GDPR & compliance

This document supplements the Privacy Policy and the Terms of Service and is addressed mainly to legal entities - customers and partners of CACTUS DIGITAL S.A. (CACTUS DIGITAL Α.Ε.) that need compliance documentation for their own GDPR obligations. If this English version and the Greek version differ, the Greek version prevails.

1. Overview

CactusCRM is designed according to the principles of privacy by design and privacy by default:

• We collect only the data that is necessary for the functionality you use.
• Roles & permissions are defined on the basis of the principle of least privilege.
• Data is hosted in European data centers.
• Our staff's access to customer data is logged and strictly justified.

2. Roles: Controller & Processor

3. Data processing agreement (DPA)

For every business customer we sign a Data Processing Agreement (DPA) in accordance with Article 28 GDPR, which includes:

• The subject matter, duration, nature and purpose of the processing.
• The type of personal data & the categories of data subjects.
• The obligations of the processor (confidentiality, security, assistance).
• The terms for engaging subprocessors.
• The notification procedure in the event of a breach.
• The return or deletion of data after the contract ends.
• Assistance with data subject rights requests & DPIAs.

A template DPA is available on request at dpo@cactusweb.gr.

4. Subprocessors

We use carefully selected subprocessors for specific functions of the platform. All of them are bound by equivalent contracts and apply appropriate security measures.

We reserve the right to add or change subprocessors with 30 days' prior notice. The Customer may raise a reasoned objection to the specific change.

5. Technical & organisational measures

5.1 Technical measures

• Encryption of data in transit (TLS 1.2+).
• Encryption "at rest" of databases & backups.
• Strict isolation of customers at application level (multi-tenant with tenant guards).
• RBAC (role-based access control) and the principle of least privilege.
• 2FA for critical roles.
• Audit logs for the creation/modification/deletion of critical records.
• Daily automated backups with restore tests.
• Separate environments (development / staging / production).
• Vulnerability checks (dependency scanning, code review).

5.2 Organisational measures

• Confidentiality agreements with all staff & partners.
• Annual staff training in security & GDPR.
• User on-/off-boarding procedures.
• "Clean desk" & device management policy.
• A designated Data Protection Officer (DPO).
• Security incident response procedures.

6. Data breaches

In the event of a breach that may affect the personal data of our customers, we follow a documented response procedure:

1. Detection & containment within the first hours.
2. Impact assessment and risk categorisation.
3. Notification of the Customer without undue delay and, as a rule, within 48 hours.
4. Notification of the Hellenic Data Protection Authority (HDPA) within 72 hours (Article 33 GDPR), where required.
5. Notification of data subjects (Article 34 GDPR), where there is a high risk.
6. Corrective actions & a post-mortem with improvements.

7. International transfers

Data is primarily stored within the EEA. Where data is transferred outside the EEA (mainly to AI providers), the following apply:

• Standard Contractual Clauses (SCCs) - Decision 2021/914.
• Supplementary measures: pseudonymisation, purpose limitation, short retention by the provider.
• Transfer Impact Assessment (TIA) where relevant.

8. Data subject rights

We assist our customers in fulfilling the requests they receive from data subjects (their customers, employees, leads, etc.):

• Access & portability: export of data in a structured format (JSON / CSV).
• Rectification & erasure of records through administrator tools.
• Restriction of processing by flagging records.
• Objection & withdrawal of consent for marketing communications.

9. Retention & deletion

• During the contract, data is retained in accordance with the Customer's settings.
• After termination, a period of 30 days is given for export.
• The data is then permanently deleted within 90 days (including backups, in the normal rotation cycle).
• Data subject to a legal retention obligation (e.g. tax documents) is kept for the prescribed period.

10. AI & language processing

Where AI features are used (call transcription, sentiment analysis, RAG, AI insights), additional rules apply:

• The features are explicitly enabled by the Customer per module.
• We do not use Customer data to train models - our providers are contractually bound to the same effect.
• Where possible, pseudonymisation is applied before data is sent to an external AI provider.
• Audit logs are kept for every AI call.

11. Data Protection Officer (DPO)

We have appointed an internal contact person for data protection matters:

• Email: dpo@cactusweb.gr
• Address: 1 Morichovou Square, Thessaloniki, Greece.

12. How to submit a request

To exercise rights or to request a DPA / the list of subprocessors / a TIA:

1. Send an email to dpo@cactusweb.gr with a clear description of your request.
2. Additional identification details may be requested for security reasons.
3. We respond within 30 days (60-day extension for complex requests, with notice to you).
4. If you believe that your rights are being infringed, you can contact the Hellenic Data Protection Authority (HDPA) (1-3 Kifisias Avenue, 115 23 Athens, Greece, tel. +30 210 6475600).