GDPR Compliance

Effective date: [6 October 2026]

The General Data Protection Regulation (GDPR) gives people in the European Union clear rights over their personal data, and the UK GDPR does the same in the United Kingdom. This page explains how SalesPeep meets its own obligations and how we help you meet yours when you manage customer and prospect data in our CRM.

1. Our role under the GDPR

The GDPR separates organisations into controllers, who decide why and how personal data is used, and processors, who handle data on a controller’s behalf.

• SalesPeep as processor. For the leads, contacts, deals, emails and other records you store in your workspace, you are the controller and we are your processor. We use that data only to provide the service, and only on your instructions.
• SalesPeep as controller. For our own account, billing, website and marketing data, we are the controller. Our Privacy Policy explains how we handle it.

2. How we follow the GDPR principles

• Lawful, fair and transparent - we explain what we do with data in plain language and rely on a valid legal basis for our own processing.
• Purpose limitation - Customer Data is used to run your CRM, never for advertising and never sold.
• Data minimisation - we collect only what we need, and our website uses strictly necessary cookies only.
• Accuracy - you and your users can correct or update any record in your workspace at any time.
• Storage limitation - we delete workspace data after an account ends, as set out in section 9.
• Integrity and confidentiality - we protect data with the security measures described below.
• Accountability - we keep records of our processing and review our practices regularly.

3. Data Processing Agreement

We offer a Data Processing Agreement (DPA) that meets the requirements of Article 28 of the GDPR. It covers the scope of processing, confidentiality, security, the use of sub-processors, help with data subject requests, breach notification, audits, and the deletion or return of data at the end of the service. The DPA forms part of our Terms of Service. To receive a copy for signature, email info@salespeep.com.

4. Security measures

Article 32 of the GDPR requires security that is appropriate to the risk. Our measures include:

• Workspace isolation - each customer’s data is held in its own separate database, so it is never mixed with another customer’s.
• Encryption - all traffic is encrypted in transit using HTTPS/TLS, and sensitive fields such as email addresses and phone numbers are encrypted at rest.
• Access control - role-based permissions with deny-by-default rules, so users see only what their role allows.
• Secure sign-in - device-bound sessions, optional IP allow-listing and one-time passcodes for the mobile app.
• Audit logging - important actions in your workspace are recorded, so you can see who changed what and when.
• Abuse protection - rate limits on public forms and sign-in endpoints.
• People and process - staff access to production systems is limited to those who need it and is bound by confidentiality duties.

5. Sub-processors

We use a small number of trusted providers to run the service. Each one is bound by a written agreement with data protection terms at least as strong as ours. Several of them are used only when you choose to switch on the related feature.

We will update this list before adding or replacing a sub-processor. Customers who have signed our DPA will be told in advance and may object on reasonable data protection grounds.

6. International data transfers

Where personal data is transferred outside the European Economic Area, the United Kingdom or Switzerland, we make sure it stays protected. We rely on adequacy decisions (including the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses and the UK Addendum, along with additional safeguards where needed.

7. Data subject rights

People whose data is in your CRM have the right to access, correct, delete, restrict, object to and move their personal data. SalesPeep helps you respond to these requests:

• Access and portability - view a full record and export data from your workspace;
• Correction - edit any lead, contact or company record directly;
• Erasure - delete records that you no longer have a reason to keep;
• Restriction and objection - archive a record, or remove a contact from active email sequences.

If someone contacts us directly about data held in your workspace, we will pass the request to you promptly and will not respond to it ourselves unless you ask us to. If you need extra help with a request, our support team is here.

8. Your responsibilities as controller

As the controller of the data in your CRM, you decide what data to collect and how to use it. In particular, you should:

• Have a lawful basis, such as consent or legitimate interests, for each contact you store and email;
• Tell people how you use their data, including if you use email open and click tracking;
• Respect opt-outs and remove people who ask not to be contacted;
• Give your users only the permissions they need for their role;
• Not store special category data unless you have a valid reason and the right safeguards.

9. Data retention and deletion

You control how long records stay in your workspace and can delete them at any time. When your subscription ends, you have 30 days to request an export of your data. We then delete workspace data from our live systems within 90 days. Any copies in backups are overwritten as part of our normal backup cycle.

10. Data breach notification

If we become aware of a personal data breach that affects your Customer Data, we will notify you without undue delay. We will tell you what happened, what data was involved, and what we are doing about it, so you can meet your own duty to notify the authorities within 72 hours where required. Where we are the controller, we will notify the relevant supervisory authority ourselves.

11. Contact and complaints

For any GDPR question, to request our DPA, or to exercise your rights over data that SalesPeep controls, please contact us:

SalesPeep - Data Protection
Website: www.salespeep.com
Email: info@salespeep.com

You also have the right to complain to the data protection authority in the country where you live or work. We would, however, appreciate the chance to resolve your concern first.