DPA

Data Processing Agreement (DPA) — Pomio CRM (English)

Processor: S. Simon Communication, trading as Pomio CRM (“Pomio”).

Pomio CRM is a trading name of S. Simon Communication, the legal provider of the Pomio CRM service.

Version: pomio-dpa@2026-11-04-draft
Language: English

1. Parties and scope

1.1 This Data Processing Agreement (“DPA”) is entered into between the customer that has concluded a Subscription or Trial for Pomio CRM (the “Customer”, acting as controller) and S. Simon Communication, trading as Pomio CRM (“Pomio”, acting as processor). Pomio is registered in the Trade Register of the Dutch Chamber of Commerce (KvK) under number 62685252, has VAT identification number NL002218668B93 and is established at Pier Christiaanswei 11A, 8508 SB Delfstrahuizen, the Netherlands.

1.2 This DPA forms part of the Pomio CRM Terms of Service / Subscription Terms (the “Terms”) and applies to all processing of personal data that Pomio carries out on behalf of the Customer when providing the Pomio CRM service (the “Service”).

1.3 This DPA does not apply to personal data that Pomio processes as controller for its own purposes, such as the marketing website, trial, demo and contact intake, account administration, billing and invoicing, and product support (except Customer Personal Data shared in support requests; see Annex C). That processing is described in the Privacy Policy.

1.4 This DPA is intended to meet the requirements of Article 28(3) of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).

2. Definitions

2.1 Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given to them in the GDPR. Capitalised terms not defined in this DPA have the meaning given to them in the Terms.

Customer Personal Data: personal data contained in the Customer Data that Pomio processes on behalf of the Customer under the Terms and this DPA.
Sub-processor: a third party engaged by Pomio that processes Customer Personal Data on behalf of the Customer.
Applicable Data Protection Law: the GDPR, the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and other data protection legislation of the European Union or its Member States that applies to the processing.

3. Subject matter, nature, purpose and duration

3.1 The subject matter of the processing is the provision of the Service: a multi-tenant SaaS Customer Relationship Management (CRM) application for leads, companies, contacts and pipeline.

3.2 The nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex A.

3.3 The processing lasts for the term of the Subscription or Trial and thereafter for as long as Pomio still holds Customer Personal Data in accordance with Article 13 of this DPA.

4. Roles of the parties

4.1 For Customer Personal Data, the Customer is the controller and Pomio is the processor. The Customer determines the purposes and means of the processing.

4.2 The Customer is responsible for the lawfulness of the processing, including a valid legal basis, informing data subjects and the accuracy of the personal data it enters into the Service.

4.3 Where the Customer itself acts as processor for a third party, the Customer warrants that its instructions are authorised by that controller; Pomio then acts as sub-processor of the Customer.

5. Instructions

5.1 Pomio processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless Union or Member State law to which Pomio is subject requires otherwise. In that case Pomio informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

5.2 The Terms, this DPA and the Customer’s use and configuration of the Service (including settings made by authorised users) constitute the Customer’s complete documented instructions. Additional instructions must be given in writing and must be consistent with the Terms and the functionality of the Service.

5.3 Pomio immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. Pomio may suspend execution of such an instruction until it has been confirmed or amended.

5.4 Pomio does not process Customer Personal Data for its own purposes, does not sell it and does not use it for advertising or for profiling outside the Customer’s instructions.

6. Confidentiality

6.1 Pomio ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

6.2 Access to Customer Personal Data by Pomio is limited to what is necessary to provide, secure and support the Service, or to comply with the law.

7. Security of processing

7.1 Pomio implements appropriate technical and organisational measures as referred to in Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk to the rights and freedoms of natural persons. The measures are described in Annex B.

7.2 Pomio may update the measures, provided that the overall level of security is not reduced.

7.3 The Customer is responsible for the security of its own accounts and devices, including managing users and permissions, using strong passwords and, where available, multi-factor authentication.

8. Sub-processors

8.1 The Customer grants Pomio general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex C.

8.2 Pomio informs the Customer of any intended addition or replacement of a Sub-processor at least fourteen (14) days in advance, by email and/or in the Service. If a replacement is urgently required to safeguard the security or continuity of the Service, Pomio may engage the new Sub-processor earlier; in that case Pomio informs the Customer without undue delay. The Customer may object on reasonable data protection grounds in writing within the fourteen (14) day period before the change or, in the case of an urgent replacement, within fourteen (14) days after the notification. Pomio assesses the objection and, in consultation with the Customer, seeks a reasonable solution within a reasonable period, such as an alternative or additional measures. If the parties cannot reach a solution, the Customer may terminate the affected part of the Subscription with effect from the date on which the new Sub-processor is engaged or, in the case of an urgent replacement, with immediate effect; fees already paid are not refunded, unless mandatory law requires otherwise. By way of exception, solely where the Customer has made a justified objection on data protection grounds to an added or replaced Sub-processor, Pomio does not offer an appropriate solution and the Customer terminates the affected part for that reason, Pomio refunds pro rata the amount paid in advance for the remaining prepaid period of that part, calculated from the effective date of termination.

