Data processing agreement
How we process personal data on behalf of companies that use the service.
Effective 2026-11-07 · Version 1
Parties and scope
This agreement forms part of the terms of service between Rutba (the processor) and the company using Rutba CRM (the controller). It applies to personal data the controller places in the service.
What is processed
- Purpose: providing the customer relationship service the controller chose.
- Duration: the life of the subscription, then until deletion under this agreement.
- Nature: storing, organising, sending, receiving, analysing and deleting data.
- People: the controller's customers, leads, patients, staff and contacts.
- Data: identity and contact details, messages, orders, deals, tasks, files and anything else the controller records. This may include health information where the controller is a clinic.
Our commitments
- We process personal data only on the controller's documented instructions, which include using the service and these terms, unless the law requires otherwise. If we think an instruction breaks the law, we say so.
- Our staff are bound to confidentiality, and support access to a company's workspace needs that company's approval, is limited in time and is recorded.
- We keep the technical and organisational measures described on the security page.
- We help the controller answer requests from individuals, using the export, correction, erasure and stop marketing tools in the service.
- We help with security, breach notification and impact assessments, taking into account what we know.
- We tell the controller about a personal data breach without undue delay after becoming aware of it.
Subprocessors
The controller gives general authorisation to use the providers on the subprocessors page. We give at least 30 days of notice on that page before adding or replacing one, so the controller can object. We bind each one to equivalent duties and remain responsible for them.
International transfers
The service is hosted in Germany. Where data moves to another country, we rely on the safeguards the applicable law requires.
End of the service
When the subscription ends, the controller can export its data. On request, we delete or anonymise it within 90 days, and it leaves our backups within 30 days, unless the law requires us to keep it.
Audits
We provide the information needed to show we meet this agreement. The controller can audit us, or use an independent auditor, on reasonable notice and at its own cost, without seeing other companies' data.
Controller duties
The controller is responsible for having a lawful basis, for what it tells individuals, for the accuracy of the data and for choosing which features to turn on, including AI and connected accounts.
Contact
Privacy: no-reply@rutbacrm.com. Security incidents: no-reply@rutbacrm.com.