Data processing agreement

Version 2026-08-13

This agreement under Art. 28 GDPR forms part of the terms of use and applies between the customer (controller) and SGS Virtual Marketer GmbH (processor), Frankfurter Landstraße 50, 61352 Bad Homburg vor der Höhe.

1. Subject matter and duration

The subject matter is the processing of personal data that the customer enters into Virtual Marketer CRM or that the service retrieves on their behalf. Processing continues for as long as the service contract is in force.

2. Nature, purpose and scope

We process the data solely to deliver the service: storing, organizing, searching, evaluating and displaying CRM records, retrieving and sending messages through connected accounts, and backing up and restoring data.

There is no use for our own purposes. In particular, customer data is not used to train models.

3. Categories of data subjects and data

Data subjects: the customer's staff and users, their customers, prospects and contact persons, and people who correspond with the customer through a connected account.

Categories of data: master data, contact data, communication content including attachments, contract and transaction data, appointment and task data, usage and log data.

Special categories under Art. 9 GDPR are not part of the service. If the customer nonetheless enters such data, we process it with the same measures; the customer is responsible for its admissibility.

4. Instructions

We process the data only on documented instructions from the customer. Use of the service within its features, and the settings the customer configures, constitute such instructions. If we consider an instruction to infringe applicable law, we will say so and may suspend execution.

5. Confidentiality

All persons authorized to process the data are bound to confidentiality. Access is limited to those who need it to deliver the service.

6. Technical and organizational measures (Art. 32 GDPR)

• Transport encryption (TLS) for all connections; the application is reachable over HTTPS only.
• Credentials for connected mailboxes and OAuth tokens are stored encrypted with AES-256-GCM, with the key held separately from the database.
• Tenant separation is enforced not only in application logic but additionally in the database layer: queries without a valid tenant context are rejected.
• Sign-in exclusively via single sign-on with mandatory two-factor authentication; no passwords are stored in the service.
• Role and permission based access control per organization.
• Change record (audit log) covering processed records.
• Regular backups, with restores tested.
• Operation in a data centre in Germany (see subprocessors).

7. Subprocessors

The customer consents to the engagement of the providers listed under subprocessors. We announce intended changes 30 days in advance. The customer may object within that period for good cause; if no agreement is reached, they may terminate the contract with effect from the date of the change.

Further providers are engaged only if the customer connects the relevant feature themselves.

8. Assistance to the controller

We assist the customer in responding to data subject requests, in data protection impact assessments and with notification obligations. Requests from data subjects that reach us directly are forwarded to the customer and not answered by us.

We notify the customer of any personal data breach without undue delay, and no later than 48 hours after becoming aware of it.

9. Evidence and audits

We provide the customer with the information necessary to demonstrate compliance and allow for audits. On-site audits are permitted with reasonable notice, during business hours, and without disrupting operations.

10. Deletion after the contract ends

After the contract ends we delete the data within 30 days unless the customer requests its return beforehand. Backups are overwritten within the regular backup cycle, and after 90 days at the latest. Statutory retention obligations remain unaffected.

11. Third-country transfers

No third-country transfer takes place for base operation. If the customer connects an account with a provider that processes outside the EU, the transfer takes place on the basis of that provider's standard contractual clauses; the customer makes that decision by connecting.