CRMCA
1. Parties and roles
Controller: the Customer tenant organization using app.crmca.cc. Processor: CRMCA platform operator. This DPA forms part of the Terms of Service for processing of personal data within Customer Data.
2. Subject matter and duration
Processor hosts and processes personal data stored in the tenant workspace to provide the Service for the term of the subscription and any post-termination retention/deletion period described in the Privacy Policy.
3. Nature and purpose of processing
Storage, retrieval, transmission, backup, display, and related processing necessary to operate CRM modules, integrations enabled by Controller, support, and security.
Where Controller instructs Processor (via product configuration or integrations) to transmit or publish Customer Data or other content to third-party platforms, Controller remains responsible as controller for that outbound publishing, including lawful basis and third-party terms. Processor acts only as a technical facilitator under Controller’s instructions; liability for published content is addressed in the Terms of Service.
4. Types of personal data and data subjects
May include identity and contact data of Controller’s customers, leads, employees, contractors, and other individuals whose data Controller chooses to store; categories depend on Controller configuration. Special-category data should not be submitted unless Controller has a lawful basis and appropriate safeguards.
5. Instructions
Processor processes personal data only on documented instructions of Controller, including via product configuration and support tickets, unless required by law. Brand sharing between two tenants requires additional tenant↔tenant arrangements; CRMCA remains processor for platform-layer processing for each tenant.
6. Confidentiality
Processor ensures persons authorized to process personal data are bound by confidentiality obligations.
7. Security
Processor implements appropriate technical and organizational measures (access control, encryption in transit, backups, monitoring) taking into account the state of the art and risk. Controller is responsible for configuring user access within its tenant.
8. Subprocessors
Controller authorizes Processor to engage subprocessors listed on the Subprocessors page. Processor remains responsible for subprocessors’ performance. Material additions will be published on that page; Controller may object on reasonable data-protection grounds by contacting hello@crmca.cc.
9. Assistance with rights and compliance
Taking into account the nature of processing, Processor assists Controller with data-subject requests, DPIAs, and consultations with supervisory authorities where reasonably possible through product features and support.
10. Personal data breach
Processor will notify Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, with information reasonably available to assist Controller’s notification duties.
11. Deletion and return
Upon termination, Processor will delete or return Customer Data in accordance with product export tools and retention practices, unless law requires storage.
12. Audits
Upon reasonable written request, Processor will make available information necessary to demonstrate compliance with this DPA and allow audits mutually scheduled so as not to disrupt operations, subject to confidentiality.
13. International transfers
Where Processor transfers personal data outside the EEA/UK, it ensures an appropriate transfer mechanism as described in the Privacy Policy.
14. Liability and precedence
Liability follows the Terms of Service unless mandatory law provides otherwise. If there is a conflict between this DPA and the Terms regarding data-protection obligations, this DPA prevails for that subject.
15. Contact
hello@crmca.cc