Privacy statement
Who we are
DynSolutionZ B.V. makes DynBrowser, a browser application for Microsoft Dynamics 365 Finance & Operations, and runs this website and the customer portal. We are the controller for the processing described in this statement. We have not appointed a data protection officer; for any privacy question or request, write to info@dynsolutionz.com.
Prins Bernhardstraat 9
2671ER Naaldwijk
NL
KvK 42157346
BTW NL869966030B01
invoice@dynsolutionz.com
When this statement applies
Organisations that use DynBrowser are themselves responsible for much of the personal data of their users — the accounts, the content they create together, support requests. For that part we are their processor under our data processing agreement, and the organisation’s own privacy statement applies. This statement covers what we are responsible for ourselves, listed below, and your visit to this website.
Your ERP data stays yours
DynBrowser connects directly from your computers to your own Microsoft Dynamics 365 environment. What you view or change in Dynamics 365 — orders, items, stock, prices, production — does not pass through our servers, and DynBrowser does not send it to us of its own accord. What is stored on our servers is only what your users store or submit themselves to share it within your organisation: DynPlanboard settings (groups, resources, colours, shift calendars), DynCost price lists, Document Designer templates, DynDesigner themes, the company settings your administrator records in the portal, and what you attach to a support request. That can include data your users take over from Dynamics 365, such as rates in a price list or the names of resources.
What we process, why, on what basis and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Visiting this website | Your IP address and the address requested, to deliver the page and to limit and trace misuse (rate limiting, the web server’s access log). Your language and theme choice and, when signed in to the portal, the session token — stored in your own browser, not with us. | Legitimate interest (a working, secure website). The browser storage is strictly necessary and needs no consent; we use no cookies for tracking or analytics. | The web server’s access log, with IP address: fourteen days. Browser storage until you sign out or clear it. |
| Registration and the customer relationship | Company details; name, e-mail address and phone number of contact persons; the version of the terms accepted, and when. | Performance of the contract; for contact persons of a business customer, legitimate interest. | For the duration of the relationship; what forms part of our accounts, seven years. A rejected registration: twelve months after the decision. |
| Portal accounts and security | Login sessions with IP address and browser type; the activity log of logins, password resets, user management, downloads, exports and administrative actions. | Legitimate interest (security and preventing misuse). | Sessions until they expire; activity log twelve months. |
| Licence and seat checks | Hashed machine identifier, machine name, application version, Dynamics 365 domain, the Dynamics 365 user name and e-mail address, time zone, language, minutes of use per day and per hour, online status. On sign-in, the proof of the Microsoft sign-in (ID token), which we verify and do not store. Your administrators see in the portal, per user, the minutes of use per day, when someone was last active and on which computer. If your organisation allows only added users, we keep the name and e-mail address of someone who was refused, with the number of attempts, so your administrators can add them. | Performance of the contract with your organisation, and legitimate interest in enforcing the licence. | Usage per hour 90 days; refused access attempts 90 days after the last attempt; usage per day 24 months; installations for as long as the subscription runs. |
| Usage statistics | Per user and per DynPage, the number of requests to Dynamics 365 and of failed requests, with entity name, error code and the Dynamics 365 environment; for a refused request also the name of the object Dynamics 365 refused. Never the content, filters or addresses of those requests. Your administrators see the refused requests per user in the portal (D365 access), so they can set the rights in Dynamics 365; the other counts only we see. | Legitimate interest (a working product, support). These counts travel with the licence check and cannot be switched off. | 90 days. |
| Error reports | Scrubbed error descriptions with hashed machine identifier and version. Of a web address only the server name remains. | Legitimate interest (a working product, support). On by default; can be switched off in the app under Settings → General. | 90 days. |
| Finding your organisation on first start | The company code or the domain of the e-mail address a user enters (never the full address), or what Windows reports about the machine: the Microsoft tenant and the domain of the Windows user. When we find your organisation, we record the IP address and a shortened hash of the input. For a search without a result, the technical server log records only the shortened hash. | Legitimate interest (finding the right settings, preventing misuse). | Twelve months. |
| Distribution of the software | The recipient of a download link; the downloads with IP address. | Legitimate interest (protecting the licence, audit trail). | Twelve months. |
| Arcade on the start page | Anonymous play statistics with a hashed machine identifier; a scoreboard entry with your name and score only if you switch that on. | Legitimate interest (anonymous statistics); consent (scoreboard), which you withdraw by switching the setting off. | Statistics 24 months; scoreboard until your organisation’s subscription ends. |
| Quotes, invoices and payments | Company and contact details, amounts, payment details, the name of the person who accepted or signed. | Legal obligation (tax retention) and performance of the contract. | Seven years. |
| Correspondence | Name, e-mail address and the content of e-mails you send us. | Legitimate interest, or performance of the contract. | As long as the matter requires, and no longer than two years after it is closed unless it forms part of our accounts. |
When a subscription ends, the content and user data we hold for the organisation are deleted thirty days after the end date, as set out in the licence terms and the data processing agreement. If a subscription is suspended without an end date, we keep the data until the subscription ends or the organisation asks us to delete it. Backups expire within thirty days after a deletion.
Who receives the data
We do not sell or trade your data. It is received only by: STRATO AG (hosting and e-mail, Germany); Mollie B.V. (online payment of invoices, the Netherlands, an independent controller for the payment data); our accountant, for the annual accounts and tax returns; the Dutch Tax Administration where the law requires it; and the European Commission’s VIES service, to which we send a business customer’s VAT number to check it. Our data processing agreement lists the sub-processors.
We do not transfer personal data outside the European Economic Area. This site loads no external scripts, fonts, analytics or trackers: everything, including the web fonts, comes from our own servers.
Your rights
You have the right to access, rectification, erasure and restriction of your personal data, the right to data portability, and — where we rely on consent — the right to withdraw it at any time. Send your request to info@dynsolutionz.com; we answer within one month and may ask you to confirm your identity first. If the request concerns data we hold as processor for your organisation, we forward it to your organisation. Organisation administrators can also manage their own users directly in the customer portal.
Right to object. Where we process your data on the basis of our legitimate interest, you may object to that at any time on grounds relating to your particular situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl). We would appreciate hearing from you first, so we can try to resolve it.
Required data and automated decisions
The data for the licence check is needed for the software to work; without it the software cannot be used. We take no decisions based solely on automated processing that have legal or similarly significant effects on you. The licence check automatically admits or refuses a session under your organisation’s subscription; it does not assess you as a person.
Security
All traffic is encrypted (TLS). Passwords are stored only as strong one-way hashes, session tokens are stored hashed, secrets are stored encrypted, and the price lines of DynCost price lists are encrypted per organisation. Logs and usage data are deleted automatically every day once their period in the table above has passed. Access to production systems is restricted.
Changes
We update this statement when our processing changes, and change the date above. We announce material changes to our customers by e-mail.