This Data Processing Agreement ("DPA") forms part of the Terms of Service or other agreement between CRMown ("Processor," "we," "us") and the customer ("Controller," "you") that governs your use of the CRMown platform ("Agreement").
Self-Hosted Customers: This DPA applies only to the CRMown managed SaaS platform. If you have purchased a perpetual "Own" license and self-host CRMown on your own infrastructure, CRMown does not process any Personal Data on your behalf and this DPA does not apply. You are the sole controller and processor of data on your self-hosted instance.
"Personal Data" means any information relating to an identified or identifiable natural person that is processed by CRMown on behalf of the Controller in connection with the Agreement.
"Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
"Data Protection Laws" means all applicable laws relating to the processing of Personal Data, including the GDPR (EU Regulation 2016/679), UK GDPR, Swiss nFADP, CCPA/CPRA, LGPD, PIPEDA, and the Australian Privacy Act, as applicable.
"Sub-Processor" means any third party engaged by CRMown to process Personal Data on behalf of the Controller.
The Controller determines the purposes and means of processing Personal Data. CRMown acts as a Processor, processing Personal Data solely on behalf of and in accordance with the Controller's documented instructions.
The categories of Personal Data processed, the categories of data subjects, and the purposes of processing are determined by the Controller's use of the CRMown platform, which may include contact management, communications, pipeline management, invoicing, scheduling, and related CRM functions.
The Controller shall:
CRMown shall:
The Controller provides general authorization for CRMown to engage Sub-Processors. A current list of Sub-Processors is maintained at crmown.com/sub-processors.
CRMown shall:
If the Controller objects to a new Sub-Processor on reasonable grounds, the parties shall discuss the concern in good faith. If no resolution is reached, the Controller may terminate the affected services.
CRMown implements and maintains appropriate technical and organizational measures, including:
In the event of a Personal Data breach, CRMown shall:
CRMown processes data primarily in the United States. Where Personal Data is transferred from the EEA, UK, or Switzerland to the United States or other countries, CRMown relies on Standard Contractual Clauses (SCCs) as approved by the European Commission (Commission Implementing Decision (EU) 2021/914), or other legally recognized transfer mechanisms.
The Controller may request execution of SCCs by contacting legal@crmown.com.
CRMown provides tools within the platform to assist the Controller in responding to data subject requests, including:
If CRMown receives a data subject request directly, CRMown will redirect the data subject to the Controller unless legally prohibited from doing so.
CRMown shall make available to the Controller on request all information reasonably necessary to demonstrate compliance with this DPA. The Controller may conduct audits, including inspections, on reasonable notice and during normal business hours. CRMown may satisfy audit requests by providing relevant third-party audit reports, certifications, or compliance documentation.
This DPA shall remain in effect for the duration of the Agreement. Upon termination, CRMown shall, at the Controller's election, delete or return all Personal Data within 30 days, unless retention is required by applicable law. CRMown shall certify deletion upon request.
This DPA shall be governed by the same governing law as the Agreement between the parties, except to the extent that Data Protection Laws require otherwise.
For questions about this DPA or to request execution of Standard Contractual Clauses, contact: legal@crmown.com