Data Processing Agreement (DPA)

The Processor processes the personal data of data subjects that the Controller uploads to the SimpleCRM Service or that enter it through the Controller's actions (in particular customer contacts, business correspondence including e-mails forwarded via the Smart BCC feature, bulk e-mail campaigns sent from the Controller's mailbox, and billing data), solely for the purpose of providing the Service for the term of the Contract and further in accordance with Section 8.

The Controller's customers, business partners, employees and contact persons.

Identification data (name, company name, Company ID (IČO)), contact data (e-mail, telephone, address), data on business relationships, the content of e-mail communication, including attachments, that the Controller forwards to the Service or sends from it, records of opens and link clicks of sent e-mails, and login credentials for the Controller's mailbox that the Controller stores in the Service for sending messages.

The Processor:

4.1 processes personal data only on the basis of documented instructions from the Controller, including instructions regarding transfers to a third country; the instructions are the Terms and Conditions, this agreement and the settings of the Service made by the Controller. If the law of the European Union or of a Member State requires the Processor to carry out other processing, the Processor informs the Controller of this before the processing, unless those laws prohibit this,

4.2 ensures that persons authorized to process the personal data are bound by confidentiality,

4.3 takes technical and organizational measures appropriate to the risks of the processing pursuant to Art. 32 GDPR, in particular encrypted data transmission, access control, separation of the data of individual organizations and a record of accesses pursuant to Section 5,

4.4 engages other processors only under the conditions of Section 6,

4.5 taking into account the nature of the processing, assists the Controller in fulfilling its obligation to respond to requests from data subjects under Chapter III GDPR; forwards any request it receives directly from a data subject to the Controller without undue delay and does not itself respond to it on the merits,

4.6 assists the Controller in ensuring compliance with Arts. 32 to 36 GDPR, in particular by providing the information needed for notifying a personal data breach, for a data protection impact assessment and for prior consultation with the supervisory authority, taking into account the nature of the processing and the information available to it,

4.7 notifies the Controller of a personal data breach without undue delay after becoming aware of it and informs the Controller of the nature of the breach, the categories and approximate number of data subjects concerned, and the measures taken; the 72-hour time limit under Art. 33(1) GDPR runs for the Controller in relation to the supervisory authority,

4.8 after termination of the Contract, at the Controller's choice, deletes the data, or hands it over to the Controller, to the extent of the data kept in the Service, in a machine-readable format (CSV) and then deletes it; the Controller communicates its choice within 30 days of termination of the Contract; until an instruction is given, the Processor retains the data, and the Controller may carry out the deletion itself at any time in accordance with Section 8. Data that the Processor is required to retain under legal regulations (in particular billing data) is retained for the period prescribed by law,

4.9 provides the Controller with the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows the Controller an audit announced at least 14 days in advance, as a rule no more than once a year; informs the Controller without undue delay if it considers an instruction of the Controller to be contrary to the GDPR or other personal data protection regulations,

4.10 informs the Controller of operational accesses by its authorized persons to the Controller's data in accordance with Section 5.

5.1 For the purposes of customer support, incident resolution, maintenance and data integrity checks, a limited group of the Processor's authorized persons (the so-called “super-administrator”) has the technical ability to:

1. view the metadata of the Controller's organization (name, plan, number of users, date of last activity, billing details),
2. view the list of user accounts (name, e-mail, role),
3. view the billing history and subscription activity,
4. sign in as a specific user of the Controller (“impersonation”) in order to replicate a reported problem; in this mode, the authorized person has the same permissions as that user.

5.2 This access is an explicit instruction of the Controller within the meaning of Art. 28(3)(a) GDPR, and it grants general authorization for the listed actions for the term of the Contract. The authorized persons are bound by confidentiality pursuant to Section 4.2.

5.3 Each individual access is recorded in an audit log and is available to the Controller in real time in the administration under Settings → Privacy (Operator access). The record contains the date, the type of action, the identity of the authorized person and — in the case of impersonation — the identity of the user as whom the access was made.

5.4 The Controller may object to a specific access at any time at podpora@simplecrm.cz.

6.1 The Controller grants general authorization for the engagement of the following other processors (sub-processors):

• Hetzner Online GmbH (operation of the application and database, Germany)
• Comgate, a.s. (payment gateway, Czech Republic)
• Zoho Corporation B.V. (sending e-mails from the application, Amsterdam data center, the Netherlands)
• Cloudflare, Inc. (receiving e-mails at an address in the in.simplecrm.cz domain — the Smart BCC feature; United States of America, processing on the basis of standard contractual clauses)

6.2 The Processor imposes on each other processor, by contract, the same personal data protection obligations as are agreed in this agreement, and is liable to the Controller for the performance of that processor's obligations (Art. 28(4) GDPR).

6.3 The Processor informs the Controller of an intended change of another processor at least 30 days in advance. If the Controller objects within this period, the Processor tells the Controller without undue delay, and no later than within 10 days, whether it will abandon the change or proceed with it; in the latter case, the Controller is entitled to terminate the Contract as of the day the other processor is engaged, and the Processor refunds the Controller the pro rata portion of the price paid for the unused part of the Billing Period.

6.4 If a user of the Controller signs in with a Google account or connects their calendar with Google Calendar, this service is provided to them by Google as an independent controller under its own terms; the Processor does not engage it as another processor.

The Processor keeps its invoicing records in its own application — no external invoicing system has access to the personal data of the data subjects.

The Processor operates the application and the database with Hetzner Online GmbH in Germany. A transfer to a third country takes place only in the case of the other processor Cloudflare, Inc. (Section 6), on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

8.1 This agreement is effective for the term of the main Contract and further until the data is deleted or handed over pursuant to Section 4.8.

8.2 After termination of the main Contract, the data remains accessible to the Controller for export to the extent set out in Section 4.8.

8.3 The Controller may carry out the deletion itself at any time in the administration in the Settings → Privacy section (Permanently delete organization) or request it at podpora@simplecrm.cz; the Processor carries it out without undue delay.

9.1 If tracking is switched on in the Controller's organization, the Service inserts into the HTML part of outgoing messages an image element loaded from the Processor's server and replaces links with links leading through the Processor's redirect point. Whether and when a message was opened and which link was clicked is recorded.

9.2 The Controller ensures the legal basis for this tracking in relation to the recipients, including any consent under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications.

9.3 The Controller may switch tracking off for the entire organization at any time in the administration in the Settings → Permissions section.

10.1 The Controller sends bulk messages from its own mailbox; the sender within the meaning of Section 7 of Act No. 480/2004 Coll., on Certain Information Society Services, is the Controller.

10.2 The Controller is responsible for ensuring that it has the addressee's consent to send a commercial communication or relies on the exception under Section 7(3) of Act No. 480/2004 Coll., that the message is clearly marked as a commercial communication and that the addressee has the option to refuse further messages.

11.1 This agreement is concluded in electronic form pursuant to Art. 28(9) GDPR by the confirmation under Section 3.1 of the Terms and Conditions when the organization is created.

11.2 The proof of conclusion is the record of the confirmation, which contains the date and time of the confirmation, the user who made it, and the version of the Terms and Conditions and of this agreement; the record is available to the Controller in the administration in the Settings → Privacy section.