Last Updated: September 14, 2025
CRMx processes personal data on behalf of the Customer in connection with the services (heatmaps, session recordings, email analytics, A/B testing, dashboards). Processing continues for as long as the Customer maintains an account, unless otherwise required by law.
Customer (Controller): Responsible for lawful collection of data, consent, and responding to data subject requests.
CRMx (Processor): Processes personal data only under Customer’s instructions and as required by law.
CRMx will assist the Customer, where possible, in fulfilling obligations to respond to data subject rights requests.
CRMx uses trusted sub-processors (e.g., hosting providers, payment processors). Customer authorises CRMx to engage sub-processors provided CRMx remains responsible for their performance.
CRMx ensures compliance with GDPR/UK DPA when transferring data outside the UK/EU via SCCs, IDTA, or adequacy decisions.
CRMx will notify the Customer without undue delay if aware of a personal data breach.
On termination of services, CRMx will delete or return Customer data, subject to legal retention requirements.
This DPA is governed by the laws of England and Wales. Liability is limited in line with CRMx’s Terms of Service.
Contact: privacy@crmx.uk
