GDPR Compliance

1. Roles: controller vs. processor

2. Data Processing Agreement (DPA)

We provide every customer with an Art. 28 GDPR DPA covering subject matter and duration, categories of data and data subjects, confidentiality obligations, sub-processors, assistance with data subject requests, deletion or return of data at contract end, and audit rights. Request it at gdpr@crmconnect.ro.

3. Sub-processors

We notify customers before adding a new sub-processor, with a right to object as set out in the DPA.

4. Technical and organisational measures

• Encryption in transit (TLS) and at rest.
• Single-tenant pod isolation for platform customers.
• Role-based access control, least-privilege principle, access logs.
• Regular backups and tested restore procedures.
• Retention policies and automated deletion of data no longer needed.
• Staff training and confidentiality clauses in employment contracts.
• Data Protection Impact Assessments (DPIA) for high-risk processing.

5. How to exercise GDPR rights

• Send your request to gdpr@crmconnect.ro, stating the right invoked and the e-mail address used on the site.
• We may ask for additional information to verify your identity.
• We reply within 30 days; the deadline may be extended by 60 days for complex requests, with prior notice.
• Requests are free of charge, except manifestly unfounded or excessive ones.
• If you are a user of an CRMconnect customer, we forward the request to the controller (the customer) and assist them in handling it.

6. Account and data deletion

On request we delete the account and derived data within 30 days, except data we must retain by law (e.g. invoices - 10 years). Send your request to gdpr@crmconnect.ro.

7. Security incidents

We notify ANSPDCP within 72 hours of becoming aware of a personal data breach that poses a risk, and inform affected customers without undue delay. Report a suspected vulnerability to gdpr@crmconnect.ro.

8. Supervisory authority

ANSPDCP - 28-30 G-ral. Gheorghe Magheru Blvd., district 1, Bucharest; anspdcp.ro; anspdcp@dataprotection.ro.