

“Connect Gmail to CRM” requests gmail.send and gmail.readonly, with openid and email. Separate preview choices request gmail.metadata and/or calendar.events.readonly and display up to 10 messages or 10 events without importing that preview.

Reply retrieval only covers conversations of CRM messages with confirmed sending and the associated contacts. It may run on request or periodically for connected mailboxes with the necessary reading permissions. Checks process batches of up to 20 confirmed CRM messages, normally from the last 90 days or while follow-up remains pending. Identified replies are copied to the CRM to update follow-up; this does not read or import the entire mailbox or trigger automatic AI analysis.

The browser can check every 5 minutes while Prosio is open and visible. If the operator enables scheduled server processing, it can run without an open browser at a target frequency of 5 minutes. Execution depends on infrastructure activation, permissions and provider availability; this does not guarantee immediate receipt.

The account, permissions and encrypted tokens are stored for the connection. Removing the connection in Prosio stops future access using its stored tokens; revoking permission at the provider can also interrupt access. Removing a connection does not erase messages and data already saved. These operations are separate from deleting CRM data.

17. Protection of minors

Prosio is a B2B service for adult professionals acting in their professional capacity. It is not directed at minors. If information about a minor has been recorded, contact contact@prosio.be so the situation can be reviewed and appropriate measures taken with the controller.

18. Changes to the policy

This policy may change to reflect developments in the service and applicable obligations. The date at the top indicates its latest revision. Changes requiring specific information or new consent must be brought to affected people’s attention under the applicable rules; this page does not attest to an automatic email notification mechanism.