GDPR & data subject rights.
Solar CRM is committed to GDPR compliance. This page explains our legal bases for processing, your rights as an EU/EEA data subject, our Data Processing Agreement, and how to contact our DPO.
Key highlights
DPA available
A signed Data Processing Agreement is available to all customers on request.
SCCs for EU transfers
EU/EEA data is transferred only under EU Standard Contractual Clauses.
30-day response SLA
We respond to all data subject requests within 30 calendar days.
Privacy by design
Data minimisation, purpose limitation and storage limits built into our architecture.
Who we are
Solar CRM Technologies Pvt. Ltd. (“Solar CRM”) is the data controller for personal data collected directly from you (e.g. account registration, billing).
When you use Solar CRM to manage your own customers' data, Solar CRM acts as a data processor on your behalf and you are the data controller. Our obligations as a processor are documented in our Data Processing Agreement (DPA), available on request.
Our Data Protection Officer can be reached at [email protected].
Lawful bases for processing
Under GDPR Article 6, we rely on the following lawful bases:
| Processing activity | Lawful basis |
|---|---|
| Providing the Solar CRM platform | Contract (Art. 6(1)(b)) |
| Billing and invoicing | Contract + Legal obligation (Art. 6(1)(b)(c)) |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Product analytics (anonymised) | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Legal compliance and law enforcement requests | Legal obligation (Art. 6(1)(c)) |
Your rights as a data subject
Under GDPR, EU/EEA residents have the following rights:
| Right | What it means | How to exercise |
|---|---|---|
| Access (Art. 15) | Obtain a copy of your personal data and information about how it is processed | Email [email protected] |
| Rectification (Art. 16) | Correct inaccurate or incomplete data | Settings → Profile, or email us |
| Erasure (Art. 17) | Request deletion of your personal data | Email [email protected] |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format | Settings → Export Data |
| Restriction (Art. 18) | Restrict processing while a dispute is resolved | Email [email protected] |
| Objection (Art. 21) | Object to processing based on legitimate interests or for direct marketing | Unsubscribe link or email us |
| Withdraw consent (Art. 7(3)) | Withdraw consent at any time without affecting prior processing | Unsubscribe link or email us |
We respond to all requests within 30 calendar days. Where a request is complex, we may extend by a further 60 days with notice. We will never charge you for exercising your rights.
Data Processing Agreement (DPA)
If you are a business customer using Solar CRM to process personal data on behalf of your own customers (e.g. lead data, contact information), you are acting as a data controller and Solar CRM is your data processor.
GDPR Article 28 requires a written DPA between controller and processor. Our standard DPA covers:
- Subject matter, duration, nature and purpose of processing.
- Type of personal data and categories of data subjects.
- Obligations and rights of both parties.
- Sub-processor authorisations and change notification procedure.
- Security measures and breach notification (72-hour obligation).
- Audit rights and assistance with data subject requests.
To request a signed DPA, email [email protected] with your company name and registration details.
International data transfers
Solar CRM is headquartered in India. When we transfer EU/EEA personal data outside the EEA, we rely on:
- Standard Contractual Clauses (SCCs) — the EU Commission-approved 2021 SCCs are incorporated into all our sub-processor agreements involving EU data.
- Adequacy decisions — where the European Commission has recognised an adequate level of protection.
A copy of our SCCs and a full list of sub-processors is available at [email protected].
Sub-processors
We use the following sub-processors when processing EU/EEA personal data. We will notify you of any new or replaced sub-processors at least 30 days before the change takes effect:
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services | Hosting & storage | India (ap-south-1) | SCCs |
| Stripe | Payment processing | USA | SCCs + adequacy |
| Razorpay | Payment processing | India | SCCs |
| Postmark | Transactional email | USA | SCCs |
| Mixpanel | Product analytics | USA | SCCs |
| Intercom | Support chat | USA | SCCs |
Technical & organisational measures (TOMs)
In accordance with GDPR Article 32, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk:
- Pseudonymisation and encryption of personal data (AES-256 at rest, TLS 1.3 in transit).
- Ongoing confidentiality, integrity, availability and resilience of processing systems.
- Rapid restoration of availability following a physical or technical incident (daily backups, 30-day retention).
- Regular testing and evaluation — annual penetration tests and internal security audits.
- Role-based access control (RBAC), MFA for admin accounts, least-privilege principle.
- Documented incident response procedure with 72-hour breach notification to supervisory authorities.
Data breach notification
In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, we will:
- Notify the relevant supervisory authority within 72 hours of becoming aware (GDPR Art. 33).
- Notify affected data subjects without undue delay if the breach is likely to result in high risk (GDPR Art. 34).
- Notify you (as data controller, if we are acting as processor) within 48 hours of becoming aware.
Breach notifications will include: nature of breach, categories/approximate number of data subjects affected, likely consequences, and measures taken or proposed.
Retention & deletion
We apply strict retention limits in line with the GDPR data minimisation principle:
| Data category | Retention period |
|---|---|
| Account & profile data | Duration of account + 90 days after deletion |
| Financial records | 7 years (Indian legal requirement) |
| Application logs | 12 months (then anonymised) |
| Marketing consent records | Until withdrawn + 3 years (evidence of consent) |
| Support ticket data | 3 years after ticket closure |
| Backup copies | Rolling 30-day cycle |
Contact our DPO
- Email: [email protected]
- For data subject requests: [email protected]
- Post: Solar CRM Technologies Pvt. Ltd., Koramangala, Bengaluru 560034, Karnataka, India.
- Response time: within 30 days of receipt.