Privacy Policy
We protect your data like it is our own. This policy explains what we collect, how we use it, and your rights as a client or visitor.
Effective date: January 1, 2025
Information We Collect
We only collect what is required to perform the service: project contact details, CRM access credentials (when shared by the client), and audit artifacts produced during the engagement. We never collect unnecessary personal information and only request access to the data needed for cleanup operations.
How We Use Data
Solely to deliver the cleanup service — auditing, deduplication, field standardisation, validation, enrichment gap analysis, and reporting. We never sell data, share data with third parties for marketing purposes, or use client data for any purpose outside the contracted CRM cleanup engagement.
Security
We use encrypted transport (TLS 1.2+), least-privilege access controls, SOC-2/ISO 27001 cloud infrastructure, and maintain change logs that are available to clients on request. We implement industry-standard security measures to protect your data at all times during and after an engagement.
Retention & Deletion
By default we delete project files 30 days after engagement completion unless a different retention period is agreed in writing. You can request earlier deletion at any time and we will comply promptly. Backup copies are purged on the same schedule.
Your Rights
You can request access, correction, or deletion of your data at any time by emailing privacy@cleanupcrm.com. We respond to all requests within 48 hours. If you are located in the EU or UK, you also have the right to lodge a complaint with your local supervisory authority.
International Transfers
If data leaves your jurisdiction, we use approved legal safeguards including Standard Contractual Clauses (SCCs) and Data Processing Addenda (DPAs). We ensure compliance with GDPR, UK-GDPR, CCPA, and other applicable data protection regulations relevant to your location.
Policy Updates
We will post any policy changes on this page with an updated effective date. Active clients will be notified of material changes with at least 30 days notice before they take effect. Continued use of our services after that date constitutes acceptance of the updated policy.
Data Processing Addendum (DPA)
If you are a Data Controller under GDPR, UK-GDPR, or DPDP, our DPA forms part of the service agreement. Summary below — full signed DPA available on request.