GDPR Compliance

• MrGeeksCRM as controller — for your account details, billing records, and usage data, we decide how and why the data is processed.
• MrGeeksCRM as processor — for the content your workspace stores in the platform (customer contacts, chat conversations, deals, and documents), the workspace owner is the controller. We process that data only on documented instructions, as set out in our Data Processing Agreement.

We offer a DPA incorporating the GDPR's Article 28 processor terms and, where relevant, Standard Contractual Clauses. Customers who need a countersigned copy can request one at legal@mrgeekscrm.com.

As a controller, we rely on contract performance, legitimate interests, consent, and legal obligations, as described in our Privacy Policy. As a processor, the workspace owner is responsible for establishing a lawful basis for the personal data they collect — for example, obtaining any consent required to message their customers on WhatsApp or other channels.

Under the GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you;
• Rectification — correct inaccurate or incomplete data;
• Erasure— request deletion ("right to be forgotten") where there is no overriding reason to keep it;
• Restriction — limit how we process your data in certain circumstances;
• Portability — receive your data in a structured, machine-readable format;
• Objection — object to processing based on legitimate interests or used for direct marketing;
• Withdraw consent — at any time, without affecting prior processing;
• Complain — lodge a complaint with your local supervisory authority.

How to exercise your rights

Email privacy@mrgeekscrm.com and we will respond within one month. Many requests can also be handled directly from your account settings (profile edits, data export, account deletion). If your data was entered into MrGeeksCRM by one of our customers, direct your request to that business — as their processor we will assist them in fulfilling it.

We use a limited set of vetted sub-processors for hosting, payment processing, email delivery, error monitoring, and messaging-channel connectivity (including Meta for WhatsApp, Instagram, and Messenger). Each is bound by a written agreement imposing data protection obligations no less protective than our DPA. A current list is available on request at legal@mrgeekscrm.com, and customers are notified in advance of material changes.

Where personal data is transferred outside the EEA, the UK, or Switzerland, we use recognised safeguards — primarily the European Commission's Standard Contractual Clauses and the UK Addendum — together with supplementary technical measures such as encryption in transit.

• Encryption of data in transit (TLS);
• Role-based access control and workspace-level permissions;
• Audit logging of administrative actions;
• Least-privilege access for our personnel, under confidentiality obligations;
• Continuous monitoring, error tracking, and regular backups;
• Vendor due diligence and data processing agreements.

We maintain an incident response process. Where a personal data breach is likely to result in a risk to individuals, we will notify affected customers without undue delay after becoming aware of it, and in any event within the timeframes the GDPR requires, providing the information controllers need for their own notification obligations.

Workspace data is retained while the subscription is active. On termination, controllers can export their data for a limited period, after which it is deleted from production systems and expires from backups on a rolling schedule. Account and billing records are retained as required by tax and accounting law.

For GDPR matters, contact our privacy team at privacy@mrgeekscrm.com or our legal team at legal@mrgeekscrm.com. You also have the right to contact the supervisory authority in your country of residence or place of work.