8.3 Pomio imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures.

8.4 Pomio remains fully liable to the Customer for the performance of the obligations of its Sub-processors, within the limits of Article 14.

9. Transfers outside the EEA

9.1 Pomio transfers Customer Personal Data to a country outside the European Economic Area (EEA) only if the conditions of Chapter V GDPR are met, for example on the basis of an adequacy decision (including the EU–U.S. Data Privacy Framework for certified recipients) or the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), with supplementary measures where necessary.

9.2 The transfers known at the date of this DPA and the safeguards relied on are described in Annex D.

10. Assistance to the Customer

10.1 Data subject rights: taking into account the nature of the processing, Pomio assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects (access, rectification, erasure, restriction, data portability and objection). The Service offers functions for this, including privacy and data subject request (DSAR) functions for authorised administrators. If Pomio receives a request directly, it forwards the request to the Customer without undue delay and does not respond itself unless the Customer instructs it to.

10.2 Other obligations: taking into account the nature of the processing and the information available to Pomio, Pomio assists the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority).

10.3 Pomio may charge reasonable costs for assistance that goes beyond the standard functions of the Service, after prior notice, unless the assistance is required because of a breach of this DPA by Pomio.

11. Personal data breaches

11.1 Pomio notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and where feasible within 48 hours, so that the Customer can meet its own obligations under Articles 33 and 34 GDPR.

11.2 The notification contains, insofar as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. The initial notification may be preliminary. Information that is not yet available is provided as soon as it becomes available, without undue further delay and, where necessary, in phases.

11.3 Pomio takes reasonable measures to contain the breach and limit its consequences, and documents the breach. Notification by Pomio is not an acknowledgement of fault or liability.

11.4 The Customer, as controller, decides whether to notify the supervisory authority and data subjects.

12. Information and audits

12.1 Pomio makes available to the Customer all information necessary to demonstrate compliance with the obligations of Article 28 GDPR, such as a description of the security measures and relevant Sub-processor documentation.

12.2 (a) Regular audit: if that information is demonstrably insufficient, the Customer may have an audit carried out, at most once per calendar year, with at least thirty (30) days’ prior written notice, during business hours and without disproportionate disruption of Pomio’s operations. (b) Exceptional audit: in addition, regardless of whether the information under Article 12.1 is sufficient and without an annual limit, the Customer may have an audit carried out in the case of: (i) a personal data breach that has affected Customer Personal Data; (ii) a serious security incident that affects or may affect Customer Personal Data; (iii) a concrete indication of a breach of this DPA; or (iv) a request or order from a competent supervisory authority. For an exceptional audit, a shorter, reasonable notice period applies or, where required by law, immediate cooperation; such an audit is proportionate and, where possible, limited to the data and systems concerned. Every audit is carried out by the Customer or an independent auditor bound by confidentiality, under reasonable confidentiality and security conditions; the auditor is not given access to data of Pomio’s other customers. This Article 12 does not limit any statutory audit or inspection rights of the Customer or of supervisory authorities.

12.3 The costs of a regular audit are in principle borne by the Customer. If an audit reveals a demonstrable material failure by Pomio to comply with this DPA, Pomio bears the reasonable costs of that audit. Cost arrangements never suspend or block the cooperation required by law towards the Customer or a supervisory authority. Audits of Sub-processors take place through the audit reports and certifications that they make available.

13. Return and deletion

13.1 At the end of the Subscription, the Customer has a reasonable opportunity to export Customer Data using the export functions of the Service (Terms, Article 12.3).

13.2 After the export period and any Retention Period (Terms, Articles 4.7, 4.8 and 12.4), Pomio deletes Customer Personal Data in a controlled manner, unless Union or Member State law requires storage of the personal data or a legal hold applies.

13.3 Copies in backups are not restored for other purposes and are overwritten in the normal backup cycle (see Annex B). Until then they remain protected under this DPA.

