This policy describes how the CRM (the “Service”) processes personal data, under the General Data Protection Regulation (GDPR) and the French Data Protection Act. The Customer (your company) is the controller of the data of its own customers and prospects entered into the Service; the publisher acts as a processor within the meaning of article 28 of the GDPR — see the data processing agreement (DPA).
| Category | Examples | Purpose |
|---|---|---|
| User accounts | Name, email, password (hashed), role | Authentication and access control |
| Customers & contacts | Company name, company/establishment numbers, address, contacts (name, email, phone, job title) | Managing the commercial relationship |
| Quotes & deals | Amounts, products, history of exchanges | Sales pipeline tracking |
| Telephony (optional module) | Numbers called/calling, duration, audio recording, transcript | Tracking commercial exchanges, service quality |
| Visit reports | Notes, transcribed voice dictation | Internal sales reporting |
| Financial data (optional module) | Financial health of customer companies (source: INSEE/Pappers) | Assessing commercial risk |
| Technical logs | IP address, timestamps of actions | Security, traceability (audit) |
| Data | Period |
|---|---|
| Customer accounts / contacts | Duration of the commercial relationship + 3 years (prospecting) |
| Quotes, deals | Duration of the subscription contract, then legal archiving (accounting obligations) |
| Call recordings | Configurable by the Customer's administrator (Settings > Telephony > Governance), 90 days by default. Automatic daily purge, including at the telephony provider (Twilio). |
| Audit logs | The retention period configured for call recordings (Settings > Telephony) |
| User account after termination | See Terms, termination section |
Depending on the modules enabled for your instance:
| Provider | Role | Location |
|---|---|---|
| Hostinger International Ltd (Cyprus) | Hosting of the application and the database | European Union |
| Twilio Inc. | Telephony (optional module) — calls, recordings | United States (standard contractual clauses) |
| OpenAI / Anthropic | AI transcription and rewriting (optional modules) | United States (standard contractual clauses) |
| Pappers / INSEE | Public company financial data (optional module) | France |
The exact list of active sub-processors depends on the modules subscribed to (Settings > Modules).
When the telephony module is enabled, calls may be recorded for sales follow-up purposes. Under the applicable regulations, informing the people being called (announcement message or prior contractual notice) is the Customer's responsibility. The publisher provides the technical means for automatic purging and for deleting an individual recording (including at the technical sub-processor), but cannot act in the Customer's place in informing the data subjects.
Anyone whose data is processed in the Service has the rights of access, rectification, erasure, restriction, objection and portability. Such requests should be addressed first to the Customer (the controller) who uses the Service to manage its commercial relationship. Failing a response from the Customer, a request may be sent to the publisher: contact@indusiax.com.
Everyone also has the right to lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr — or with the supervisory authority of their own country of residence.
Technical measures in place: hashed passwords (never stored in clear text), encrypted connection (HTTPS), sign-in attempt throttling, data partitioning by user role, encrypted daily backups, automatic purging of data according to the retention policy defined.