Data Processing Agreement
1. Scope & roles
Customer is the controller of personal data contained in workspace content; Glime is the processor. Glime processes such data solely to provide the service, on documented instructions, and never for its own purposes (including AI model training on shared models).
2. Categories
Data subjects: customer's customers, prospects, contacts, and employees. Data types: business contact details, deal and transaction data, communications metadata, and any content the customer stores. Special categories: not intended for the service; customer agrees not to store them.
3. Security measures (Annex II summary)
- AES-256 encryption at rest; TLS 1.2+ in transit; HSTS.
- Row-level tenant isolation; RBAC with field- and row-level security.
- Append-only audit logging of all processing operations.
- MFA for all Glime personnel; access on least-privilege, logged and reviewed quarterly.
- Encrypted backups, 35-day rotation, quarterly restore tests.
Full detail: glimecrm.com/security.
4. Subprocessors
Current list at glimecrm.com/legal/subprocessors. Customers receive 30 days' notice of additions and may object on reasonable data-protection grounds; unresolved objections permit termination of affected services with a pro-rated refund.
5. International transfers
Transfers outside the EEA/UK are covered by the EU Standard Contractual Clauses (Module 2) and the UK Addendum, incorporated by reference. Enterprise workspaces may elect EU-only residency for workspace content.
6. Data subject requests
Glime forwards any request received directly within 5 business days and provides self-serve export and deletion tooling so the customer can respond without Glime's involvement.
7. Incidents
Notification of a personal data breach without undue delay and within 48 hours of confirmation, including scope, data involved, and mitigation steps, followed by a written post-incident report.
8. Audit
Upon SOC 2 issuance, reports satisfy audit rights. Until then, Glime answers security questionnaires within 5 business days and permits one customer audit per year on 30 days' notice, at the customer's cost, under NDA.
9. Deletion
On termination or instruction: deletion within 30 days, backups within their 35-day rotation, written confirmation provided. Export remains available for 60 days post-termination.