Legal information
Data processing agreement (DPA)
In force from 13 October 2026
Contents
1. Parties and scope
This agreement is part of the TDACRM Terms and conditions and applies automatically to every Customer. The Customer is the controller and SERVICII AMPLE S.R.L., IDNO 1016605002030 (the “Provider”), is the processor of the personal data the Customer uploads to or receives in TDACRM (the “Customer Data”).
The agreement meets the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR) and of Moldovan Law No. 195/2024 on personal data protection. If you need a signed copy, write to us at [email protected].
2. Subject matter and duration of processing
| Item | Description |
|---|---|
| Subject matter | providing the TDACRM Service: storing, organising and displaying data, receiving leads, sending messages and the integrations the Customer chooses |
| Duration | for the whole term of the contract, plus the export and deletion period in section 9 |
| Data subjects | the Customer’s clients, prospects and contacts; Users of the Customer’s account |
| Categories of data | identification and contact details (name, phone, email, company, city), information about enquiries and sales, communication history (notes, messages, emails, calls), uploaded files, custom fields, ad tracking data (for example UTM, campaign) |
The Customer does not upload special categories of data (for example health data) to TDACRM unless it has a legal basis and has taken the necessary measures.
3. The Customer’s instructions
We process Customer Data only on the Customer’s documented instructions (these terms, the settings and the actions taken in the application), including with regard to transfers. If an instruction seems to us to breach the law, we tell the Customer. We don’t use Customer Data for any other purpose, we don’t sell it and we don’t use it for advertising.
4. Confidentiality
People with access to Customer Data are bound by confidentiality and access it only as far as their work requires.
5. Security
We take technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:
- encrypted connections (HTTPS/TLS);
- separation of data between accounts and role-based access control;
- sign-in with passkeys and one-time codes, with extra confirmation for sensitive actions;
- regular backups and restore procedures;
- access logs and incident monitoring;
- regular system updates.
6. Sub-processors
The Customer gives us general authorisation to use sub-processors. We bind them by contract to data protection obligations at least equivalent to those in this agreement, and we remain responsible for them. We tell the Customer about any new sub-processor at least 30 days in advance; the Customer may object on reasonable grounds and, if no solution is found, terminate the contract.
We send the current list of sub-processors on request — write to [email protected].
7. International transfers
If a sub-processor processes data outside the Republic of Moldova or the European Economic Area, the transfer takes place only to countries with an adequate level of protection or on the basis of appropriate safeguards, for example the European Commission’s standard contractual clauses.
8. Assistance to the Customer
- Data subject requests. We help the Customer answer requests for access, rectification, erasure, restriction, portability and objection, mainly through the application’s features: search, edit, export, delete. Requests that data subjects send directly to us are passed on to the Customer.
- Data breaches. We inform the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Data, with the information available: the nature of the breach, the data concerned, the likely consequences and the measures taken.
- Assessments and consultations. We provide the information needed for a data protection impact assessment and for consulting the supervisory authority.
9. Return and deletion of data
When the contract ends, the Customer can export its data for 30 days. After that we delete the Customer Data, except data the law requires us to keep. Backups are overwritten in their normal cycle, within 30 days.
10. Audits
On request we give the Customer the information needed to demonstrate compliance with this agreement. On-site audits take place with at least 30 days’ notice, during business hours, under a confidentiality undertaking and at the Customer’s expense, no more than once a year, except after an incident or at an authority’s request.
11. Final provisions
Where they conflict, this agreement prevails over the Terms and conditions as regards data protection. The parties’ liability is governed by the Terms and conditions, except where the law does not allow limitations.