Last updated: October 2026
Draft notice: this page should be reviewed by a qualified professional before it is relied on.
Our role: processor, not owner
When we work inside your CRM, marketing platform, ecommerce store or integration tools, we act as a data processor. You (or your client, if you’re an agency) are the controller. You decide why customer data is collected and how it’s used. We only handle it to carry out the work you’ve asked for.
In practice, that means we see and work with customer data only as far as the project requires, and we don’t use it for any purpose of our own.
This is different from the information you give us when you fill in a form on this website. For that, CRMmentor is the controller, and our privacy policy applies.
What data we typically come across
What we see depends on your systems, but it commonly includes:
- contact details such as names, email addresses, phone numbers, job titles and company names
- marketing consent and subscription status
- engagement data such as email opens, clicks, form submissions and page or product views
- commercial data such as deals, orders, products purchased and order values
- notes, tasks and activity history recorded by your team
- custom properties your business has created
We don’t need special category data (such as health information) for our work. If your systems contain it, tell us before the project starts so we can agree how to avoid it or handle it appropriately.
How we handle it
Our commitments as a processor include:
- Acting on your instructions. We only process data to deliver the agreed scope, or as you instruct in writing.
- Confidentiality. Anyone working on your project is bound by confidentiality obligations.
- Security. We follow the practices on our security page, including least-privilege access, named seats, multi-factor authentication and careful handling of credentials and exports.
- Minimal copying. We work in your systems wherever possible. When an export is needed, it contains only the necessary fields and is deleted when the task ends.
- Helping with requests. If someone asks you to access, correct or delete their data and you need our help to do it within the systems we’re working on, we’ll assist.
- Incident notification. If we become aware of a personal data breach affecting your data, we’ll notify you without undue delay and give you the information you need to meet your own obligations.
- Return and deletion. At the end of the engagement, we remove our access and delete any copies of your data we still hold, unless the law requires us to keep something.
Sub-processors
To run our business we use a small number of tools, for example for secure file storage, password management, email and video calls. Some of these may come into contact with client data, for instance if a working export is stored temporarily or a screen is shared on a call. We’ll give you a list of sub-processors on request and tell you before adding a new one that would handle your data.
The platforms you already use, such as your CRM or email service provider, are your own processors, not ours. Your agreement with them covers their processing.
International transfers
Where providing our services involves transferring personal data to another country, and the law requires safeguards for that transfer, we put appropriate measures in place, such as standard contractual clauses. The details are set out in the data processing agreement.
Data processing agreements
We can sign a data processing agreement (DPA) for any engagement where we handle personal data on your behalf. You can use our standard DPA, or send us yours to review. Either way, we’ll agree on it before any access is set up.
A DPA typically records:
- the subject matter, duration, nature and purpose of the processing
- the types of personal data and the categories of people involved
- our obligations around instructions, confidentiality, security, sub-processors, assistance, breach notification and deletion
- how you can check that we’re meeting those obligations
To request one, contact us using the email address on our Contact page.
Agencies and white-label work
When we work for an agency on behalf of the agency’s client, we’re normally a sub-processor. The agency processes data for its client, and we process data for the agency. We can sign a DPA with the agency that mirrors the commitments it has made to its client. See agency partnership for how those engagements work.