13.4 At the Customer’s request, Pomio confirms in writing that deletion has taken place.

14. Liability

14.1 The liability of the parties under this DPA is subject to the limitations of liability in the Terms (Article 18), insofar as permitted by law.

14.2 Nothing in this DPA limits the rights of data subjects under Article 82 GDPR or liability that cannot be limited under mandatory law.

15. Term and termination

15.1 This DPA is accepted at registration in the Service, applies from the start of the Trial (and, where there is no Trial, from the start of the Subscription) and remains in force for as long as Pomio processes Customer Personal Data on behalf of the Customer.

15.2 Obligations that by their nature are intended to continue after the end of this DPA, such as confidentiality, deletion and liability, remain in force.

16. Precedence

16.1 In the event of conflict between this DPA and the Terms with regard to the processing of Customer Personal Data, this DPA prevails. Standard Contractual Clauses, where applicable, prevail over this DPA.

17. Changes and versions

17.1 Each version of this DPA has a version identifier. On acceptance, Pomio records: the version identifier, a checksum (hash) of the accepted text, the user accepting on behalf of the Customer and the time of acceptance. The website and the Service use the same version of this DPA.

17.2 Pomio may amend this DPA where this is necessary because of changes in the law, guidance from supervisory authorities or changes in the Service or Sub-processors. Material changes are announced in advance with reasonable notice. Changes cannot reduce the level of protection of Customer Personal Data required by the GDPR.

18. Governing law and disputes

18.1 This DPA is governed by Dutch law. Disputes are submitted to the competent court in accordance with Article 20 of the Terms.

18.2 This DPA is available in Dutch, English and German. In case of differences between language versions, the Dutch text prevails.

Annex A — Description of the processing

Item	Description
Categories of data subjects	The Customer’s users (employees and other persons authorised by the Customer); contact persons of the Customer’s leads, prospects, customers, suppliers and other business relations; other persons whose data the Customer enters into the Service.
Types of personal data	Identification and contact details (name, job title, company, business email address, telephone number, address details as entered by the Customer); CRM content (notes, activities, tasks, deals, pipeline and sales data, communications sent from the Service); user account data (name, email address, role and permissions, authentication data, MFA status); usage and log data (audit trail of actions, IP address and technical metadata).
Special categories of personal data	Not intended. The Customer does not enter special categories of personal data (Article 9 GDPR) or criminal-law data (Article 10 GDPR) into the Service, unless it has a lawful basis for doing so and has taken appropriate measures itself.
Nature of the processing	Collecting, recording, organising, structuring, storing, adapting, retrieving, consulting, using, disclosing by transmission (including sending email on the instructions of users), aligning, combining, restricting, erasing and destroying, in each case through the Service.
Purpose of the processing	Providing, hosting, maintaining, securing and supporting the Service for the Customer, including backups, monitoring and incident handling.
Duration and retention	For the term of the Subscription or Trial; after that, during the export period and Retention Period, followed by controlled deletion (Article 13). Backups follow the cycle in Annex B.
Frequency	Continuous, for as long as the Service is used.

Annex B — Technical and organisational measures

Tenant isolation: each customer environment (tenant) is logically separated; access rules are enforced server-side and in the database rules, not only in the user interface.
Access control: role-based permissions per tenant; the Customer’s administrators manage users and roles; a user only has access to the tenants of which they are an active member.
Authentication: individual accounts with passwords; multi-factor authentication (TOTP) is available.
Audit trail: relevant actions in the Service are logged in an audit trail per tenant.
Encryption: data in transit is encrypted with TLS; data at rest is encrypted by the hosting provider (Google Cloud) by default.
Secret management: API keys and other secrets are stored in a secret manager and are not stored in source code.
Hosting location (production environment): the primary database (Cloud Firestore) and the CRM files are stored in the europe-west4 region (Netherlands). Tenant logos are stored in the us-east1 region (United States); this storage contains no customer documents. Most application functions (Cloud Functions) run in the us-central1 region (United States), including the functions for billing, mailbox, privacy requests, trial, communications, documents, downloading CRM files, Stripe webhooks and user management; the remaining functions run in the europe-west4 region (Netherlands). The functions in us-central1 process Personal Data, including the content of CRM files when downloaded, during execution in the United States. Personal Data is therefore stored in the EU but partly processed in the United States. Authentication (Firebase Authentication) is processed in the United States. The Service is delivered via the global CDN of Firebase Hosting; system logs (Google Cloud Logging) are stored in a global location. Pomio does not offer full data storage or processing within the EU. See Annex D.
Backups and recovery: point-in-time recovery of the database for 7 days, daily backups retained for 7 days and weekly backups retained for 84 days (12 weeks). According to Google’s documentation, database backups are stored in the same region as the database (europe-west4). Deletion protection on the production database; recovery procedures have been tested.
Monitoring: log-based monitoring and alerting on errors and unusual events in the production environment.
Separated environments: development and test environments are separate from production.
Privacy functions: functions for retention policies, legal holds and data subject requests (export, rectification, erasure) for authorised administrators.
Organisational measures: confidentiality, access to production data only where necessary, changes to production only after review and approval.

