Data Processing Terms

CRM Online (Pty) Ltd, registration number 2026/741309/07

Effective 20 October 2026. These Data Processing Terms form part of our Terms and Conditions (section 11). You agree to them when you accept the Terms. They meet Article 28 of the UK GDPR.

"Data protection law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time. Words such as "controller", "processor", "personal data" and "personal data breach" have the meaning they have in the UK GDPR. "Working days" means Monday to Friday, except public holidays in South Africa.

1. Our roles

You (the customer) are the controller of the personal data in your CRM. We (CRM Online) are your processor.
If you hold that data as a processor for someone else, we are your sub-processor. You confirm that you have that controller's permission to use us.
You are responsible for having a lawful basis for the data you put in your CRM and for the messages you send through it.

2. What we process

Subject matter: hosting and running your CRM, and supporting you.
Duration: for as long as the Terms apply, plus the read-only and archive periods in section 9 below.
Nature of the processing: storing, hosting, backing up, retrieving, displaying, sending (when you send emails or WhatsApp messages from your CRM), restoring and deleting data, and viewing it when you ask us for support.
Purpose: to provide the Service to you under the Terms.
Types of personal data: contact details (names, email addresses, phone numbers, addresses); business details; quotes, invoices, payments and other financial records; jobs, projects and tasks; files and documents; messages and notes; staff user details, logins and activity logs; and any other personal data you choose to put in your CRM.
Special category data: none intended. Do not store it unless you have a lawful reason and have checked that the Service is suitable for it.
People the data is about: your staff, customers, leads, contacts and suppliers, and anyone else whose details you put in your CRM.

3. Your instructions

We process the data only on your documented instructions. Your instructions are these Data Processing Terms, the Terms, what you do in your CRM (for example, sending an email or exporting a list), and anything else we agree with you in writing.
This includes instructions about sending data outside the UK (see section 11).
If the law requires us to process the data in any other way, we will tell you first, unless that law forbids us to.
If we think an instruction breaks data protection law, we will tell you.
We will not use your data for our own purposes.

4. Confidentiality

Everyone we allow to process your data is bound to keep it confidential.

5. Security

We take appropriate technical and organisational measures to protect your data, as Article 32 of the UK GDPR requires. Annex 2 lists them.

6. Sub-processors

You give us general permission to use the sub-processors listed in Annex 1.
We will email you at least 30 days before we add or replace a sub-processor.
If you have a reasonable data protection reason to object, tell us within 10 working days of our email. If we cannot resolve your concern, you may cancel the Service before the change takes effect. We will refund any fees you have paid for the period after the change.
We will make sure each sub-processor is bound by a written contract that gives your data the same level of protection as these terms.
We remain responsible to you for our sub-processors.

7. Helping you

Requests from individuals. Most requests, such as copying, correcting or deleting someone's records, you can handle yourself inside your CRM. If someone sends a request about your data to us, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to. We will help you respond where you need us to.
Other duties. Taking into account what we do and the information we have, we will help you meet your duties on security, personal data breaches, data protection impact assessments and consulting the ICO.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and in any case within 72 hours. We will give you the information we have, including what happened, the types of data and the approximate number of people affected, the likely effects, and what we are doing about it. We will update you as we learn more.

9. When the Service ends

You can export your data at any time, and for 90 days after your trial or subscription ends, while your CRM is read-only.
After the 90 days, we keep a sealed copy for 12 months so that we can restore your CRM if you ask. We then delete it.
You can ask us to delete your data sooner. We then delete it, and remove it from our backups within 30 days.
We will keep data after this only where UK law requires us to.
If you ask, we will confirm the deletion in writing.

10. Showing that we comply

We will give you the information you reasonably need to show that we meet these terms.
We will allow and help with audits by you, or by an independent auditor you appoint who is bound to confidentiality. Please give us at least 30 days' notice. Audits take place during working hours, no more than once a year, unless there has been a personal data breach or the ICO requires an audit.
You pay your own audit costs. We may first answer your questions in writing or with documents, if that gives you what you need.

