Data Processing Agreement

Last updated 8 November 2026

This agreement forms part of our Terms of Service. It applies automatically to every business that uses CRM Ground, with no separate signature needed. It sets out how we handle the personal data you store in CRM Ground, as required by Article 28 of the UK GDPR.

Who is who

"You" means the business that holds the CRM Ground account. You are the controller of the personal data you put into CRM Ground. "We" means CRM Ground Limited, company number 17556174, registered office Suite 82 Dorset House, Duke Street, Chelmsford, Essex, CM1 1TB. We are your processor for that data.

What we process

  • Subject matter and purpose: providing the CRM Ground service to you, including storing records, sending the emails and texts you ask us to send, syncing with services you connect, and producing invoices, reports and other documents.
  • Duration: for as long as you have an account, plus the deletion period below.
  • People the data is about: your customers and their contacts, people who book or enquire with you, and your own staff who use the account.
  • Types of data: names, addresses, email addresses, phone numbers, site and equipment details, job and visit records, notes, photos and files you upload, messages, and payment records (we never hold full card or bank details).

Your data is only used for you

We process your data only on your documented instructions, which are these terms and the way you use the service. Specifically, we will never:

  • use your customer data, customer lists or contact details for any purpose of our own;
  • sell, rent or share your data with anyone, or use it for marketing;
  • contact your customers, except to send messages you or your settings ask us to send;
  • combine your data with another account's data, or use it to compare, profile or target your customers;
  • pass your data to, or let it be used by, any related company, whether one that shares owners or directors with CRM Ground Limited or otherwise.

Any related company that helps run the platform does so only as our sub processor under the obligations in this agreement, and is bound by the same restrictions. Using your data for any other purpose would breach this agreement and data protection law.

If the law ever requires us to process your data in some other way, we will tell you first unless the law forbids it.

Who can see your data

Your data is separated from every other account at database level. Nobody at CRM Ground can open your account unless your account owner switches on support access under Settings, for 24 hours or 7 days. While it is on, our support staff can look at your account but cannot change anything, your owner is emailed each time they open it, and access switches itself off when the time is up or the moment your owner turns it off.

Every time anyone at CRM Ground accesses your data, whether through support access or any other way (for example a fix you have asked us to make), it is recorded with the reason in your CRM Ground access log, which your owner can see under Settings and which cannot be edited. Anyone working on the platform for us is bound by a duty of confidentiality.

Keeping it secure

We take appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, encrypted storage of connection credentials, two step verification for every user, separation of each account's data, and an activity log of changes made in your account.

Sub processors

You give us general permission to use the sub processors listed in our Privacy Policy. We put a written agreement in place with each one that gives your data the same protection as this agreement, and we remain responsible to you for them. Before adding or replacing a sub processor we will update that list and tell account holders by email. If you object on reasonable data protection grounds, we will discuss it with you, and if we cannot resolve it you may close your account without penalty.

International transfers

Your data is stored in the United Kingdom. Where a sub processor handles it outside the UK, we make sure an approved safeguard is in place, such as the UK International Data Transfer Agreement.

Helping you meet your obligations

CRM Ground lets you view, correct, export and delete your customers' records yourself. Where you need more help to respond to a request from someone exercising their data protection rights, or with a data protection impact assessment or a question from the Information Commissioner's Office, we will give reasonable help. If we receive a request directly from one of your customers, we will pass it to you rather than answer it ourselves.

If something goes wrong

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within 48 hours, with the information we have about what happened, the data affected and what we are doing about it, so that you can meet your own reporting duties.

When your account ends

You can export your data at any time before closing your account. After closure we delete your data within 30 days, unless the law requires us to keep part of it. Copies held in backups are overwritten in the normal backup cycle and are not restored except to recover the service.

Checking we keep to this

We will give you the information you reasonably need to show that we comply with this agreement. If you need to audit us, tell us in writing and we will agree a reasonable scope and timing with you.

Everything else

The liability terms in our Terms of Service apply to this agreement. If this agreement and the Terms of Service disagree about personal data, this agreement wins. Questions about it can be sent to privacy@crmground.com.