Compliance: GDPR, NIS2 and KRITIS

GDPR

• For the data processed on the customer's behalf we are a processor under Art. 28 GDPR and conclude a data processing agreement.
• Processing on servers in Germany, backups in the EU. The only transfer to a third country: e-mail delivery via SendGrid (USA) on the basis of the EU Standard Contractual Clauses.
• Data minimisation: contact data from the CRM systems is not stored, phone numbers in logs only pseudonymised, retention adjustable per customer.
• Our measures under Art. 32 GDPR are in the Trust Center under "Security (TOMs)".

NIS2

The NIS2 Directive (EU) 2022/2555 and its national implementations oblige entities in certain sectors above certain sizes to manage risks and report incidents. One of these duties is supply chain security (Art. 21(2)(d)): affected customers must assess their service providers.

For this assessment we provide:

• the description of our measures (Security/TOMs), among others on encryption, access control with a second factor, backup and recovery, secure development and incident handling,
• the list of our processors with their location of processing,
• information without undue delay about security incidents affecting your data, so you can meet your own reporting deadlines.

KRITIS (German critical infrastructure)

CRM Proxy is not critical infrastructure under the German BSI-Kritisverordnung. Operators of critical infrastructure who use CRM Proxy can use our documents to assess their service providers. Telephony itself stays with the customer's 3CX system: if CRM Proxy is unavailable, the phone system keeps working, only without contact display and call journaling.

Requests

Data processing agreement, supplier assessment questionnaires and other questions: via the contact address in the legal notice.