Data processing agreement

Last updated 20 October 2026 · Version 2026-10-20 draft

This agreement forms part of the terms of service between your organisation ("you", the controller) and Collinalitics Ltd ("we", the processor). It covers the personal data your workspace holds in CAE CRM, as Article 28 of the UK GDPR requires.

1. What we do with your data

We process personal data only to provide CAE CRM to you, and only on your documented instructions. Those instructions are these terms, and what you and your team do in the app, the API and the integrations you switch on. If we think an instruction breaks data protection law, we'll tell you. If the law requires us to process data in some other way, we'll tell you first, unless the law forbids it. Schedule 1 sets out the details.

2. Our people

Everyone we allow to access your data is bound to keep it confidential, and has access only where they need it to run, support or secure the service.

3. Security

We keep appropriate technical and organisational measures in place, as Article 32 requires. Schedule 2 lists them. We may improve them, but we won't make them weaker overall.

4. Sub-processors

You give general permission for us to use the sub-processors in Schedule 3. We'll tell admins at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can't resolve it, you can end the terms and get a refund of any prepaid fees for the time left. Each sub-processor is bound by a written contract with data protection duties at least as strong as ours, and we stay responsible for them.

Services you choose to connect, such as Gmail, Outlook, Xero, HMRC, Zapier, Power BI, your own Stripe account for card payments on your invoices, or your own systems, aren't our sub-processors. Data goes to them on your instruction. The same goes for Companies House: when you look a company up, the name or number you type is sent to its public register.

5. Helping you

• People's rights. CAE CRM lets you find, correct, export (as a subject access file) and erase a person's data. If someone contacts us directly about data you control, we'll pass it to you, and help you respond where you need us to.
• Deleted records. Records your team deletes stay in a recycle bin for 30 days so an admin can restore them, then they're deleted. Admins can delete them permanently sooner. Erasing a contact deletes their personal data straight away.
• Your other duties. We'll give reasonable help with security, breach notifications, data protection impact assessments and consulting the ICO, taking into account what we know about the processing.

6. Personal data breaches

If we become aware of a breach affecting your data, we'll tell you without undue delay, and in any case within 48 hours. [to confirm: notification period] We'll tell you what we know: what happened, the data and people likely to be affected, the likely consequences, and what we're doing about it. We'll then keep you updated.

7. Transfers outside the UK

We'll only transfer your data outside the UK with a valid safeguard in place:

• UK adequacy regulations;
• the UK Extension to the EU-US Data Privacy Framework;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU's standard contractual clauses.

8. When the terms end

You have 30 days to export your data. After that we'll delete it, including from backups as they're overwritten, unless the law requires us to keep it. We'll confirm the deletion in writing if you ask.

9. Checks and audits

We'll give you the information you reasonably need to show that we're meeting this agreement. If that isn't enough, you can audit us, or ask an independent auditor bound by confidentiality to do so. Give us at least 30 days' notice, and do it no more than once a year, unless there's been a breach or a regulator requires it. You pay for the audit.

10. Your responsibilities

You're responsible for:

• having a lawful basis for the personal data you put into CAE CRM;
• giving people the privacy information they're entitled to;
• getting any consent you need, including under PECR for marketing emails.

Schedule 1: Details of the processing

Subject matter and duration

Providing CAE CRM, for as long as the terms last, plus the 30-day export and deletion period.

Nature and purpose

Storing, organising, displaying, searching, exporting, sending and deleting records, so you can manage customer relationships, sales, service tickets, quotes, invoices, email campaigns and web forms. This includes receiving your customers' emails into tickets if you switch on email-to-ticket (adding a contact for a new sender), emailing your customers when your team replies to a ticket and, if you switch it on, a one-question satisfaction survey when a ticket closes. If your admin turns on the AI assistant, looking up records to answer your team's questions, draft text for them, summarise records, and suggest how to triage new tickets. If you switch on website chat, answering your website's visitors from your published help articles and passing their details to your team as tickets.

Types of personal data

Whatever you put in. Typically:

• names, job titles, email addresses and phone numbers;
• company details;
• notes, call and meeting records, and emails logged from connected mailboxes (subject and a short preview);
• marketing consent and unsubscribe records;
• web form submissions;
• quote signatures (name, position, IP address and browser);
• files you attach;
• your custom fields.

CAE CRM isn't designed for special category or criminal offence data. Don't put it in unless you've checked that you can.

People the data is about

Your customers, prospects, suppliers and their staff, people who fill in your web forms or sign your quotes, and your own team.

Schedule 2: Security measures

• Encryption: all connections use HTTPS. Tokens for connected services (Gmail, Outlook, Xero, HMRC) are encrypted in the database.
• Signing in: passwords are stored as salted scrypt hashes, and new ones are checked against known breached passwords. Accounts lock for 15 minutes after 5 failed sign-ins, and a network is paused after 20 failures in 15 minutes. Admins must use two-factor sign-in. Sessions end after 12 hours unused, and people can see and end their sessions. Sign-ins from a new browser are emailed to the person.
• Keeping businesses apart: every query is limited to the signed-in workspace, and this is covered by automated tests. Row-level security is on for every database table, so the database provider's public interface can't read them.
• API and webhooks: API keys are stored only as hashes, can be limited to reading, and are rate-limited. Webhooks are signed, go only to public HTTPS addresses, and don't follow redirects.
• Files: attachments are kept in a private storage bucket and downloaded through links that expire after a minute, or in the database where no bucket is set up. File types that could run code are refused.
• Web protection: forms carry anti-forgery tokens. Exports and feeds are protected against spreadsheet formula injection.
• Accountability: an audit trail records who changed what. Error reports have personal data removed.
• Development: every change is tested automatically before it's released.
• Resilience: the database is backed up by our database provider, Supabase. [to confirm: backup frequency and how restores are tested]

Schedule 3: Sub-processors