WILS

Privacy Policy

Last updated: 2 Oct 2026

Effective date: 2 October 2026. This notice explains how WILS handles personal data when you visit our website, request a demonstration or pilot, use a WILS account, or contact us.

1. Who is responsible

WILS is operated by Gherardo Frusci trading as WILS, a sole trader in Ireland. CRO business-name reference: 791634.

Postal address: 49 Stradowe Meadows, Athy, Co. Kildare, R14 FR98, Ireland.
Privacy, account and legal enquiries: [email protected].
Website: wils-app.com.

We are the controller for website enquiries, our business contacts, account administration and our own security and legal records. A business using WILS normally controls the personal data it puts in its warehouse workspace; WILS processes that data on its instructions. The data-processing terms explain that relationship. This notice does not replace your employer's or another customer's privacy notice.

2. Data we receive and where it comes from

  • Enquiries and support: your name, work email, company, optional warehouse-size information, messages and information you choose to send. A pilot request also creates a record of the request, its status and your privacy-notice acknowledgement.
  • Accounts: name, email, account and organisation identifiers, password hash, role, access permissions, language preference and account activity. An administrator may provide or update these details on your behalf.
  • Workspace data: information the customer enters, which may include staff identifiers, operator attribution, supplier or customer contacts and delivery details linked to warehouse activity.
  • Technical information: IP address, browser/device information, requested pages, dates, security events, session information and anti-abuse challenge results. Hosting and security providers also receive connection information when your browser contacts them.
  • Business records: correspondence, agreements and, where applicable, invoice and payment-status information. Please do not send card numbers, identity documents or sensitive personal data in the pilot form or warehouse notes.

Information comes from you, your business administrator, use of the service and the providers described below. For relevant business introductions we may also use professional contact details published by the business itself or supplied by a referral; we identify the source when required and respect objections to marketing.

3. Purposes and legal bases

  • Answering requests and arranging a pilot: steps requested before a contract, where you personally enter it (GDPR Article 6(1)(b)); otherwise our legitimate interest in communicating with business representatives and evaluating a relevant business request (Article 6(1)(f)).
  • Providing and supporting accounts: performance of our contract with you where applicable; otherwise our legitimate interests in administering the business relationship and giving authorised personnel access. Customer-controlled workspace processing follows the customer's lawful instructions.
  • Security, service reliability and limited website measurement: our legitimate interests in preventing abuse, diagnosing faults and understanding which public pages are useful. We consider the effect on individuals and restrict access to the information.
  • Accounting, legal duties and rights requests: compliance with applicable legal obligations (Article 6(1)(c)). Necessary evidence for disputes is handled on the basis of our legitimate interest in establishing or defending legal claims.
  • Marketing: consent where required by electronic-marketing rules, or a lawful basis permitted for the particular business communication. You may object at any time. Submitting a pilot enquiry or acknowledging this notice does not subscribe you to a newsletter or give blanket marketing consent.
  • Optional advertising measurement: your separate consent (Article 6(1)(a)) to measure which Google advertisements lead to interest in a pilot, where the request process encounters errors, and which requests are completed. Refusing or withdrawing this consent does not affect the form, pilot or account access.

The contact fields marked as required are needed to answer your request; without them we cannot arrange a pilot. Optional fields are voluntary. Account identifiers and access information are necessary to provide a working account.

4. Cookies, security tools and website measurement

WILS uses session and security mechanisms needed for login and protected actions. When you select a website language, the wils_public_locale preference cookie lasts approximately one year; you can remove it through your browser. Session-cookie lifetimes depend on the session and browser settings.

Public production pages use Cloudflare Web Analytics for visit, page-view and performance statistics. This service does not use advertising cookies or cross-site visitor profiles. Cloudflare also provides network protection and Turnstile anti-abuse checks. Turnstile involves a direct connection from your browser to Cloudflare; it is separate from submitting the text of your enquiry.

Some public pages load fonts from Google Fonts and styling from the jsDelivr content-delivery network. Those requests disclose technical connection data, including your IP address and the requested resource, to the relevant provider. Their notices are available at Google Privacy and jsDelivr Privacy.

Optional Google Ads measurement

On public production pages, the Google Ads tag loads only after you select Allow measurement. Until then, or if you reject measurement, WILS does not load that tag or send advertising-measurement events to Google. This choice is separate from the acknowledgement needed to submit the pilot form. Google Fonts and Cloudflare connections described above are separate services.

If you allow measurement, Google receives technical connection and device information, advertising click identifiers and limited events: clicking a pilot link, beginning to complete the pilot form, encountering a form or security-verification error, and successfully saving a pilot request. Interaction and error events are diagnostic observations, separate from completed requests. We send no field values, field names, error text or security tokens. For completed requests only, an opaque, purpose-specific request identifier prevents duplicate counting. We do not send your name, email, company, message or warehouse records through this integration. We do not enable enhanced conversions, remarketing or advertising personalisation. None of these events is an account registration or paid sale.

