Data processing overview

1. Roles

For enterprise customers using crmtr to process personal data about their own clients, employees, or partners, the customer is typically the controllerand crmtr acts as a processorfor product processing activities performed on documented instructions.

2. Subject matter and duration

Processing relates to hosting and operating the CRM and related modules the customer enables. Processing lasts for the term of the agreement and until deletion or return of data in accordance with that agreement.

3. Nature and purpose

Processing includes storage, retrieval, search, workflow execution, reporting, authentication, backups, security monitoring, and support access where contractually permitted.

4. Types of personal data

Categories may include identifiers (name, email, phone), professional data, commercial information, and content the customer chooses to store in the product. Sensitive categories should only be uploaded where legally justified and technically supported.

5. Subprocessors

We use vetted subprocessors for infrastructure, payments, email, and optional AI features. Customers may request a subprocessor list and notice of material changes as part of an enterprise agreement.

6. Security

We implement appropriate technical and organizational measures, including access controls, encryption in transit where applicable, and operational monitoring. Details are summarized on our Securitypage.

7. Assistance

Where GDPR Article 28 applies, we assist with reasonable requests regarding data subject rights, breach notifications, and impact assessments, subject to the scope of the commercial agreement.

8. Formal DPA

This page is a high-level overview for procurement discussions. A signed Data Processing Agreement or equivalent clauses should be executed for regulated production use; contact salesfor the current template.