GDPR document for customers
GDPR in FluxCRM: you are the controller, FluxLab is the processor
Who is responsible for what, what data the CRM holds, how to handle a data subject request, and what leaves the server.
You handle data subject rights from the panel: access, rectification, erasure (anonymisation), withdrawal of consent.
Information template for legal review. English translation for convenience: the Polish version prevails. The document describes product features and the division of roles. It is not legal advice. The processing agreement, the privacy policy and the terms of service are separate documents.
Roles
| Role | Who | Responsible for |
|---|---|---|
| Controller | Your company | the legal basis, the duty to inform customers, decisions on purposes and retention time |
| Processor | Paweł Iwanek (FluxLab), ul. Żołnierska 10/36, 20-801 Lublin, tax no. 7123336008, pawel@fluxlab.pl | hosting and maintenance of the instance, security measures, help with data subject rights, reporting breaches |
The relationship is governed by the data processing agreement (Art. 28 GDPR). Template: docs/prawne/umowa_powierzenia.
What data the CRM holds
| Category | Examples | Where from |
|---|---|---|
| Contact data | first and last name, email, phone, company, job title | form, mail, phone, manual entry |
| Correspondence content | the beginning of an email, text messages, notes from calls | mailbox, adviser's phone, notes |
| Commercial data | offers, amounts, stages, tasks, pro forma invoices | team work |
| Form data | page address, campaign parameters (UTM), visit source | form on the website |
| Consents | kind, date, source, text and proof of the consent | form, conversation, email |
| Credit data (credit industry instances) | application amounts, bank decision status, refusal reasons, case documents | advisers' work |
| Controller's staff data | login, name, role, IP address in logs, audit entries | user accounts |
We do not process special categories of data within the meaning of Art. 9 GDPR as such, but credit data and scans of documents can contain high-risk data (national ID numbers, income). For such instances we recommend carrying out an impact assessment (template: DPIA for credit data).
Sub-processors
The list below matches the product code. Each entity is named with a condition: whether it always applies or only after a feature is switched on.
| Entity | For what | What data | When | Location |
|---|---|---|---|---|
| OVH SAS | hosting of the VPS server with the instance, copies on the server | all instance data | always | EU (by IP address: Poland, to be confirmed in the OVH panel) |
| Anthropic PBC | language models: reply drafts, summaries, opportunity score, assistant, credit conversation preparation, title translations | the conversation of one opportunity and its context, for the time of the task | only after [tlumaczenie] is switched on and with the Controller's consent | USA (transfer mechanism in the agreement) |
| SMSAPI (SMSAPI.pl) | sending text messages to customers | phone number and the text message | only when [sms] dostawca = smsapi | Poland |
| Google (Google Ireland Limited and Google LLC) | OAuth sign-in to the Controller's Gmail mailbox (IMAP), the push notification service for Chrome and Android | mailbox access token, encrypted notifications | only when the mail source is Gmail or push notifications are on | EU / USA |
| Apple, Mozilla, Microsoft | transport of push notifications to the PWA (iPhone, Firefox, Edge) | encrypted notification payload | only after push notifications are switched on on the phone | USA / EU |
In addition:
- Tailscale is used only for private access to FluxLab's internal instance. It does not process customers' instance data and is not a sub-processor for them.
- The Controller's mail (Zoho, Gmail, Microsoft, own server) is the Controller's service: the CRM reads it over IMAP read-only and does not change messages.
- Public registers (KRS, CEIDG, the MF taxpayer whitelist, NBP) receive only tax and registry numbers of companies and are available only after the relevant feature is switched on.
- Orange Polska and other telephone operators are the Controller's suppliers: they pass text messages and call data on the company number to the CRM.
- Monitoring sends alerts about the instance state (without personal data) by email to FluxLab.
We notify changes to this list in advance, within the period set in the processing agreement.
Data location
The database and copies of the instance are on a VPS server at the OVH provider in the European Union. Outside the EEA the data can go only to Anthropic, and only when the Controller switches on features based on the model. By default nothing leaves the server.
Consent to AI processing
The instance can require the customer's consent before their data is processed by a language model. The consent is a separate record of the opportunity (given by the customer in the portal, or entered by an adviser after a conversation, with the source and proof). Without consent, the model routes for that opportunity are blocked. The customer can withdraw the consent at any time in the portal. Every use of AI is described and reviewed in the ethical review register, and replies drafted with AI can carry a note that AI was used.
