This page summarises the processor terms Sales Surge applies. A binding Data Processing Agreement is concluded in writing between Sales-Surge B.V. and the client; to execute one, contact info@sales-surge.nl.
1. Roles
Where Surge Adopt processes personal data on behalf of a client, the client is controller and Sales-Surge B.V. is processor (Art. 28 GDPR). Where Sales Surge processes its own data, Sales Surge is controller.
2. Subject matter and duration
Processing of CRM personal data for the purpose of driving Pipedrive adoption from within Pipedrive, for the duration of the client relationship and use of Surge Adopt.
3. Categories of data and data subjects
Contact and organisation data (names, business email addresses, phone numbers, job titles, notes, activities) relating to the client's contacts, prospects and customers.
4. Instructions
Sales Surge processes personal data only on the documented instructions of the controller, unless required by EU or Dutch law.
5. Confidentiality
Persons authorised to process the data are bound by confidentiality.
6. Security (Art. 32)
TLS in transit, encryption at rest, role-based access and row-level security, MFA on administrative access, logging and incident response.
7. Sub-processors
The controller gives general authorisation for Sales Surge to engage sub-processors, including Lovable Cloud (Supabase) for hosting and the Pipedrive API for CRM operations. Sales Surge notifies the controller of intended changes; the controller may object on reasonable grounds within 14 days. Sub-processors are bound by equivalent Article 28 terms.
8. International transfers
Any transfer outside the EEA relies on adequacy decisions (incl. the EU-US Data Privacy Framework) and the EU Standard Contractual Clauses (2021/914).
9. Assistance
Sales Surge assists the controller, taking into account the nature of processing, with data subject requests and obligations under Articles 32–36 GDPR.
10. Breach notification
Sales Surge notifies the controller without undue delay and within 48 hours of becoming aware of a personal-data breach.
11. Deletion or return
On termination, Sales Surge deletes or returns the personal data at the controller's choice, unless retention is required by law.
12. Audit
Sales Surge makes available the information necessary to demonstrate compliance and allows for audits on reasonable notice.
Concluding a signed DPA
To conclude a signed DPA, contact info@sales-surge.nl. Full terms: https://www.sales-surge.io/terms/.