Data Processing Agreement

This agreement is between the organisation that registers for DealCRM in the European Union or European Economic Area (the Customer, acting as controller) and DEALCRM LLC, identification number 422961806, Khvanchkara, block N001, plot N047 settlement, Ambrolauri district, Georgia (DealCRM, acting as processor). It applies when the Customer accepts it at registration and covers all personal data DealCRM processes on the Customer’s behalf in the DealCRM service.

It forms part of the agreement for the service and supplements it as required by Article 28 of Regulation (EU) 2016/679 (GDPR).

• Subject and nature: hosting, storage, retrieval, display, transmission and deletion of CRM records so the Customer can run its sales and customer-service work.
• Duration: for as long as the Customer uses the service, plus the deletion periods in section 8.
• Data subjects: the Customer’s employees and users, its leads, clients, partners and other contacts.
• Data categories: names, email addresses, telephone numbers, job titles, company names, deal and task details, comments, business correspondence (emails, messages, call records), attachments and any other data the Customer chooses to enter.
• Special-category data: not intended. The Customer should not enter such data unless it has a lawful basis and appropriate safeguards.

DealCRM processes the data only on the Customer’s documented instructions, which are this agreement, the Customer’s use of the service’s functions and its written requests. DealCRM tells the Customer if it believes an instruction infringes data protection law. Everyone at DealCRM with access to the data is bound by confidentiality.

DealCRM applies the technical and organisational measures in Annex II and reviews them as the service changes.

The Customer gives general authorisation to use the subprocessors in Annex III. DealCRM informs the Customer of changes at least 30 days in advance by email to the account administrator; the Customer may object on reasonable data-protection grounds and, if the objection cannot be resolved, terminate the service. DealCRM imposes on each subprocessor obligations equivalent to this agreement and remains responsible for them.

The service lets administrators export and delete the organisation’s data and lets each user export and delete their own account. DealCRM also helps the Customer, by appropriate measures and taking into account the nature of processing, to respond to data-subject requests, to carry out data protection impact assessments and to consult the supervisory authority where required. Send requests to crm@dealcrm.app.

DealCRM notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, with the information available to it so the Customer can meet its own notification duties.

The Customer can download its data at any time. When an organisation is deleted, its records are marked immediately and permanently erased after 7 days; during that period all administrators are notified. Accounting records of payments are kept as the law requires. Encrypted backups expire automatically within 30 days (37 days including superseded versions) and are not restored except to recover the service.

DealCRM makes available the information needed to demonstrate compliance and allows for and contributes to audits, including inspections, by the Customer or an auditor it appoints, on reasonable notice, during business hours and subject to confidentiality.

DealCRM is established in Georgia, which has no adequacy decision from the European Commission. The data is hosted in the European Union, and DealCRM’s access to it from outside the EEA is a transfer. The parties therefore agree that the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated by reference and apply to those transfers, with the Customer as “data exporter” and DealCRM as “data importer”, completed as follows:

• Clause 7 (docking clause): included.
• Clause 9(a): Option 2, general written authorisation; notice period 30 days.
• Clause 11(a): the optional independent dispute-resolution body is not included.
• Clause 13: the competent supervisory authority is that of the Member State where the exporter is established, or where its representative is established.
• Clause 17: Option 1; the law of Ireland (proposed).
• Clause 18(b): the courts of Ireland (proposed).
• Annexes I–III of the clauses are Annexes I–III below.

In case of conflict between this agreement and the clauses, the clauses prevail. DealCRM will carry out and document a transfer impact assessment and give the Customer a summary on request.

• Data exporter: the Customer, identified by the organisation name, country and administrator email given at registration; role: controller.
• Data importer: DEALCRM LLC, address above, contact crm@dealcrm.app; role: processor. EU representative under Article 27 GDPR: to be appointed and published here.
• Data subjects, data categories and sensitive data: as in section 2.
• Frequency: continuous, for the duration of the service.
• Nature and purpose: remote access for operating, supporting, securing and developing the hosted service for the Customer.
• Retention: as in section 8.
• Competent supervisory authority: as in section 10.

• Encrypted connections (HTTPS) for all access to the service.
• Passwords stored only as hashes; optional two-step verification for users.
• Short-lived access tokens (15 minutes) and session cookies that are HttpOnly and expire after 7 days.
• Role-based access control inside each organisation; each organisation’s data is separated logically.
• Production services separated from development; the EU service runs in its own deployment with its own database that is not replicated to other deployments.
• Daily database backups, encrypted with a public key before upload; the private key is not held on the server.
• Self-service data export (link valid for 7 days) and deletion of accounts and organisations, with a 7-day grace period for organisations.
• Access to production data is limited to personnel who need it to operate the service and is subject to confidentiality duties.

• Hetzner Online GmbH, Germany — server hosting and storage of encrypted backups.

Providers the Customer connects itself (its own mailbox via Google or Microsoft OAuth or its own mail server, messengers, telephony) are the Customer’s processors, not DealCRM’s subprocessors. Payments for the subscription are handled by Paddle as merchant of record under its own terms and do not involve CRM content.