Data-processing agreement for Giver CRM
giver-crm-20261012-v1
Parties and instructions
The company identified at registration is the controller; Giver is its processor. The authorised representative accepts this agreement for the company. The subject is hosting and operating the company’s CRM throughout its use. Processing covers storage, organisation, retrieval, modification, export and instructed deletion of business contact details, sales activities and uploaded files concerning contacts, prospects, customers and company users. Special-category data is outside the agreed scope.
Documented instructions
Giver processes CRM contents only on the company’s documented instructions, including these terms and authenticated actions by its authorised users, unless Union or Member State law requires otherwise. Giver informs the company of a required legal processing duty where permitted and warns it if an instruction appears to infringe data-protection law. Instructions and support requests may be sent to mmusiol@ongiver.com.
Confidentiality and security
Persons authorised to process data must be bound by confidentiality. Controls include separate company databases and private files, native role and session checks, single-use expiring email links, HTTPS, certificate-verified email transport, restricted internal service networks, malware checks before storing uploads, encrypted database tables and complete encrypted backups. Server administration is restricted to the operator. Backup restoration is tested with synthetic data. There is no claim of complete host-loss recovery, external penetration testing or immutable accounting archiving.
Subprocessors
Your company gives general written authorisation for IONOS hosting and Resend transactional access-email delivery. Their respective processing contracts and appropriate transfer safeguards apply. Giver informs your company by email at least 14 days before adding or replacing a subprocessor for this service; you may object for substantiated data-protection reasons. Giver remains responsible for its subprocessor obligations. No contact-content transmission to an AI, payment or benefit provider is included.
Assistance and incidents
Considering the processing and available information, Giver assists the company with data-subject rights, security, breach notifications, impact assessments and supervisory consultations. Giver notifies the company without undue delay after becoming aware of a personal-data breach, shares available scope and mitigation information, and supplements it as facts become known. The company remains responsible for its statutory notifications.
Return, deletion and evidence
After the service ends, your company chooses a data return and/or deletion within 30 days. Giver deletes remaining processor copies, including affected backup copies, except specific records whose retention is legally required. Giver makes information necessary to demonstrate compliance available and permits proportionate audits, including inspections by your company or its mandated auditor, subject to protection of other customers and reasonable coordination. Technical export format and operational arrangements are agreed through support; no automatic deletion of existing Benefits data is involved.
Transfers and responsibility
Processing and subprocessors must comply with Chapter V GDPR for any transfer outside the EEA. Giver maintains the agreed safeguards and informs the company of relevant changes. Your company determines the legal basis, accuracy and required notices for its contacts. This agreement does not appoint a data-protection officer or transfer your company’s controller duties to Giver.
Version and provider
giver-crm-20261012-v1. Giver, Maximilian Matthias Musiol, Ickstattstraße 26, 80469 München, Deutschland. mmusiol@ongiver.com
Resend Data Processing Agreement · Resend Subprocessors · IONOS