This policy explains how 333CRM processes the personal data that customer companies keep in the application, and which tools we give them to comply with Law no. 195/2024 on personal data protection of the Republic of Moldova and, for people in the European Union, Regulation (EU) 2016/679 (GDPR). For the data we process on our own behalf (website visitors, demo requests, account users, invoicing), the Privacy policy applies.
Who has which role
- The customer company is the controller. It decides what data about its own customers it keeps in 333CRM, why and for how long.
- 333CRM is the processor. Servicii complete SRL, bd. Moscova 21, Chișinău, Republic of Moldova, IDNO 1020600001417, processes this data only to provide the service and only on the customer company’s instructions.
- The data subjects are the customer company’s customers and contacts: the people who write to it, call it or appear in its records.
The data processing agreement
With every customer company we conclude, together with the contract, a data processing agreement. In it we undertake:
- to process the data only on the customer company’s documented instructions;
- not to use the data for any other purpose and not to sell it;
- that the people who work with the data are bound by confidentiality;
- to apply the security measures described below;
- to use other providers only on the terms described below;
- to help the customer company answer data subjects’ requests and to notify it of any personal data breach;
- to return or delete the data when the contract ends;
- to make available the information needed to show that these obligations are met.
GDPR tools in 333CRM
- Exporting a person’s data. For a contact, the application prepares an archive with their data, their identities on each channel, every conversation with its messages in order, and the files sent and received in them.
- Erasure on request. The contact’s personal data is anonymised and the content of every message is replaced. The conversations remain only for statistics, without identifying the person. So that it is never done by mistake, the erasure is confirmed by typing the contact’s email or full name.
- Consent. Each contact records whether they gave consent, the date, the source and the date it was withdrawn.
- Rectification. Data is corrected directly in the contact’s record, and every change stays in the record’s history.
- The list of requests. Export and erasure requests appear in a list, each with its status.
- Who has access. Export and erasure have separate permissions, which the company’s administrator grants only to the right roles.
- The audit log. Every export, erasure and field change is recorded. The log is kept for 7 years by default and archived after 12 months; the company can choose other periods in its settings.
Data subjects’ requests
Requests about data in 333CRM are handled by the customer company, as controller, with the tools above.
Data security
- Connections are encrypted (HTTPS, with HSTS).
- Each company’s data is separate from the others’, and access within an account depends on role.
- Two-step authentication is mandatory for administrators and can be required for other roles.
- Passwords have at least 12 characters and are kept only as a hash; after 5 wrong attempts, the account is locked for 15 minutes.
- Access keys, channel tokens and authentication secrets are stored encrypted.
- Uploaded files are scanned for viruses.
Where the data is and who helps us
By contract, we impose on the providers that process data on our behalf the same data protection obligations that we have.
Data leaves the Republic of Moldova only with the safeguards required by Law no. 195/2024, for example standard contractual clauses.
The channels and services that the customer company connects itself (WhatsApp, Instagram, Telegram, Stripe and others) receive data through its own accounts with those providers, as it chooses.
Personal data breaches
If we become aware of a breach affecting a customer company’s data, we notify it without undue delay, with what we know about the nature of the breach, the data and people affected, the likely consequences and the measures taken. This lets the company notify the authority and, where needed, the data subjects in time.
When the contract ends
Before the contract ends, the customer company can export its data.
Contact
For questions about this policy or the data processing agreement, write to us at servicii.complete.srl@gmail.com.
The supervisory authority is the National Center for Personal Data Protection (CNPDCP), str. Serghei Lazo 48, MD-2004 Chișinău, datepersonale.md.