GDPR CRM: what to check before you store customer data

A GDPR CRM is not a product with a badge. It is a CRM plus the contracts, settings and habits that let you meet your own duties under the GDPR, and those duties sit with you as the controller: a lawful basis for each use of personal data, a data processing agreement with the provider that stores it, answers for people who ask what you hold, and deletion once you no longer need the data. A CRM vendor can make that easy or hard, but no CRM makes you compliant on its own.

This guide lists the duties that matter for a CRM with their article numbers, shows what to check in any vendor's contract and subprocessor list, walks through an access and an erasure request, and states where Customermates stands, including what it does not claim. Customermates publishes it and appears in labelled sections. It is general information, not legal advice: ask a lawyer or your data protection officer about your own case. The EU law sources and the Customermates legal pages were checked on 11 November 2026; the legal pages change, so read the current data processing agreement and subprocessor list before you rely on this page.

What does the GDPR require from a CRM?

The GDPR (Regulation (EU) 2016/679, text on EUR-Lex) does not certify software. It regulates the organisation that decides why and how personal data is used, the controller, and a provider that handles the data on its behalf, the processor. A CRM full of names, email addresses and conversations holds personal data, so you are the controller and the vendor that stores it for you is a processor. The table maps the duties that matter most for a CRM to the articles.

The European Commission's page on the principles of the GDPR gives the plain-language version, and the European Data Protection Board's Guidelines 07/2020 explain the controller and processor roles in detail. A CRM database built with these duties in mind starts with fewer fields and clear owners.

Is there such a thing as a GDPR-compliant CRM?

No CRM is GDPR compliant on its own. Compliance describes how you use a tool: what you collect, on which basis, how long you keep it and how you answer requests. What a vendor can honestly offer is narrower and checkable:

• a processor contract that covers Art. 28(3);
• a public subprocessor list and a stated process for changes;
• clear information on where data is processed and which mechanism covers any transfer outside the EEA;
• security measures written into the contract;
• product functions to find, correct, export and delete one person's data; and
• a way to leave: return or deletion of your data at the end.

Treat a badge such as "GDPR compliant" or "made in Europe" as a marketing claim. The GDPR provides for approved certification (Art. 42), so ask which certification, from which body, for which service. Customermates holds no compliance certification; hosting in an EU region is a hosting fact, not a certification.

Does it matter where the CRM vendor and its servers are?

Three places get mixed up: where the vendor is established, where its database runs, and where every other provider in the chain processes data. The GDPR does not require EU hosting. It restricts transfers outside the EEA (Arts. 44 to 46) and makes you answerable for the whole processor chain. A vendor in Germany can run its application at a US hosting provider, and a US vendor can run a database in Frankfurt. This is the real question behind a search for a German or an EU CRM: read all three places, not the headline.

For Customermates, the legal pages say this (as published on 11 November 2026):

The subprocessor list holds each provider with its purpose, location and transfer basis, and the security documentation explains tenant isolation and where credentials live. The summary: an operator in Germany, a database configured in an EU region, and US providers in the chain, which is why the list matters more than a country name.

What should a CRM data processing agreement contain?

Art. 28(3) lists the minimum content of a processor contract. Hold a vendor's agreement against points (a) to (h). The right column shows the Customermates DPA, whose section numbers refer to the published DPA.

Read the limits as well. The DPA states what it cannot promise: for connected accounts it has no contractual per-account deletion right against Unipile and can only request removal, and raw inbound records that cannot be attributed to a customer are kept for error analysis without a fixed period. A DPA that states its limits is easier to assess than one that states none.

Also check how it is concluded. Publishing a document does not conclude it: the Customermates DPA takes effect for a customer when an authorised administrator accepts it, together with the Terms, during onboarding, and a copy in text form is available on request. The German version is authoritative and the English one is a convenience translation.

How do you handle an access or erasure request in a CRM?

This is the test of any CRM setup: someone writes "what do you hold about me?" or "delete my data". The steps below use Customermates, and the order works in any tool.