11. Sending your data to South Africa

We are established in South Africa, and the Service is hosted on servers in South Africa. When you use the Service, you send personal data from the UK to us in South Africa. This is a "restricted transfer" under the UK GDPR.
The UK has not made adequacy regulations for South Africa. So we and you agree to the safeguard below.
The IDTA. You (as exporter) and we (as importer) enter into the International Data Transfer Agreement (IDTA), version A1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and in force from 21 March 2022, as revised under its own terms. It is included in these terms by reference. You and we agree to be bound by it when you accept the Terms. Its Part 1 tables are completed as follows:
- Table 1 (parties): Exporter: you, with the details you gave at sign-up. Importer: CRM Online (Pty) Ltd, registration number 2026/741309/07, 108 Workington Road, Greenwood Park, Durban, KwaZulu-Natal, 4051, South Africa, hello@crmonlinehub.co.uk. Start date: the date your agreement with us starts.
- Table 2 (transfer details): The IDTA is governed by the law of England and Wales, and the primary place for legal claims is England and Wales. The exporter is a controller (or a processor, as in section 1). The importer is a processor (or sub-processor). The UK GDPR does not apply to the importer's processing of the transferred data, so the importer follows all of the IDTA's protections. The linked agreement is the Terms and these Data Processing Terms. The importer may process the data for as long as the linked agreement is in force, plus the periods in section 9. Neither party may end the IDTA before then, unless there is a breach or both agree in writing. If the ICO changes the approved IDTA, the importer may end the IDTA as Section 29.2 of the IDTA allows. The importer may transfer the data on only to the sub-processors in Annex 1, in line with Section 16.1 of the IDTA. Review: at least once a year, and whenever the data, the purposes, the sub-processors or the law in South Africa change.
- Table 3 (transferred data): the data, people and purposes in section 2. These update automatically if section 2 is updated.
- Table 4 (security): the measures in Annex 2. These update automatically if Annex 2 is updated.
- Part 2 (extra protection clauses): none.
- Part 3 (commercial clauses): the Terms and these Data Processing Terms.
- Part 4 (mandatory clauses): the Mandatory Clauses of the approved IDTA, as issued by the ICO and revised under Section 5.4 of those clauses.
If anything in the Terms conflicts with the IDTA's mandatory clauses, the IDTA's mandatory clauses win.
UK Addendum instead. If you also transfer data under the EU GDPR, and prefer it, we can instead enter into the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0). Please email us.
Your transfer check. As exporter, you must check that the transfer meets UK law's "data protection test". On request, we will give you information to help you, including about South Africa's data protection law (POPIA), how we protect your data, and how we would respond if a public authority asked us for it.
We will send your data on to any country outside South Africa only to sub-processors listed in Annex 1, and only with safeguards that UK law accepts.

12. Providers you connect yourself

Some features let you connect your own account with another company. Examples are Google Maps and Places (with your own Google key, for the Find Businesses add-on), AI providers (with your own key) and payment gateways. When you use them, your data goes to that company under your own agreement with it. That company is not our sub-processor. You are responsible for that agreement and for any transfer of data to that company.

Annex 1: Sub-processors

xneelo - South Africa - hosting of our servers and backups, and delivery of email sent from your CRM through our mail service.
Pro Media Mogul - South Africa - development, maintenance and technical support of the Service, including support sign-ins to your CRM.
Meta Platforms (WhatsApp) - United States and other countries - only if you use WhatsApp features in your CRM: sending and receiving WhatsApp messages.

Paystack processes our billing to you, not the data in your CRM. It is listed in our Privacy Policy.

Annex 2: Security measures

Each customer's CRM has its own separate database.
Access is by password over an encrypted (HTTPS) connection.
Support sign-ins show a notice inside your CRM and are logged on your system and on ours.
Access to systems is limited to people who need it for their work.
Systems are kept patched.
Daily backups, with a copy kept in a separate location.

CRM Online (Pty) Ltd, a private company registered in South Africa, registration number 2026/741309/07. Registered address: 108 Workington Road, Greenwood Park, Durban, KwaZulu-Natal, 4051, South Africa. Email: hello@crmonlinehub.co.uk.