This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Controller”) and Tecnospice Technologies (“Processor”, “Gro Wing CRM”). It governs the processing of personal data on the Controller's behalf.
This page is a v1 summary. For a signed, jurisdiction-specific DPA (including EU Standard Contractual Clauses), please email info@growingcrm.com.
1. Roles
- The Customer is the Controller of the personal data in its Gro Wing CRM workspace.
- Gro Wing CRM is the Processor and processes the data only per the Controller's instructions.
2. Scope of processing
- Subject matter: providing the Gro Wing CRM CRM service.
- Duration: for as long as the Controller's account is active + 30 days.
- Nature and purpose: storing, retrieving, transmitting, and processing sales-related personal data (leads, contacts, deals, communications).
- Categories of data subjects: the Controller's prospects, customers, and internal users.
- Categories of personal data: contact identifiers, communication records, engagement metadata.
3. Processor obligations
Gro Wing CRM shall:
- Process personal data only on documented instructions from the Controller.
- Ensure personnel authorized to process personal data are under a duty of confidentiality.
- Implement the technical and organizational security measures described in our Security page.
- Assist the Controller in responding to data-subject rights requests within reasonable time.
- Notify the Controller of any personal data breach within 72 hours of becoming aware.
- Delete or return all personal data at the end of the service (Controller's choice).
4. Sub-processors
The Controller authorizes Gro Wing CRM to engage the sub-processors listed on our Privacy Policy. Gro Wing CRM will provide at least 30 days' notice before engaging new sub-processors; the Controller may object on reasonable grounds.
Current sub-processors:
- Amazon Web Services, Inc. — hosting (Mumbai).
- Resend, Inc. — transactional email.
- Twilio, Inc. — telephony for AI voice.
- ElevenLabs, Inc. — voice synthesis for AI voice.
- Contracted LLM providers under zero-retention terms (list available on request under NDA).
5. International transfers
Where personal data is transferred outside the Controller's jurisdiction, Gro Wing CRM relies on appropriate safeguards including EU Standard Contractual Clauses (SCCs) for EU-origin data. Data-residency options are available for Enterprise customers.
6. Audits
The Controller may audit Gro Wing CRM's compliance with this DPA once every 12 months, with 30 days' notice, subject to a mutually agreeable scope and confidentiality. Gro Wing CRM will provide relevant certifications and audit reports in lieu where reasonable.
7. Liability
Each party's liability under this DPA is subject to the limitations of liability set out in the underlying Terms of Service.
8. Term and termination
This DPA remains in effect for the duration of the service and any period thereafter during which Gro Wing CRM continues to process personal data on behalf of the Controller.
9. Governing law
This DPA is governed by the same law as the underlying Terms of Service, unless otherwise required by applicable law.
10. Contact
DPA-related requests: info@growingcrm.com