Data protection and security

A plain summary of how the Leeway ERP holds your data. Leeway, LeeTech IM LTD in Cyprus, is responsible for it.

Where your data is

• The ERP, its documents and the signing service run on Leeway’s own server at Amazon Web Services in Frankfurt, Germany.
• Leeway does not use a third-party signing company: the signing service runs on Leeway’s server.

Backups

The ERP database, its files and the signing service are backed up nightly to separate storage in the same EU region. Backups are kept for 35 days.

Who can reach your data

• Leeway staff and Leeway’s support system, each with its own named account. The number of accounts is small.
• You, through share links and, if you have one, your portal account. A share link opens one document only.
• Share links use a long random key, which can be replaced if a link is exposed.

In transit

billing.leeway-im.com and sign.leeway-im.com use encrypted HTTPS connections, with TLS 1.2 or 1.3. The support portal also uses HTTPS.

Payments

Card payments are processed by Stripe. Card numbers never reach Leeway’s server. Bank transfers go directly to Leeway’s bank account.

Your requests

To see, correct or delete personal data Leeway holds about you, write to info@leeway-im.com. Invoices and accounting records are kept for the period Cypriot law requires.

For Gerard: add the retention schedule, the list of sub-processors and the link to the privacy notice when they are published.

Odoo counterpart: none. Leeway hosts its own Odoo Community server, so Odoo’s hosting pages do not apply.