Data Processing Addendum

This addendum forms part of the Terms of Service and governs our processing of personal data on your behalf. Anyone with European or UK contacts in their CRM needs a signed one under Article 28 GDPR; it is usually the first document a buyer's counsel asks for, which is why it is published rather than kept in a drawer.

You are the controller; we are the processor. You decide what goes into the CRM and why. We hold it and act on your instructions.

Subject matter: providing the CRM platform and its AI analysis. Duration: for as long as your subscription lasts, plus the deletion window in section 8.

Categories of data subject: your leads, customers, and your own staff.

Categories of personal data: names, phone numbers, email addresses, company details, correspondence, notes made by your staff, call recordings and their transcripts, and whatever else you choose to record in custom fields.

Special categories: not requested, and the product is not designed for them. If you put health, biometric or similar data into free-text fields you do so on your own assessment, and you must tell us first if that is your intention.

We process personal data only on your documented instructions, of which using the product is one, and to the extent the law requires otherwise — in which case we tell you first unless prohibited from doing so. We do not use your data to train general-purpose models, ours or anyone else's.

Everyone with access is bound by confidentiality obligations, and access is granted on a need-to-know basis for a specific reason — a support request, an incident — rather than standing by default.

We keep appropriate technical and organisational measures, described in full on the Security page. The one worth naming here: each customer's data lives in its own database, so a query written for one customer cannot return another's rows even if someone gets it wrong.

You give general authorisation for the subprocessors listed on the Subprocessors page. We will give at least 30 days' notice before adding one, and you may object on reasonable data-protection grounds — if we cannot resolve it, you may terminate the affected part of the service without penalty. Each subprocessor is bound by terms no less protective than these, and we remain liable for what they do.

Data subject requests. The product lets you find, export, correct and delete records yourself. Where that is not enough, we help — at no charge for a reasonable volume.

Breach notification. If we become aware of a personal data breach affecting your data, we will tell you without undue delay and within 72 hours, with what we know, what we are doing, and what we recommend you do. A first notice will often be incomplete; we would rather tell you early than tell you a full story late.

Assessments and audits. We will provide the information you reasonably need for a DPIA, and answer a security questionnaire once a year. Where an on-site audit is required by law, it is at your cost and on reasonable notice.

You can export your data at any time while the account is open, and for 30 days after it closes. After that we delete it from live systems; backups age out within [BACKUP RETENTION — to be confirmed] days, and remain protected by this addendum until they do.

Where personal data leaves your jurisdiction it is transferred under Standard Contractual Clauses or an equivalent mechanism, together with the additional measures those clauses require. The Subprocessors page names the location of each one.

Accepting the Terms of Service accepts this addendum. If your procurement process needs a countersigned copy on paper, write to admin@larscrm.com and we will send one.

[DOWNLOADABLE PDF — to be produced once the text is settled by counsel.]