GDPR & Data Processing
Last updated: 20 August 2026
In short: oCRM is operated by an EU company, your data is hosted in the European Union, every customer workspace has its own isolated database, and we act as your data processor under art. 28 GDPR for the personal data you store in the platform. You can export everything, at any time.
1. Roles under the GDPR
When you store personal data about your own clients, contacts and leads in your oCRM workspace, you are the data controller and Addo Vision Solutions SRL is your data processor. This page sets out the data processing terms that form part of our Terms & Conditions for all customers. For data about you as our customer (account, billing), we are the controller — see the Privacy Policy.
2. Our commitments as processor (art. 28 GDPR)
- We process Customer Data only to provide the Service and on your documented instructions given through the platform.
- Persons authorised to process data are bound by confidentiality.
- We implement appropriate technical and organisational security measures (Section 4).
- We engage sub-processors only under equivalent data protection obligations (Section 3) and will inform customers of intended changes, giving the opportunity to object.
- We assist you, insofar as possible, in responding to data subject requests and in meeting your obligations on security, breach notification and impact assessments.
- We notify you without undue delay after becoming aware of a personal data breach affecting your workspace.
- On termination, we delete or return Customer Data (Section 5).
- We make available the information necessary to demonstrate compliance and allow audits within reasonable limits.
3. Sub-processors
| Sub-processor | Purpose | Location / transfer safeguard |
|---|---|---|
| Hosting provider | Infrastructure, databases, backups | European Union |
| Stripe | Subscription payments | EU/US — Standard Contractual Clauses / EU-US DPF |
| Meta Platforms (WhatsApp Business) | WhatsApp messaging (only if you enable it) | EU/US — Standard Contractual Clauses / EU-US DPF |
| OpenAI | AI assistant (only if you use it) | US — Standard Contractual Clauses / EU-US DPF |
| Google (reCAPTCHA) | Bot protection on authentication pages | EU/US — Standard Contractual Clauses / EU-US DPF |
4. Security measures
- Tenant isolation: each customer workspace runs on its own separate database — no shared tables between customers.
- Encryption in transit: all connections use HTTPS/TLS.
- Access control: role-based permissions in the platform; administrative access restricted and logged.
- Backups: regular automated backups, stored in the EU.
- Monitoring: security logging and abuse prevention (including bot protection on authentication).
5. Data export, retention and deletion
You can export your data from the platform at any time. After the end of your subscription, the workspace and its database are retained for 30 days (during which you may request a final export), then permanently deleted, including from rotating backups within the backup cycle. Records we are legally required to keep (e.g. issued invoices) are retained per fiscal law.
6. Data subject requests
If a person whose data you store in oCRM contacts us directly, we will redirect them to you as controller and, where possible, assist you with the tools needed to respond (search, export, rectification, deletion within your workspace).
7. Contact
For GDPR matters, data processing questions or to request a countersigned data processing agreement: contact@ocrm.app.
Supervisory authority in Romania: ANSPDCP — National Supervisory Authority for Personal Data Processing.