Privacy & TOMs

1. Who we are

PlusGrowth BV, based in the Netherlands, provides the PlusGrowth CRM. For data of our own website visitors and account holders we act as controller. For data customers store in the CRM (their contacts, companies, emails) we act as processor and the customer is the controller.

All processing follows the GDPR. Our Data Processing Agreement (DPA) and these TOMs together form the security framework.

2. Data we process

• Account data: name, business email, phone number, organization and role.
• Usage data: sign-ins, features used, error reports and audit logs.
• CRM content: contact and company records, activities, emails and notes entered or synced by the customer.
• Enrichment and signal data: publicly available company information and website visitor signals.
• Billing data: company name, address, VAT number and payment status (payments run through our payment provider).

3. Why we process data

• Delivering, securing and improving the service (performance of the contract).
• Support, billing and administration (contract and legal obligation).
• Security, fraud prevention and abuse detection (legitimate interest).
• Product and update communication (legitimate interest or consent).

4. Retention

Account data is retained while the account is active and up to 90 days afterwards. Billing data is retained for 7 years under tax law. Audit logs are kept for a maximum of 12 months. CRM content is retained per customer instructions and deleted or exported within 30 days after termination.

5. Your rights

You have the right to access, rectification, erasure, restriction, objection and data portability. Send requests to privacy@plusgrowth.eu; we respond within 30 days. You may also lodge a complaint with your supervisory authority.

6. TOMs — Access control

• Outsourced processing: we host with cloud providers under contractual safeguards and data processing agreements.
• Physical and environmental security: our infrastructure providers are audited for SOC 2 Type II and ISO 27001, among others.
• Authentication: a uniform password policy; users must authenticate before accessing non-public data.
• Authorization: multi-tenant storage with strict per-organization separation; access only via the application and API, never directly to infrastructure.
• API access: only via API key or OAuth authorization.

7. TOMs — Network and abuse prevention

• Network access controls via VPCs, security groups and firewall rules.
• Web Application Firewall (WAF) protecting publicly reachable services.
• Annual penetration tests by recognized third parties.
• Bug bounty program for ethical disclosure of vulnerabilities.

8. TOMs — Limitation of privileges

• Only a subset of employees can access production data, through controlled interfaces.
• Access is granted through just-in-time requests; all requests are logged.
• Privileges are role-based; high-risk grants are reviewed daily and roles at least every six months.
• All employees pass a background check and are bound by confidentiality.

9. TOMs — Transmission and storage security

• In transit: HTTPS/TLS on all login interfaces and customer environments, using industry-standard algorithms and certificates.
• At rest: stored data is encrypted; passwords are hashed following industry standards.
• Credentials and tokens are stored encrypted and are not readable through the API.

10. TOMs — Logging and incident response

• Extensive logging of system behaviour, traffic, authentication and application requests.
• Aggregated log analysis with alerting on malicious or anomalous activity.
• Incident register with descriptions, timestamps and resolution; customer notification per the agreement and the GDPR.

11. TOMs — Availability

• Infrastructure providers target at least 99.95% uptime, with N+1 redundancy for power, network and HVAC.
• Backups and replication across multiple availability zones.
• Production databases replicate to at least one secondary; backups follow industry-standard methods.

12. Sub-processors

We engage the following sub-processors. Changes are announced in advance in line with the data processing agreement.