Annex C — Sub-processors

Sub-processor	Service	Personal data	Location
Google (Google Cloud / Firebase), Google Cloud EMEA Limited (Ireland)	Hosting, database (Cloud Firestore), application functions, authentication, file storage, secret management, logging and monitoring	All Customer Personal Data	Storage of database, backups (per Google documentation) and CRM files: EU (europe-west4, Netherlands). Tenant logos: United States (us-east1). Application functions: mostly United States (us-central1; including billing, mailbox, privacy requests, trial, communications, documents, CRM file downloads, Stripe webhooks, user management), remainder EU (europe-west4); processing of Personal Data, including CRM file content when downloaded, in the US. Authentication: United States. Hosting: global CDN. Logging: global location. Onward transfer to Google LLC (US) as Google’s subprocessor: see Annex D.
Resend (Plus Five Five, Inc.)	Sending transactional email from the Service, including email sent by users from the CRM	Recipient email addresses, names, message content and delivery metadata	United States: storage and primary processing (including message content and delivery logs) under Resend’s terms. The sending region only determines the route through which email is sent, not where data is stored. See Annex D.
Google (Google Workspace), Google Cloud EMEA Limited (Ireland)	Pomio’s business email, including the support mailbox	Customer Personal Data shared in support correspondence, such as names, contact details and message content	On the basis of Google’s standard terms. No data region set; processing may also take place in the US and other countries (see Annex D).
Typeform SL (Barcelona, Spain)	Pomio’s support form	Customer Personal Data that users share in a support request or attachment, such as names, contact details, screenshots and message content	Stored by default in the United States (Amazon Web Services, Virginia) via Typeform’s sub-processors. See Annex D.

Not sub-processors for Customer Personal Data (Pomio acts as controller for this data, see the Privacy Policy): Stripe (payments), WeFact (invoicing), Typeform (other forms on the marketing website), Cloudflare (marketing website, DNS and the Turnstile bot check at sign-up in the Service). VIES, the European Commission’s VAT validation system, is an external public source and not a sub-processor.

Because support requests may contain Customer Personal Data, Google Workspace and Typeform are listed above as Sub-processors.

Annex D — International transfers

Recipient	Country	Safeguard (Chapter V GDPR)
Google LLC (US), subprocessor of Google Cloud EMEA Limited for Google Cloud / Firebase (and Google Workspace): most application functions in us-central1 (including processing of CRM file content when downloaded), storage of tenant logos in us-east1 and Firebase Authentication; for Firebase Hosting (global CDN), Cloud Logging (global location) and Google Workspace, processing may also take place at other Google locations	United States; for Firebase Hosting, Cloud Logging and Google Workspace possibly also other countries	EU–U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795; Google LLC is certified, see dataprivacyframework.gov/list), applied as Google’s Alternative Transfer Solution (cloud.google.com/terms/alternative-transfer-solution); as a fallback, Standard Contractual Clauses (Decision (EU) 2021/914, Module 3, processor-to-processor) between Google and its subprocessors under the Cloud Data Processing Addendum (cloud.google.com/terms/sccs/eu-p2p-google-exporter).
Resend (Plus Five Five, Inc.)	United States	Standard Contractual Clauses (Decision (EU) 2021/914) incorporated in the Resend DPA; the Standard Contractual Clauses are the primary safeguard; the EU–U.S. Data Privacy Framework applies in addition to the extent Resend’s certification is active (www.dataprivacyframework.gov/list)
Typeform SL, with storage at its sub-processors in the United States (including Amazon Web Services)	United States	Standard Contractual Clauses (Decision (EU) 2021/914, Module 3: processor to processor) which Typeform concludes with these sub-processors under its DPA (www.typeform.com/dpa/); Typeform is not certified under the EU–U.S. Data Privacy Framework

Contact for privacy matters and requests under this DPA: via [email protected] or the contact page.

End of DPA (EN).