Data Processing Agreement

This agreement (the “DPA”) forms part of the Terms of Service and is entered into between the company using the CRM (the “Controller”) and Intrawebix SRL, company ID 1025600049858 (the “Processor”, “we”). It applies to the processing of personal data that the Controller enters into the CRM.

1. Roles of the parties

The Controller determines the purposes and means of processing the data of its customers and partners. We process that data only on the Controller’s instructions, in order to provide the Service. User account data (name, email, sign-in logs) is processed by us as a controller, as described in the Privacy Policy.

2. Subject matter, duration, nature and purpose

We process the data for the duration of the subscription plus the deletion period below. Nature of processing: storage, organisation, consultation, transmission to the services connected by the Controller, and erasure, through the CRM’s features (contacts, deals, activities, emails, conversations, files, reports, automations).

3. Categories of data and data subjects

4. Controller instructions

The documented instructions are the Terms, this DPA and the actions taken by the Controller’s users in the application and through the API. We do not use the Controller’s data for our own purposes, do not sell it and do not train models on it. If a legal obligation requires other processing, we inform the Controller beforehand where the law allows.

5. Confidentiality

Only members of our team who need it for administration and support have access to the Controller’s data, and they are bound by confidentiality. Support access to a company’s account is granted by that company, is time-limited, read-only and logged.

6. Security measures

Database-level isolation of data between companies (Row-Level Security); encrypted connections (HTTPS) and security headers; irreversibly hashed passwords; encryption of integration credentials; available two-step verification; limits on sign-in attempts and bot protection of public forms; a log of actions on records; server access only through a private network, with keys and no passwords; automatic security updates; daily backups outside the data centre and a database replica for disaster recovery.

7. Sub-processors

The Controller authorizes the use of the following sub-processors:

We notify the Controller before adding or replacing a sub-processor; if it objects, it may end the subscription. Each sub-processor is bound by data protection obligations at least equivalent to those in this agreement.

8. International transfers

Data is processed in the European Union (Germany); backups, the replica and administration of the Service take place in the Republic of Moldova. For Controllers in the European Union, the European Economic Area or the United Kingdom, transfers to the Republic of Moldova rely on the European Commission’s standard contractual clauses (Decision 2021/914, Module Two: controller to processor), which are deemed entered into together with this agreement, along with the UK addendum where applicable. Cloudflare and Paddle also process data outside the EU (United States, United Kingdom), under adequacy decisions (including the EU–US Data Privacy Framework) or standard contractual clauses. A transfer impact assessment is available on request. For Controllers in the Republic of Moldova, this agreement is the contract with the processor required by Law no. 195/2024.

9. Assistance to the Controller

Within the limits of our technical role, we help the Controller to: answer data subject requests (access, rectification, erasure, portability — including through the full export in the application), carry out impact assessments and consultations with the authority, and keep the processing secure. If a data subject contacts us directly, we refer them to the Controller.

10. Security incidents

We notify the Controller without undue delay and within 48 hours at the latest of becoming aware of an incident affecting its data, with the information available to us, and we assist with notifying the authority and the data subjects.

11. Deletion and return of data

The Controller can export its data from the application at any time (CSV and files). When the subscription ends or the account is closed, data is permanently deleted from the application within 30 days, and from backups within at most another 30 days, through their normal rotation, except for data we are required by law to keep.

12. Audits

We provide the Controller with the information needed to demonstrate compliance with these obligations and accept audits, no more than once a year, with 30 days’ notice, at the Controller’s expense and without access to other companies’ data.

13. Liability and governing law

The liability limits in the Terms apply. This agreement is governed by the laws of the Republic of Moldova; for transfers from the EU / EEA / UK, the standard contractual clauses prevail in case of conflict.

To sign a copy of this agreement or to request security documentation: [email protected].

Last updated: 01.10.2026 (version 1)