Data processing agreement (DPA) under Art. 28 GDPR

1. Subject matter and duration

• Subject matter is the processing of personal data by CRM Proxy on behalf of the Customer when providing the CRM Proxy service: connecting the Customer's 3CX phone system with their CRM, help desk and ERP systems for contact display, contact lookup, and call and chat journaling.
• This agreement applies for the term of the main contract and beyond, as long as CRM Proxy processes the Customer's data.

2. Nature and purpose of processing

• On a call or chat, CRM Proxy looks up the contact in the systems the Customer connected and returns the result to 3CX.
• After the call or chat, CRM Proxy writes an entry (note, activity, ticket) into the respective system if the Customer configured it.
• CRM Proxy synchronises the 3CX phone book (users, extensions, departments) to assign calls to people and departments.
• CRM Proxy keeps logs of lookups and entries for operation, troubleshooting and proof, and usage counters for quotas.

3. Types of data

• Call data: phone numbers, extensions, times, duration, direction, outcome, call path, department.
• Contact data from the Customer's systems (name, company, phone numbers, e-mail addresses, link to the record) – only during processing, not stored in CRM Proxy's database; some connectors keep a phone index in memory for up to 6 hours.
• Content the Customer has journaled: chat transcripts and, if enabled, the summary or transcript of a call created by 3CX.
• 3CX phone book: name, extension, e-mail address, department.
• Credentials for the Customer's phone system and systems (API keys, tokens).
• The Customer's user accounts in CRM Proxy: name, e-mail address, role, sign-in data.

4. Categories of data subjects

• Employees and agents of the Customer (users of 3CX and CRM Proxy).
• Callers, chat partners and contacts of the Customer (customers, prospects, suppliers and other contacts).

5. Instructions

• CRM Proxy processes the data only on documented instructions of the Customer, including transfers to third countries, unless required to do otherwise by law; in that case CRM Proxy informs the Customer beforehand where the law permits.
• Instructions are this agreement, the main contract and the settings the Customer makes in the customer area (connected systems, routes, journaling rules, retention). Further instructions are given in text form.
• If CRM Proxy considers an instruction unlawful, it informs the Customer without undue delay and may suspend it until confirmed.

6. Confidentiality

CRM Proxy only uses persons who are committed to confidentiality or under a statutory obligation of secrecy, and gives them access only as far as their task requires.

7. Security of processing

CRM Proxy takes the technical and organisational measures under Art. 32 GDPR described in Annex 1. CRM Proxy may develop them further as long as the level of protection does not decrease; material changes are documented.

8. Subprocessors

• The Customer grants general authorisation to engage subprocessors. Those engaged at signing are listed in Annex 2 and are deemed approved.
• CRM Proxy informs the Customer in advance of any new or replaced subprocessor. The Customer may object within 30 days for an important data protection reason; if the parties find no solution, the Customer may terminate the affected service.
• CRM Proxy imposes the same data protection obligations on each subprocessor by contract and remains liable to the Customer for their performance.
• Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of the EU Standard Contractual Clauses.

9. Data subject rights

CRM Proxy assists the Customer with appropriate measures in responding to requests from data subjects (Art. 15 to 22 GDPR). If a data subject contacts CRM Proxy directly, CRM Proxy forwards the request to the Customer without undue delay.

10. Assistance and breach notification

• CRM Proxy assists the Customer with its obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the information available.
• CRM Proxy notifies the Customer of a personal data breach without undue delay after becoming aware of it, with the information under Art. 33(3) GDPR as far as available, and supplements it on an ongoing basis.

11. Deletion and return

• At the end of the contract CRM Proxy deletes all of the Customer's data unless a statutory retention obligation applies. The Customer's data key is destroyed, so the data can no longer be read in backups either. Backups are overwritten after 30 days at the latest, and a restore does not bring deleted customers back.
• Before deletion CRM Proxy provides the existing log data in a common machine-readable format on request. Contact data and entries in the Customer's systems remain there.
• During the term the Customer sets the log retention itself (1 to 3650 days, default 30 days).

12. Proof and audits

• CRM Proxy makes available all information necessary to demonstrate compliance with this agreement, in particular the documents in the Trust Center.
• The Customer or an auditor appointed by it and bound to confidentiality may carry out audits. Primarily by information and documents; on-site audits after notice with reasonable lead time, during business hours and without disrupting operations. Data centres of subprocessors are audited through their certifications and reports.

13. Partners

If a partner (reseller) concludes the main contract for its customers, the partner is the processor towards its customers and CRM Proxy its subprocessor; this agreement then applies accordingly between the partner and CRM Proxy.

14. Final provisions

• Liability follows Art. 82 GDPR and the main contract.
• Changes require text form. If a provision is invalid, the rest of the agreement remains valid.
• German law applies.

Annexes

• Annex 1: Technical and organisational measures – Trust Center, "Security (TOMs)" (crm-proxy.com/trust/security).
• Annex 2: Subprocessors – Trust Center, "Subprocessors" (crm-proxy.com/trust/subprocessors).