PomioPomioCRM
Start 14-day trial

Privacy

Privacy Policy

Controller / contracting party: Pomio CRM (“Pomio”).

Last updated: 8 October 2026 (Europe/Amsterdam)
Language: English (default)

1. Who we are

Pomio CRM (“Pomio”, trade name/brand) is the provider of the Pomio SaaS multi-tenant Customer Relationship Management (CRM) for leads, companies, contacts and pipeline (not an Applicant Tracking System / ATS) (EU / Made in Europe positioning). Pomio is the sole controller and contracting party for this Privacy Policy.

Privacy contact: via the contact page (forms on this site). No separate privacy mailbox is required.

2. Roles under GDPR / AVG

Context Who is controller?
Pomio marketing website, trial/demo/contact intake, account administration, billing metadata, support about the product Pomio (controller)
Personal data that you (the customer) store or process inside the Pomio CRM on behalf of your own organisation or clients You (the customer) are controller; Pomio acts as processor; a data processing agreement (DPA / verwerkersovereenkomst) is available on request

This Privacy Policy mainly covers processing where Pomio is controller. CRM customer-content processing is governed by the Terms and, where concluded, the DPA (data processing agreement on request).

3. What we process and why

3.1 Account & subscription

  • Data: name, email, organisation, seat count, plan, payment status / billing references
  • Purpose: create and manage your Pomio CRM subscription, authenticate users, invoice
  • Legal basis: performance of contract (Art. 6(1)(b) GDPR)

3.2 CRM service delivery (as processor)

  • Data: whatever you enter into Pomio (contacts, notes, activities, etc.)
  • Purpose: host and operate the CRM for you
  • Legal basis (your side): determined by you as controller; our processing is on your documented instructions (Art. 28 GDPR) under the DPA (available on request)

3.3 Support

  • Data: contact details, ticket content, technical logs needed to diagnose issues
  • Purpose: respond to support requests
  • Legal basis: contract and/or legitimate interest in assisting customers (Art. 6(1)(b)/(f))

3.4 Trial / demo / contact / support / privacy intake (Typeform)

  • Data: fields you submit via Typeform (typically name, email, company, message, request type)
  • Purpose: handle trial, demo, contact, support, and privacy requests
  • Legal basis: pre-contractual steps / contract (Art. 6(1)(b)) or legitimate interest in responding to enquiries (Art. 6(1)(f)); consent where we ask for marketing follow-up
  • Note: Typeform is a named subprocessor of Pomio for lead / intake / privacy forms

3.5 Cookies & similar technologies

We use necessary first-party cookies (for example session and security) to operate the site and app. Cloudflare may set necessary or security-related cookies to protect and deliver the site.

Non-essential cookies or analytics — which may include Google Analytics where enabled on the site — are only set after consent. You can manage or withdraw consent via the cookie settings / banner on the site when available. Details of specific cookies follow the cookie settings on the site; we do not publish a fixed name/duration table in this policy.

3.6 Marketing (if any)

  • Where we send product or marketing communications: only with consent or soft-opt-in where Dutch/EU law allows for existing customers, with a clear opt-out
  • Legal basis: consent (Art. 6(1)(a)) and/or legitimate interest with opt-out where applicable

4. Categories of data (summary)

  • Identity & contact data
  • Organisation / role data
  • Account & subscription data
  • Support communications
  • Typeform intake / privacy-request data
  • Technical / log data (IP, user agent, timestamps — as needed for security and operations)
  • Cookie/analytics identifiers (non-essential only with consent)
  • CRM content: processed as your data under your controllership (see §2)

We do not intentionally collect special categories of personal data for our own purposes as controller. Do not submit such data via marketing forms unless necessary and lawful on your side.

5. Retention

We retain personal data only for as long as needed for the purposes described in this policy, to perform the contract, and to meet applicable legal obligations (including fiscal and accounting duties where they apply). We also retain data as needed to handle deletion or other rights requests.

Data Approach
Account & subscription / billing For the subscription relationship and as long as required for legal / fiscal obligations
CRM customer content Per your instructions as controller, until you delete it or the account ends, then for a reasonable period to allow export (see Terms), subject to legal holds
Environment after a trial without a paid subscription For the retention period as shown in the app, then deleted, subject to statutory retention obligations and any legal hold
Support communications For as long as needed to resolve the request and for a reasonable follow-up / archive period
Typeform privacy / lead forms Until handled, then for a reasonable period, or earlier on request where applicable
Security / operational logs For as long as needed for security, abuse prevention and operations
Cookies According to the cookie settings / banner on the site

6. Recipients and subprocessors

Pomio may share data with providers engaged by Pomio. Known subprocessors / processors include:

  • Typeform — lead, contact, support and privacy intake forms
  • Cloudflare — CDN, security and related site delivery
  • Google / Firebase — infrastructure / platform services (may involve processing in the EEA and the US; US transfers under Standard Contractual Clauses or other appropriate safeguards)
  • WeFact (or a comparable invoicing provider) — invoicing
  • Google Analytics — optional analytics where enabled (only with consent)
  • Other processors as reasonably needed to operate Pomio CRM (for example professional advisers under confidentiality)
  • Authorities where legally required

This list may be updated from time to time. The current list is available on request and/or with the DPA. We do not sell personal data.

7. International transfers

Processing may take place in the EEA and the United States (for example Google/Firebase and related tools).

Where personal data is transferred to the US or another country outside the EEA/UK adequacy area, Pomio uses appropriate safeguards, in particular EU Standard Contractual Clauses (SCCs) and related transfer assessments, as required under the GDPR.

8. Your rights (GDPR / AVG)

Where Pomio is controller, you may request:

  • Access, rectification, erasure
  • Restriction of processing
  • Data portability (where applicable)
  • Objection to processing based on legitimate interest
  • Withdrawal of consent (without affecting prior lawful processing)
  • Complaint to the Dutch Autoriteit Persoonsgegevens (or your local EU supervisory authority)

Submit privacy requests via the contact page.

For data inside your CRM tenant, contact your organisation (the controller) first; we assist as processor per the DPA/Terms.

9. Security

We apply appropriate technical and organisational measures for a multi-tenant SaaS CRM, including access control, encryption in transit, tenant isolation measures, and backups as configured. No measure is perfect; report suspected incidents via the contact page.

10. Children

Pomio is a B2B CRM. We do not knowingly offer the service to children. Marketing forms are not directed at minors.

11. Changes

We may update this policy. Material changes will be announced on the site and/or by email where appropriate. The “Last updated” date will change on each revision.

12. Contact

Pomio CRM
Privacy and other contact: via the contact page.

End of Privacy Policy (EN).