Data processing agreement (article 28 GDPR)

This agreement is part of the terms of service. It applies to the personal data the customer (controller) records in SoliCRM and that [publisher's legal name — to complete] (the processor) processes on its behalf.

1. Subject and duration

The processor hosts and runs the customer's CRM for the term of the subscription. Processing: storage, consultation, computation, sending emails and documents at the customer's request.

2. Data and data subjects

Contacts, leads and people at the customer's customers and suppliers; the customer's users. Identification data, business contact details, sales exchanges, sales and billing documents. The customer will not record special categories of data (art. 9).

3. Instructions

The processor processes data only on the customer's documented instructions — using the service and its settings are instructions — and tells the customer if an instruction seems to infringe the GDPR.

4. Confidentiality and security

Staff bound to confidentiality; one instance and one database per customer; encryption in transit (TLS) and of secrets at rest; hashed passwords (Argon2id); two-factor authentication and SSO available; tamper-evident audit trail; daily backups kept 14 days, restoration tested weekly.

5. Sub-processors

General authorisation for the listed sub-processors; any addition is notified 30 days ahead, and the customer may object and terminate.

6. Data subjects' rights

SoliCRM gives the customer the tools to answer them: complete export of a person, erasure, register of consents and requests, retention periods. The processor assists on request.

7. Personal data breach

Notified to the customer without undue delay, at most 48 hours after discovery, with the information it needs for its own notification.

8. End of the contract

The customer can export all its data at any time. After the subscription ends, data stays readable for 30 days, then is deleted, backups included within 14 days.

9. Audit

The processor makes available the information needed to demonstrate compliance and allows audits once a year with reasonable notice.