Privacy Policy

Last updated: 12 May 2026

This privacy policy describes how Innovaplus SRL (hereinafter "OrdoGrid", "we", "our" or "us"), a Belgian company registered under company number BE 0681.892.974, collects, uses and protects the personal data of users of the OrdoGrid platform (hereinafter "the Platform").

We are committed to complying with the General Data Protection Regulation (GDPR - Regulation EU 2016/679) as well as applicable Belgian data protection legislation.

1. Data controller

Innovaplus SRL
Company number: BE 0681.892.974
Email: contact@ordogrid.com

For any questions regarding the protection of your personal data, you may contact us at the email address above.

2. Data collected

2.1 Data provided directly by the user

• Identification data: first name, last name, email address, phone number
• Company data: legal name, VAT number, registered office address, bank details (IBAN, BIC), logo
• Billing data: information relating to invoices, quotes, receipts and credit notes (clients, amounts, line items)
• Client data: name, email, address, VAT number of your clients
• Project data: project names, tasks, description, partners
• Uploaded documents: PDF invoices, bank statements, supporting documents, company logo

2.2 Calendar integration data

If you enable one of the calendar integrations offered by OrdoGrid, we collect and store the following data, only for the account to which you have linked them:

• Google Calendar / Google Tasks: OAuth 2.0 refresh token, allowing creation, modification and deletion of events and tasks in your Google account
• Outlook Calendar: Microsoft OAuth 2.0 refresh token and email address of your Microsoft account, allowing creation, modification and deletion of events in your Outlook calendar
• iOS Calendar (ICS feed): a unique and confidential feed token, embedded in a URL that your iOS Calendar app can poll to synchronise your tasks

2.3 Automatically collected data

• Connection data: IP address, browser type, operating system, pages visited
• Session cookies: to maintain your authentication
• Usage data: interactions with the Platform, features used, navigation events
• Marketing attribution data: UTM parameters, Google Click identifier (gclid)

3. Purposes of processing

Your personal data is processed for the following purposes:

• Contract performance: creation and management of your account, provision of invoicing, accounting, project management and online payment services
• Subscription management: payment processing and management of your subscription via Stripe
• Communication: sending transactional notifications (confirmations, alerts) by email via SendGrid
• E-invoicing: sending and receiving electronic invoices via the Peppol network
• Calendar synchronisation: if you enable a calendar integration, your tasks (title, dates, status, description) are sent to Google Calendar/Tasks or Outlook Calendar, or made available via an ICS feed for iOS Calendar
• Service improvement: anonymised analysis of Platform usage via Google Analytics (browser cookies only) to improve the user experience
• Advertising measurement: measurement of the effectiveness of our campaigns via Google Ads (browser cookies only — this purpose never applies to data obtained via Google OAuth)
• Legal obligations: compliance with Belgian accounting and tax obligations
• Security: protection against fraud and unauthorised access

Important: data obtained via Google OAuth authorisation (access to Google Calendar and Google Tasks) is used exclusively to synchronise your tasks with your Google account. This data is never used for advertising, analytics, marketing or any purpose other than directly providing the calendar synchronisation feature.

4. Legal bases for processing

• Contract performance (Art. 6.1.b GDPR): to provide the Platform services
• Consent (Art. 6.1.a GDPR): for marketing communications and analytics cookies
• Legitimate interest (Art. 6.1.f GDPR): to improve our services and ensure Platform security
• Legal obligation (Art. 6.1.c GDPR): to comply with accounting and tax obligations

5. Processors and data transfers

We use the following processors for the processing of your data:

* When data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place (European Commission standard contractual clauses, adequacy decision or EU-US Data Privacy Framework).

6. Compliance with Google API policies

"OrdoGrid's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

In other words, the use and transfer of data received via Google APIs to any other application complies with the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data obtained via Google APIs (Google Calendar, Google Tasks) is used exclusively to provide the calendar synchronisation feature to the user who granted access. This data is not used for other purposes, is not shared with unauthorised third parties, and is not used for targeted advertising, data sales or AI model training.

7. Calendar integrations

OrdoGrid allows you to synchronise your tasks with third-party calendar applications. These integrations are optional and can be enabled or disabled at any time from your account settings.

