Pomio CRM and every other CRM has a free text field somewhere, and that field ends up holding everything. A salesperson types what the customer said on the phone, an office manager pastes the login for a customer portal, someone adds that the buyer is “difficult” or off sick. Each note feels harmless when it is written. Together they turn the CRM into a place where personal data, secrets and gossip sit next to the sales history, visible to everyone who has access.
Why notes need a rule at all
Notes are read by more people than the writer has in mind. Colleagues who take over an account, a manager who reviews the pipeline, support and finance with read-only access, and sometimes the customer. Under the GDPR anyone whose data you keep can ask for a copy of it, and free text about that person is included. A note that says “prefers email, decision expected after the board meeting on the 14th” is easy to hand over. A note that calls someone unreliable or mentions their illness is not, and you cannot quietly delete it once the request has arrived.
What never belongs in a note
For most small and mid-sized businesses the list is short and does not change:
Passwords, access codes and keys. Logins for a customer portal, Wi-Fi codes, alarm codes or API keys belong in a password manager with its own access control, not in a field that every salesperson can read and that may end up in an export.
Payment and identity data. Card numbers, security codes, full bank details beyond what invoicing needs, passport or ID numbers and photos of documents. Finance and accounting systems are built to hold these; a CRM note is not.
Sensitive personal data. Health, including “off sick” or “burnout”, religion, political views, trade union membership, sexual orientation and criminal records are special categories under the GDPR. Sales almost never needs them. If a meeting is postponed because someone is ill, “meeting moved, new date 3 March” is enough.
Opinions about people. “Pushy”, “clueless” or “not worth the effort” says more about the writer than about the deal and reads very badly when the person asks for their data. Describe behaviour and facts instead: “asked for three price revisions, wants approval from the CFO”.
Private life that has no bearing on the sale. Family circumstances, holidays or hobbies picked up in small talk do not need to be stored about a business contact.
Information about other customers. Mentioning that a competitor of this customer pays a lower price, or naming another client’s problems, leaks data from one relationship into another.
Whole email threads. Pasted conversations hide the one useful fact and copy other people’s personal data along with it. Summarise the outcome in a sentence or two.
What a good note does contain
A useful note answers four questions: what happened, what was agreed, what is the next step, and why something changed. It is dated, short and written so that a colleague who has never met the customer can continue tomorrow. That is also why it makes sense to ask for a short reason when a deal moves, as explained in whether every stage change should require a note. Facts about the buying process, such as who decides, what budget was mentioned and which competitor is in the picture, are relevant; personal remarks are not.
Write as if the customer will read it
The simplest rule to teach a team is the test of the reader: write every note as if the contact will one day see it on screen. That covers most of the list above without a long policy. It also keeps the tone professional, which helps when a deal is handed over or when a complaint turns into a dispute and the history is suddenly important.
Where the information should go instead
Banning things only works when there is an alternative. Credentials go into the company password manager and, if needed, the note says where to find them, not what they are. Payment data stays in the finance or payment system. Agreements that matter legally belong in the contract or order confirmation, with the note pointing to it. Sensitive personal information is usually best not recorded at all.
Cleaning up the notes you already have
Most CRMs that have been in use for a few years contain some of these slips. Search the notes for obvious words such as “password”, “login”, “IBAN”, “sick” or “ill”, remove or rewrite what you find and tell the writer why, without making it a blame exercise. Add a quick search to the monthly data quality check so new slips are caught early. Notes on leads that never became customers should disappear with the lead when its retention period ends, as described in how long a CRM should keep leads that never bought. If you correct or delete notes, it helps that important actions are visible afterwards in an audit trail.
How Pomio CRM helps
Pomio CRM keeps notes and activities on the timeline of the deal, company or contact they belong to, so context stays with the record instead of in separate documents. Who can read them follows the user’s role, sales rep, sales manager, viewer or organisation admin, and scope own, team or organisation, enforced on the server. Users have their own login with optional MFA, can be suspended when they leave, and the audit log records who did what and when for important actions. An overview is on the features page and the security approach on the security page.
A practical checklist
Agree in one paragraph what notes are for; list what never goes in: credentials, payment and ID data, sensitive personal data, opinions about people, private life, other customers’ information and pasted threads; point to the right place for credentials and payment data; teach the reader test; ask for a short reason when a deal moves; search for slips every month; delete notes together with leads whose retention period has ended; keep access limited by role and scope.
Further reading
May I note that a contact is on holiday or on leave?
Yes, as long as you note the business fact and not the reason: “away until 12 May, colleague Anna handles urgent questions” is fine. Do not record why someone is absent if it concerns health or family matters.
What about notes in other languages or abbreviations?
Write in the language the team shares and avoid private shorthand. A note that only the writer understands does not help the colleague who takes over the account.
Should sales managers read every note?
No. Managers should be able to see the notes within their team’s scope when they review deals, but the point of the rule is that notes are fine for anyone with access to read, not that someone polices them.
Can a customer ask us to delete notes about them?
Under the GDPR a contact can ask for correction or deletion of their data. Whether you must delete depends on the legal basis and retention needs, so agree a procedure with whoever handles privacy in your company.