Privacy policy

Version 2026-08-13

This policy applies to Virtual Marketer CRM at crm.virtual-marketer.de. For the rest of SGS Virtual Marketer GmbH's online offering, the general privacy policy applies.

1. Controller

SGS Virtual Marketer GmbH, Frankfurter Landstraße 50, 61352 Bad Homburg vor der Höhe, Germany.
Email: info@virtual-marketer.de · Telephone: +49 178 4556659

Full details in the legal notice.

2. Two roles, two legal bases

This service requires a clean separation of whose data is being processed.

We are the controller for the data of the people who use the CRM — accounts, sign-ins, logs and billing. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

We are a processor for the content you process in the CRM — your contacts, organizations, deals, tasks, projects, messages and attachments. For that content, you are the controller. The basis is the data processing agreement under Art. 28 GDPR. We process this content solely on your instructions and never for our own purposes.

3. What data is processed

Account and sign-in. Sign-in is exclusively through your Virtual Marketer account (single sign-on). The CRM receives a persistent identifier, your email address, your name and your organization and role assignment. We store no password for the CRM — none exists there. For the account itself, see the general privacy policy.

Usage data. Sessions, timestamps and change records (audit log). The audit log records who changed which record and when; it exists for accountability and security.

Server logs. IP address, timestamp, requested resource, status code and user agent. This is technically necessary for operation (Art. 6(1)(f) GDPR).

Content you enter. CRM records and, if you connect a mailbox, emails, messages, attachments and the associated metadata. For this we act as a processor (section 2).

4. Connected mailboxes and messengers

When you connect a mailbox, the CRM retrieves messages and stores them in its database so they can be matched to contacts and searched. Credentials and OAuth tokens are stored encrypted (AES-256-GCM), and the key is held separately from the database.

An important point: a mailbox also contains data about people who are not your customers. You are the controller for that processing. Check that you have a legal basis before connecting.

The connection runs directly between our server and your provider (IMAP/SMTP, Google or Microsoft). No intermediary service is involved. For WhatsApp: the official Cloud API involves Meta, a self-hosted instance does not.

You can disconnect a mailbox at any time. Messages already imported remain as CRM content until you delete them.

5. Where data is held, and who processes it on our behalf

Operation and storage take place on servers of STRATO AG, Berlin, in Germany. Further processors and their purposes are listed under subprocessors.

No transfer to a third country takes place for CRM content unless you connect a service operated outside the EU — a decision you make yourself when connecting a mailbox or messenger.

6. Retention and deletion

We store CRM content for the duration of your contract and delete it thereafter in accordance with the data processing agreement. Server logs are deleted after 30 days at the latest. Audit log entries follow the lifetime of the organization they belong to. Statutory retention obligations remain unaffected.

Deleting an organization irreversibly deletes all records belonging to it.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to lodge a complaint with a supervisory authority. Ours is the Hessian Commissioner for Data Protection and Freedom of Information.

If your request concerns content that one of our customers processes in the CRM, please address it to that customer — responsibility lies there. We support our customers in responding.

8. No tracking cookies

The CRM sets only the technically necessary cookies for signing in. There is no analytics, no tracking and no disclosure for advertising purposes.

9. Changes

We update this policy when the service changes. The applicable version is marked with a version number; for material changes we inform signed-in users within the service.