6.1 Google Calendar and Google Tasks

This integration uses Google's OAuth 2.0 protocol. When you enable it, you are redirected to Google to authorise OrdoGrid to access your primary calendar and tasks (requested scopes: calendar.events and tasks). OrdoGrid stores only an encrypted refresh token in our database; no Google password is ever transmitted or stored.

Your task data sent to Google includes: title, description (HTML stripped), start and due dates, and status (completed / cancelled). OrdoGrid does not access any other data from your Google account. You can revoke this access at any time from the OrdoGrid interface or directly in your Google account (myaccount.google.com → Security → Third-party apps).

Google data sharing: data obtained via Google OAuth is transmitted only to the Google Calendar and Google Tasks APIs (Google LLC services) solely to create, modify or delete events and tasks corresponding to your OrdoGrid tasks. This data is not transferred to any other third party, is not used for advertising or analytics purposes, and is not resold.

6.2 Outlook Calendar (Microsoft)

This integration uses Microsoft's OAuth 2.0 protocol (Microsoft Identity Platform). When you enable it, you are redirected to Microsoft to authorise OrdoGrid to access your Outlook calendar (requested scope: Calendars.ReadWrite). OrdoGrid stores an encrypted refresh token and your Microsoft email address in our database.

Your task data sent to Outlook includes: title, description, start and due dates, notes, and status. You can revoke this access at any time from the OrdoGrid interface or from your Microsoft account (account.microsoft.com → Privacy → Apps and services).

6.3 iOS Calendar (ICS feed)

This integration requires no third-party account. OrdoGrid generates a secret and unique URL containing a random token (webcal:// format). Your iOS Calendar app or any other iCalendar-compatible client can subscribe to this URL, which is automatically polled every 15 minutes to retrieve your tasks in iCalendar (.ics) format.

Data exposed in this feed includes: title, description, notes, start and due dates, status and priority of tasks assigned to you or created by you. This feed is accessible without authentication via the secret URL; if you wish to disable it, revoke the token from your settings — the URL will be immediately invalidated and inaccessible.

8. Cookies and tracking technologies

7.1 Essential cookies

Session cookies necessary for the operation of the Platform and your authentication. These cookies cannot be disabled.

7.2 Analytics cookies

Google Analytics 4 (GA4) is used to understand how users interact with the Platform. These cookies collect information in an anonymised manner. You can refuse them via your browser settings.

7.3 Marketing cookies

Google Ads uses cookies to measure the effectiveness of our advertising campaigns. These cookies are only active if you visited our site via an advertisement.

7.4 Local storage

We use browser local storage (localStorage) only to save your interface preferences (dashboard layout, filters). No sensitive data is stored locally.

9. Retention period

• Account data: retained for the duration of your active subscription
• After account deletion: data is deleted immediately, except for data we are legally required to retain (Belgian accounting and tax obligations: 7 years for accounting records)
• Calendar integration tokens (Google, Outlook): deleted immediately upon disconnection of the integration or account deletion
• ICS feed token (iOS Calendar): revoked immediately upon disconnection, making the feed URL inaccessible
• Analytics data: anonymised and retained for a maximum of 14 months (Google Analytics policy)
• Marketing data (UTM): retained for the session and deleted when the browser is closed

10. Your rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data
• Right to restriction: restrict the processing of your data
• Right to portability: receive your data in a structured, machine-readable format
• Right to object: object to the processing of your data based on our legitimate interest
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing

To exercise these rights, contact us at contact@ordogrid.com. We will respond to your request within 30 days.

If you believe your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority (APD): www.autoriteprotectiondonnees.be.

11. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure, including:

• Encryption of communications (HTTPS/TLS)
• Secure authentication (hashed passwords, OAuth 2.0)
• Data hosting within the European Union
• Restricted data access according to the principle of least privilege
• Regular backups and business continuity plan

12. Minimum age

The Platform is intended for professional use (B2B). You must be at least 18 years old to create an account and use our services.

13. Changes

We reserve the right to modify this privacy policy at any time. In the event of a material change, we will inform you by email or via a notification on the Platform. The date of the last update is indicated at the top of this page.

14. Contact

For any questions regarding this privacy policy or the processing of your personal data, contact us at:
contact@ordogrid.com