This policy explains what personal data 333CRM processes, why, how long we keep it, who we share it with and what rights you have. It applies to the 333crm.com website, to demo requests and to accounts in the 333CRM application, and follows Law no. 195/2024 on personal data protection of the Republic of Moldova. For people in the European Union, Regulation (EU) 2016/679 (GDPR) also applies.
Who we are
The data controller is Servicii complete SRL, with its registered office at bd. Moscova 21, Chișinău, Republic of Moldova, IDNO 1020600001417 (“333CRM”, “we”).
For any question about your data, write to us at servicii.complete.srl@gmail.com.
Our two roles
333CRM processes data in two different capacities:
- As controller, for the data of website visitors, of people who request a demo, of the users in our customers’ accounts, and for invoicing. This policy applies to that data.
- As processor, for the data that customer companies enter or receive in 333CRM: their contacts, their conversations with their own customers, calls, quotes and invoices. For this data, the controller is the customer company, and we process it only on its instructions, in accordance with the contract and the data processing agreement concluded with it (see the GDPR policy). If you wrote to a company that uses 333CRM, contact that company first.
What data we process and why
| When | What data | Why | Legal basis |
|---|---|---|---|
| You visit the website | IP address, browser type, pages requested, time of the request (in the server logs); the language you chose, kept in your browser | Operation and security of the website; displaying it in the chosen language | Legitimate interest in providing a secure and functional website |
| You request a demo | Name, company, email or phone, the channels used, your message | To contact you, to schedule and hold the demo, to send you an offer | Steps taken at your request before entering into a contract |
| You use a 333CRM account | Name, email, phone (if you add it), password (kept only as a hash), two-step authentication settings, role, language, sign-in and audit logs | Providing the service, account security, traceability of changes | Performance of the contract with your company and legitimate interest in protecting the service |
| You sign in with Google, Microsoft or LinkedIn | Account identifier, name and email received from the provider | Signing in without a separate password | Performance of the contract |
| Invoicing | Invoicing details of the company and of the contact person | Issuing invoices, accounting records | Legal obligation |
| You write to support | The message, contact details, technical details of the problem | Resolving the request | Performance of the contract or legitimate interest |
We do not use your data for personalised advertising and we do not sell it.
Who we share data with
We use providers that process data on our behalf, under contract and only as far as necessary:
- DNS and traffic protection: Cloudflare, Inc.
- AI features: Vercel, Inc. (AI Gateway), which forwards requests to the model providers, currently Anthropic (the Claude models) and Google (text indexing). They receive only what is needed for the answer: the latest messages in the conversation (at most 20 messages or 12,000 characters of an email thread), the relevant excerpts from the company’s documents and its rules. Each request asks them not to retain the data and not to use it to train models.
The channels and services that a customer company connects to its account (for example WhatsApp, Instagram and Messenger through Meta, Telegram, Viber, Twilio, Google, Microsoft, LinkedIn, X, YouTube, TikTok, SendGrid, Mailgun or Stripe) receive the data needed to send and receive messages, calls or payments. The customer company chooses and configures these connections, using its own accounts with those providers.
We may disclose data to authorities only when the law requires us to.
Transfers outside the Republic of Moldova
Some of the providers above are based in the European Union or in the United States. We transfer data outside the Republic of Moldova only to states that ensure an adequate level of protection or with appropriate safeguards, for example standard contractual clauses, as Law no. 195/2024 provides.
How long we keep data
- Audit log: 7 years by default, archived after 12 months.
- In-app notifications: 90 days.
- Technical logs of channels and webhooks: 30 to 90 days.
- Invoicing documents: as long as accounting legislation requires.
The retention periods for customer companies’ data (for example call recordings or the permanent deletion of deleted records) are set by each company in its settings.
How we protect data
- Connections are encrypted (HTTPS, with HSTS).
- Each company’s data is separate from the others’, and access within an account depends on role.
- Two-step authentication is mandatory for administrators and can be required for other roles.
- Passwords have at least 12 characters and are kept only as a hash; after 5 wrong attempts, the account is locked for 15 minutes.
- Access keys, channel tokens and authentication secrets are stored encrypted.
- Important changes are recorded in the audit log.
- Uploaded files are scanned for viruses.
Your rights
Under Law no. 195/2024 on personal data protection, you have the right:
- to find out whether we process data about you and to receive a copy of it;
- to ask for incorrect or incomplete data to be corrected;
- to ask for your data to be erased, when we no longer have a legal reason to keep it;
- to ask for the restriction of processing;
- to receive the data in a structured format and to transmit it to another controller;
- to object to processing based on our legitimate interest;
- to withdraw your consent, where the processing is based on it.
For any of these, write to us at servicii.complete.srl@gmail.com. We reply within one month at most. If the request concerns data held by a customer company in 333CRM, we pass it on to that company and help it to respond: the application has data export and anonymisation for such requests.
You also have the right to lodge a complaint with the National Center for Personal Data Protection (CNPDCP), str. Serghei Lazo 48, MD-2004 Chișinău, datepersonale.md. If you are in the European Union, you may also contact the data protection authority of your country.
Automated decisions
We do not make decisions based solely on automated processing that produce legal effects on you. When a customer company uses AI automatic reply, the AI answers questions based on the information given by that company, and the conversation passes to a person when the customer asks for this.
Children
The website and the service are aimed at companies. We do not knowingly collect data about children.
Changes to the policy
When we change this policy, we update the date above. If the change is significant, we notify account users by email or in the application.