Data Processing Addendum

This Data Processing Addendum governs the parties' rights and obligations regarding the personal data the customer transfers to TiosCRM while using the services.

This addendum is an integral part of the TiosCRM Terms of Use and Subscription Agreement.

For personal data of its own customers, prospects, employees, business partners or third parties transferred to TiosCRM, the customer acts as the data controller.

TiosCRM acts as the data processor, processing this data on the customer's instructions to provide the service.

For data TiosCRM processes for its own account management, sales, billing, support, security and communication, TiosCRM may also be a data controller.

Data transferred by the customer may include:

• Name and surname.
• Phone number.
• Email address.
• Company or organization info.
• Title and role.
• Customer notes.
• Meeting records.
• Quote and sales-process information.
• Task, reminder and follow-up records.
• File and document contents.
• Tags, segments and sales stages.
• Other CRM data the user enters.

The processed data may belong to:

• Customers.
• Prospects.
• Sales opportunities.
• Suppliers.
• Business partners.
• Employees.
• Authorized users.
• Other third parties the customer records in TiosCRM.

TiosCRM processes the customer's transferred data only to:

• Provide the TiosCRM service.
• Keep customer-management records.
• Run sales pipeline processes.
• Manage tasks, quotes, notes and follow-ups.
• Provide reporting features.
• Give authorized users access to data.
• Provide technical support.
• Ensure system security.
• Provide backup and continuity.
• Detect and fix errors.
• Meet legal obligations.

TiosCRM processes customer data only in line with instructions given via the agreement, panel use, support requests or written notice.

The customer agrees not to transfer unlawful, unauthorized data or data lacking the required legal basis.

The customer is responsible for fulfilling disclosure obligations and providing the required legal basis for transferred data.

• TiosCRM processes customer data only to the extent needed to provide the service.
• TiosCRM does not use customer data for its own purposes.
• TiosCRM does not share customer data with unauthorized third parties.
• TiosCRM limits access to authorized persons who need it for their role.
• TiosCRM takes reasonable technical and administrative security measures.
• TiosCRM binds employees, providers and authorized persons with confidentiality obligations.

The customer confirms that personal data transferred to TiosCRM was obtained lawfully.

The customer is responsible for informing data subjects and, where required, obtaining explicit consent or another legal basis.

The customer may not use TiosCRM for unlawful marketing, spam, unsolicited communication or infringing third-party rights.

The customer is responsible for correctly defining user permissions, disabling unnecessary access and ensuring account security.

TiosCRM may use sub-processors such as hosting, cloud infrastructure, email, SMS, payment, security, backup, error tracking, analytics or technical support providers.

TiosCRM limits sub-processors' access to what the service requires and takes care to have suitable agreements covering security and confidentiality.

The customer accepts that TiosCRM may use reasonable sub-processors to provide the service. TiosCRM may inform the customer of significant changes by appropriate means.

TiosCRM may apply the following measures to protect customer data:

• Authorization and role-based access control.
• Strong password policies.
• Encryption and secure communication protocols.
• Logging.
• Backup processes.
• Firewall and intrusion prevention.
• Server and application security controls.
• Limiting unauthorized access.
• Limiting employee access to need-to-know.
• Confidentiality obligations.
• Security updates and maintenance.

These measures may vary by the nature of the service, the plan, technical means and risk level.

If TiosCRM detects a suspected data breach (unlawful access, disclosure, loss, alteration or unauthorized acquisition of customer data), it makes reasonable efforts to notify the customer without delay.

The notice provides, as far as possible, the nature of the breach, affected data categories, measures taken or proposed, and a contact point.

As data controller, the customer is responsible for notifications to data subjects or authorities. TiosCRM tries to provide reasonable technical support in this process.

If a data subject request about customer data reaches TiosCRM directly, TiosCRM may forward it to the customer where possible.

TiosCRM is not obliged to resolve a data subject request on the customer's behalf without the customer's instruction.

The customer is responsible for evaluating and answering data subject requests in line with the law. TiosCRM may provide reasonable support within technical means.

While the subscription continues, the customer may export or delete data via the panel.

When the subscription ends, TiosCRM may keep customer data for a reasonable period. After this, data may be deleted, anonymized or permanently removed within the backup cycle.

The customer is responsible for exporting needed data before the subscription ends. TiosCRM may assist with export within technical means.

TiosCRM may take backups for system security and service continuity.

Data in backups may be kept for a period after deletion from active systems.

Backup data is not used beyond security, recovery and continuity purposes.

The customer may submit reasonable written requests about TiosCRM's processing activities.

TiosCRM may provide reasonable information without endangering trade secrets, other customers' information, security architecture or system integrity.

On-site audit requests are subject to written agreement, reasonable prior notice and TiosCRM's security rules. Audit costs are borne by the customer unless otherwise agreed.

TiosCRM may use infrastructure, hosting, email, analytics, error-tracking or support providers located abroad.

Where transfer abroad is required, TiosCRM takes care to act in line with applicable law.

For transferred data, the customer is responsible for providing the required disclosure, permission and legal conditions for transfer abroad.

TiosCRM is not designed to process special categories of personal data.

The customer should not transfer health data, biometric data, criminal-conviction data, union membership, religion, sect, political opinion or similar special-category data to TiosCRM.

If the customer transfers such data, all related legal responsibility rests with the customer.

TiosCRM processes customer data in line with this addendum, the terms of use and the customer's instructions.

The customer is responsible for damage arising from unlawful data collection, unsolicited communication, incorrect authorization, failure to protect accounts or use of TiosCRM contrary to the agreement.

TiosCRM's liability is assessed within the limits set out in the terms of use.

If there is a conflict between this Data Processing Addendum and the Terms of Use regarding personal data processing, this addendum's provisions prevail for the processing of customer data.

This Data Processing Addendum takes effect when the customer starts using the TiosCRM service.

By transferring data to TiosCRM, the customer is deemed to accept this addendum.