Data Processing Agreement (DPA)

You, the customer, are the controller of the personal data you put into the service and decide the purpose and means of processing. Pipevale acts as the processor: we process that data solely on your instructions to provide the service. For your own account data — registration, payment — Pipevale is the controller; see the Privacy Policy.

The purpose of processing is to provide you with CRM functionality — storing records about clients, deals, tasks and communication. Processing lasts while your subscription is active and the data is held in your account, plus a reasonable period to delete it afterwards.

We process what you enter yourself: contact details of your clients and leads (name, phone, email, notes), deal history and communication. The data subjects are your clients, contacts and staff. You are responsible for having a legal basis to enter that data.

• process personal data only on your instructions;
• maintain confidentiality — only authorised people who are under a duty of confidence have access;
• apply appropriate technical and organisational measures: encryption, access control, isolation of each customer’s data, backups and logging;
• notify you without undue delay of security incidents affecting your data;
• assist you in meeting your security obligations and in responding to data subject requests.

Below is the named list of subprocessors as at the date of this agreement. We require them to maintain protection no lower than this agreement, and we announce material changes in advance so you can object.

Always involved (the service does not run without them)

Only if you enable them

These providers receive data only after you connect the corresponding feature, and only what that feature needs:

• Google — sign-in with a Google account and sending email from connected Gmail;
• messengers (Telegram, Viber, WhatsApp, Instagram Direct, Slack, Intercom) — conversations in the channels you connect;
• telephony (Binotel, Ringostat) — call logs and linking a call to a client record;
• an AI provider — under your own key and your own agreement with them; we have no separate arrangement with them on your behalf.

We do not pass your data to third parties for their own marketing and do not use it to train models.

If a data subject contacts us directly, we forward the request to you. At your request we provide technical assistance in fulfilling data subject rights — access, correction, deletion or restriction of processing — within the service.

Where processing involves transferring data outside Ukraine or the EEA, we apply appropriate legal and technical safeguards under applicable law, including standard contractual clauses.

When the service ends we will, at your choice, return or delete personal data, except where retention is required by law. Data from a deleted account is removed within a reasonable period.

On reasonable request we provide the information needed to demonstrate compliance with this agreement.

Processing is carried out under the Law of Ukraine “On Personal Data Protection”; for customers in the EU we follow GDPR principles.

Questions about data processing: hello@pipevale.com.