Data Processing Agreement (DPA)

1. Definitions

Terms such as "personal data", "processing", "data subject", "controller", "processor" and "personal data breach" have the meanings given in Article 4 of the GDPR.

2. Roles of the parties

The Customer is the Controller of the personal data it enters into The Bell CRM (contacts, leads, and related records). ChangeSales Oy is the Processor, acting only on the Customer's documented instructions as set out in this DPA and the applicable Terms of Service.

For account-level data needed to operate the Customer's own subscription (billing contact, login credentials, workspace settings), ChangeSales Oy acts as Controller in its own right, as described in our Privacy Policy.

3. Subject matter and duration

This DPA covers the processing of personal data carried out by ChangeSales Oy on behalf of the Customer through The Bell CRM, for the duration of the Customer's subscription, plus any period required for data retention or deletion under Section 8.

4. Nature and purpose of processing

Processing is carried out to provide the CRM service: storing and organizing contact, company, and deal records; logging activities and tasks; syncing and sending email; and generating AI-assisted suggestions (Smart Input) from data the Customer enters.

5. Categories of data subjects

The Customer's contacts, leads, prospects, and business contacts, as entered into the Customer's workspace.

6. Categories of personal data

Name, email address, phone number, company affiliation, role/title, communication history (emails, notes, call logs), and any other data the Customer chooses to record about a contact.

7. Processor obligations

ChangeSales Oy shall:

• process personal data only on the Customer's documented instructions, including regarding international transfers, unless required to do otherwise by EU or member state law;
• ensure persons authorized to process the data are bound by confidentiality;
• implement appropriate technical and organizational security measures under Article 32 GDPR, proportionate to the risk (see Section 9);
• not engage a sub-processor without prior general authorization, as granted in Section 10, and remain liable for sub-processors' performance;
• assist the Customer, insofar as reasonably possible, in responding to data subject requests (access, rectification, erasure, portability, objection);
• assist the Customer with its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments), taking into account the nature of processing and information available;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data;
• at the Customer's choice, delete or return all personal data after the end of the subscription, and delete existing copies, except where retention is required by law;
• make available information necessary to demonstrate compliance with this Article, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable notice and confidentiality.

8. Data retention and deletion

Upon expiry of a trial without conversion to a paid subscription, the workspace is locked (read-only) and the Customer's data is permanently deleted 14 days after the trial end date. Upon confirmed cancellation of a paid subscription, the Customer's data is deleted within 24 hours. The Customer may request earlier deletion at any time.

9. Security measures

ChangeSales Oy maintains technical and organizational measures including encrypted connections (TLS) for data in transit; encryption at rest for SMTP/IMAP credentials and Microsoft OAuth tokens (AES-256-GCM); workspace-level tenant isolation enforced at the application layer across all core data access paths; rate limiting on public-facing and authentication endpoints; regular dependency vulnerability review and patching; and role-gated administrative access.

10. Sub-processors

The Customer grants general authorization for ChangeSales Oy to engage the following sub-processors, each bound by a data processing agreement providing an equivalent level of protection:

ChangeSales Oy will give the Customer notice of any intended changes to this list, and the Customer may object on reasonable grounds relating to data protection.

11. International transfers

The transfer of data to Supabase's hosting location in the United Kingdom is made under the European Commission's UK adequacy decision, renewed and extended until 27 December 2031, so no additional transfer mechanism is required for that transfer.

Where a sub-processor is located in the United States, transfer is made subject to Standard Contractual Clauses approved by the European Commission, or another valid transfer mechanism under Chapter V GDPR. Anthropic, Vercel, and Clerk each incorporate their SCC/DPA terms automatically into their standard customer agreements, with no separate signature required; Stripe's DPA is likewise stated to form part of its standard Services Agreement.

12. Liability

Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service.

13. Governing law

This DPA is governed by the laws of Finland.