The preference is stored in this browser as wils_ads_consent_v2 for up to 180 days. A previous version's consent does not authorise the expanded interaction measurement; we ask you to choose again. Earlier clicks or typing are not replayed after you accept. An error still displayed when you accept can be measured. Google may set first-party _gcl_* advertising-measurement cookies, commonly lasting up to 90 days. Our conversion attribution window is 30 days after an ad click; that window is not a promise that all provider data is deleted after 30 days. See Google advertising-cookie information and how Google uses information from partner sites.

Use Advertising preferences in the footer of any public page to change your choice. Rejecting measurement after accepting it clears the first-party advertising cookies and reloads the page without the Google Ads tag. Withdrawal does not undo earlier lawful processing or delete data already held by Google; contact us for a rights request. Browser settings also let you clear stored preferences and cookies.

5. Providers and other recipients

We use the following services for the stated purposes. They receive only the data needed for the relevant service; a provider is not given all categories merely because it appears in this list.

Customer-authorised administrators can see information appropriate to their role. We may disclose necessary information to professional advisers, authorities where legally required, or an integration explicitly enabled for the customer. Any paid-service payment provider and additional integration recipients are identified before that processing begins. We do not sell personal data or supply customer warehouse data for advertising.

6. Processing outside the EEA

An EU hosting or backup region does not mean that every provider's support, security or other processing stays in the EEA. Providers may process information elsewhere, including the United States. Applicable provider data-processing agreements govern those transfers, using an applicable adequacy decision or standard contractual clauses and supplementary safeguards where required. The linked provider agreements give details of their mechanisms. Contact us for information about the safeguards applicable to your data or a copy, subject to necessary redactions.

7. How long information is kept

Retention depends on the purpose and category. We review whether information is still needed and delete or minimise it when that purpose ends, unless a specific legal duty or documented dispute requires retention.

  • Unconverted enquiries and support correspondence: for the period needed to answer, follow up and resolve the matter. A continuing negotiation or unresolved issue may justify keeping the relevant correspondence; unrelated attachments and unnecessary personal detail should be removed when no longer needed.
  • Account administration: while the account or business relationship requires it, followed by the limited information needed to handle closure, outstanding requests or a specific legal claim. Closing access and erasing personal data are separate actions.
  • Customer workspace records: according to the customer's documented instructions and the agreed return/deletion arrangements. A worker leaving the business does not automatically require deletion of every lawful warehouse transaction attributed to them.
  • Technical and security records: while needed to diagnose faults, prevent abuse or investigate an incident; relevant incident evidence may be isolated and kept while that incident or a resulting claim remains unresolved.
  • WILS tax and accounting records: generally six years where Irish record-keeping rules require it, or longer for a specific applicable legal reason. This does not apply indiscriminately to all warehouse or support data.
  • Rights-request evidence: only the details needed to demonstrate what was requested, the checks made and the outcome, for as long as needed for accountability or a specific dispute. We do not require a permanent archive of identity-document copies.

Backups: recovery copies are separate from active records. Our off-site backups have a minimum 30-day immutability period and are removed through a reviewed process; they do not automatically disappear on day 30 or when an account closes. We assess the applicable recovery need, replacement recovery copies, outstanding incidents and any legal hold when deciding which copies can be deleted. Restricted backup copies must not be reused for ordinary business processing. Where data has been erased from active systems, the restriction must be reapplied before any restored copy returns to use. We confirm the treatment of relevant recovery copies when handling a closure or erasure request.

8. Your rights and account requests

Email [email protected] to request access, correction, erasure, restriction, portability where applicable, or to object to processing based on legitimate interests. You can also use the postal address above. Identify the account or business concerned and what you need; do not send identity documents unless we explain why proportionate additional verification is necessary.

You can request account closure or deletion by email without reinstalling an app or using an active account. We verify identity and, for workspace-wide actions, authority. Some data may need to be retained for a specified legal reason or to protect other people's rights; we explain any refusal or limitation and distinguish account access, business records and backups. We do not describe deactivation alone as erasure.

We respond without undue delay and normally within one calendar month. If a request is complex or numerous, the GDPR allows up to two additional months; we explain the extension and reasons within the first month. Requests are normally free. If WILS processes the data for your employer or another customer, we refer the relevant part to that controller and assist it, while handling our own controller obligations directly.

You may withdraw consent at any time for processing based on consent; that does not affect prior lawful processing. You have an unconditional right to object to direct marketing. We do not use personal data to make solely automated decisions with legal or similarly significant effects.

9. Security and scope

Measures include encrypted web connections, access controls, tenant and warehouse permissions, password hashing, security logging and restricted encrypted off-site database backups. No system is risk-free. Access to support information is limited to people who need it and are bound by confidentiality. WILS is a business service and is not directed at children or intended to hold special-category personal data.

10. Complaints and updates

You may complain to the Irish Data Protection Commission, or the competent supervisory authority where you live or work. You do not have to contact us first, although we welcome the opportunity to resolve a concern.

We update this notice when our processing changes and show the effective date above. Material changes will be brought to affected users' attention as appropriate. Contact [email protected] for questions or an earlier applicable version.