Data Processing Agreement (DPA)

Effective Date: 05 August 2026
Last Updated: 05 August 2026

This Data Processing Agreement ("DPA") forms part of the agreement between PieSetu CRM ("Processor", "we", "our", or "us") and the Customer ("Controller", "you", or "your") regarding the processing of Personal Data in connection with the use of PieSetu CRM. This DPA is intended to satisfy the requirements of Article 28 of the General Data Protection Regulation (GDPR) and other applicable privacy laws.

1. Definitions

For the purposes of this Agreement:

• Controller means the customer who determines the purpose and means of processing personal data.
• Processor means PieSetu CRM processing data on behalf of the Controller.
• Personal Data means any information relating to an identified or identifiable individual.
• Processing means any operation performed on personal data including collection, storage, use, disclosure, deletion or transfer.
• GDPR means the General Data Protection Regulation (EU) 2016/679.

2. Scope of Processing

PieSetu CRM processes customer data solely for providing CRM software services including:

• Lead Management
• Customer Management
• Sales Pipeline
• Contact Management
• Task Management
• Invoices
• Quotations
• Reports
• Marketing Automation
• AI Features (if enabled)

3. Nature of Data Processed

Depending upon your usage, PieSetu CRM may process:

• Names
• Email Addresses
• Phone Numbers
• Company Information
• Business Addresses
• Customer Records
• Lead Information
• Sales Activities
• Uploaded Documents
• Notes and Communications

4. Purpose of Processing

Personal Data is processed only for providing the CRM services requested by the Customer. PieSetu CRM does not use Customer Data for advertising, resale, or marketing to third parties.

5. Customer Responsibilities

• Ensure lawful collection of personal data.
• Obtain all necessary user consents.
• Provide accurate information.
• Comply with GDPR and applicable privacy laws.
• Respond to Data Subject Requests.

6. PieSetu CRM Responsibilities

• Process Personal Data only on documented instructions.
• Maintain confidentiality.
• Protect data using appropriate technical and organizational measures.
• Notify Customers of data breaches where legally required.
• Assist Customers with GDPR obligations where applicable.

7. Security Measures

PieSetu CRM maintains commercially reasonable security controls including:

• SSL/TLS Encryption
• Password Hashing
• Role-Based Access Control (RBAC)
• Server Firewalls
• Database Backups
• Security Monitoring
• Access Logging
• Secure Authentication
• Infrastructure Monitoring
• Regular Security Updates

8. Confidentiality

All personnel authorized to process Personal Data are bound by confidentiality obligations.

9. Sub-processors

PieSetu CRM may engage trusted sub-processors for hosting, email delivery, payment processing, AI services, analytics, cloud infrastructure, and communication services. Each sub-processor is contractually required to maintain appropriate security and confidentiality standards.

10. International Data Transfers

Where Personal Data is transferred internationally, PieSetu CRM will implement appropriate safeguards in accordance with applicable data protection laws.

11. Data Subject Rights

Upon Customer request, PieSetu CRM will reasonably assist in responding to:

• Access Requests
• Correction Requests
• Deletion Requests
• Restriction Requests
• Portability Requests
• Objection Requests

12. Data Breach Notification

PieSetu CRM maintains incident response procedures and will notify affected Customers without undue delay after becoming aware of a confirmed Personal Data Breach where notification is legally required.

13. Data Retention & Deletion

Upon termination of services, Customer Data will be retained only as necessary for legal, contractual, or regulatory obligations. After the retention period, data will be securely deleted or anonymized.

14. Audit Rights

Where required by law or contract, PieSetu CRM may provide reasonable information demonstrating compliance with this DPA, subject to confidentiality obligations and reasonable notice.

15. Limitation of Liability

The liability of each party under this DPA shall be subject to the limitations set forth in the applicable service agreement unless prohibited by law.

16. Governing Law

This Agreement shall be governed by the laws applicable under the primary service agreement unless otherwise required by applicable data protection legislation.

17. Changes to this DPA

PieSetu CRM reserves the right to update this DPA to reflect legal, technical, or operational changes. Updated versions will be published on this page.

18. Contact Information

19. Acceptance

By using PieSetu CRM, the Customer acknowledges and agrees to this Data Processing Agreement.