Rights of data subjects
| Right | How to handle it in the CRM |
|---|---|
| Access and a copy of data (Art. 15, 20) | the owner opens the opportunity and chooses the export of the person's data (GET /api/leady/<id>/eksport_rodo): everything the CRM holds about that opportunity in one JSON file. The export leaves an audit entry |
| Rectification (Art. 16) | editing data in the opportunity card and in people |
| Erasure, right to be forgotten (Art. 17) | anonymisation of the opportunity with the fluxcrm retencja command or on request, see below |
| Restriction of processing (Art. 18) | withdrawing consents in the card and closing the opportunity as lost: the data stays recorded, but the team takes no further action (set this in an internal procedure) |
| Objection and withdrawal of consent (Art. 21, 7) | withdrawing consent in the card; the record stays as proof that the consent existed and when it was withdrawn |
| Complaint to the authority | we state the right to lodge a complaint with the President of the Personal Data Protection Office in the information clause |
Process: the right to be forgotten
- The request reaches the Controller (or FluxLab, which passes it to the Controller within the period in the processing agreement).
- The Controller verifies the identity of the requester and checks whether there is a duty to keep the data (invoice, pro forma, dispute).
- The Controller orders anonymisation. The operator runs
fluxcrm retencja --na-sucho(a preview) and then the actual anonymisation of the opportunity. Personal data (name, company, email, phone, message and attachment content, notes, people, tags, fields) is replaced by a hash and the marker "Anonymised #id". - What stays are the numbers for statistics (source, dates, status, amounts, applications without content, attribution) and the proof of consents. We do not touch pro forma invoices or companies' registry data, because accounting duties require it.
- Mail stays on the Controller's mail server: it is deleted there.
- The operation leaves an audit entry (who, when, how many opportunities). The answer to the requester: within 30 days of the request.
Backups that contain data from before the anonymisation expire according to the backup retention (hourly copies 2 days, daily copies from 14 to 30 days), so the data disappears completely after that period.
In the panel (opportunity card, section "Customer data (GDPR)", owner only) every request is logged with the request date and a 30-day deadline. "Readable export" gives an HTML or PDF file with the person's data (opportunity, events, messages, files, change history) and "JSON export" a machine-readable version. "Forget customer" needs double confirmation (a dialog and typing the word ZAPOMNIJ), makes a database copy in the kopie_rodo folder before anonymising (the copy expires after 30 days) and records the completion in the log. The record of processing activities, built from the instance configuration (sources, channels, sub-processors), can be downloaded with the "Record of processing (HTML)" button.
Retention
Automatic anonymisation is off by default. It is switched on with the instance's [retencja] section: lost opportunities without activity after 365 days, opportunities without contact after 180 days (the values can be changed, 0 switches the rule off). It never anonymises won opportunities, ones with a pro forma invoice, or ones with a bank application in progress. The retention time is set by the Controller according to their legitimate interest; we recommend writing it in the privacy policy.
Consents
Consents (marketing, processing, credit bureau) are saved with a date, source and proof, and a warning about missing consent to processing is switched on in the instance configuration. An opportunity without consent lands in the "To complete" counter. Withdrawing a consent does not delete the record that it was given.
Information clause for forms
A template to place next to the contact form on the Controller's website (template for legal review, fill in the fields in brackets):
The controller of your data is [full company name], [address], [tax number]. We process the form data (name, email, phone, message text) to answer your enquiry and prepare an offer (Art. 6(1)(b) and (f) GDPR), and if you give consent, also for marketing purposes (Art. 6(1)(a)). We keep the data until the matter is settled and for [period] after it ends. The recipients of the data are IT service providers, including the processor running the CRM system (FluxLab). You have the right of access to the data, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent at any time without affecting the lawfulness of processing before its withdrawal. You can also lodge a complaint with the President of the Personal Data Protection Office. Contact: [data protection email].
For marketing consent use a separate check box, not ticked by default, with the text: "I consent to receiving commercial information from [company] by electronic and telephone means". Pass the value of this field in the zgody.marketing field (form guide), and the CRM will record the proof.
Personal data breaches
Procedure: FluxLab reports a confirmed breach to the Controller without undue delay, within the period in the processing agreement (24 hours from confirmation is recommended), so that the Controller can notify the supervisory authority within 72 hours of confirmation (Art. 33 GDPR). The report contains a description, the categories and number of people and records, the consequences, the remedial measures and a contact. The full internal procedure: the "72-hour incident procedure" document.
Training of users
Every new CRM user should go through a short GDPR training (material: the document "GDPR training for CRM users"). The most important rules: do not copy customer data outside the CRM, do not share your account, close sessions on other people's devices, report every incident at once.