1. Log the request and confirm who is asking

   Note the date you received it: the one-month period of Art. 12(3) starts then. Confirm identity in proportion to the data, without collecting more than you need to do so.

2. Find every record

   Press Cmd or Ctrl and K. Global search looks through every list you can read and finds a contact by any email address or phone number in their Contact details; search the name as well, and open linked organizations and deals. Conversations are not part of this search: the Inbox, available from Pro with a connected account, has its own search.

3. Collect the data

   Filter each list to the person, then choose Export as Excel or Export as JSON from More actions. The export contains what the list shows with your filters, up to 5,000 records, and only fields your role can read. Customermates has no whole-account export, so repeat this per list that holds the person, and add what sits in your email, spreadsheets and other tools.

4. Correct what is wrong

   Edit the value in place. That answers a rectification request under Art. 16; the Activity log records the change with the previous value, who made it and when.

5. Erase, then check the copies

   Delete moves the record to Trash and out of lists, search, widgets and exports. Open Trash and choose Delete permanently to erase it now, which also removes the record's field values from its history; otherwise it goes by itself after 30 days. Messages in a connected inbox are copies of messages in your email or messaging account, so the original needs the same decision. Ask how your vendor treats backups: the Customermates DPA names at most 90 days for the deletions it covers (Section 11).

6. Answer and record what you did

   Reply within the month and keep a note of the request, the decision and the date, so you can show it later (Art. 5(2)). For an objection to marketing (Art. 21(3)), add a Yes/No field such as Objected to marketing and leave those records out of every mailing list.

The Trash documentation covers restore and permanent deletion, and the records documentation covers filters, export and import.

How do you set up a CRM for the GDPR?

A checklist for the first week, before real customer data goes in:

1. Decide what each list stores

   Fewer fields mean less to protect, answer and delete (Art. 5(1)(c)). Write the purpose and the legal basis for each list in its description, and leave out special categories of data such as health data (Art. 9) unless you have a specific ground.

2. Give people only the access they need

   Roles grant Create, Edit, Delete and Read access (All, Assigned or None) per list. There are no field-level permissions, so keep sensitive information in a separate list with narrower access.

3. Plan how people leave

   Setting a member to Inactive blocks their access, API keys and MCP connections for the workspace at once.

4. Conclude the DPA and read the subprocessor list

   Keep your copy of the accepted version and look at the list again when a change notice arrives.

5. Connect only the channels you use

   Each connected account adds a provider to the chain and a stored copy of its messages. Disconnecting an account deletes that account's stored threads, messages, participants and calendar data, as the DPA describes.

6. Set a retention rule per list and run it

   Save a view of records not updated for the period you chose, review it on a schedule and delete what you no longer need. The GDPR leaves the period to you (Art. 5(1)(e)); where tax or commercial law requires you to keep a document, that duty applies on top.

7. Keep your own papers current

   The record of processing (Art. 30) and your privacy notice (Arts. 13 and 14) live in your compliance folder, not in the CRM vendor's documents.

What do AI features change under the GDPR?

An AI assistant adds providers to the chain and sends text from your records to them. For every AI feature, ask which provider receives which data, whether it is on the subprocessor list, where it processes, whether it trains on your data, and whether you can leave the feature off.

For Customermates Cloud, the subprocessor list describes Mate: a request goes through Vercel AI Gateway to the providers named in the table above and carries only what is needed for the reply. The list reports a zero-data-retention setting on that gateway path, which is a narrow control and not a retention promise for the CRM itself. The Claude models are pinned to an EU inference zone, while web search and the embedding model run in the USA. You decide which data a request contains and remain responsible for necessity and legal basis. If you connect your own AI client over MCP, that provider processes the data under your contract with it. Self-hosted instances have no Mate. The AI CRM guide compares the approaches.

Customermates and the GDPR: what it provides and what it does not

Provided, from the product documentation and the legal pages:

• the DPA and the subprocessor list for the managed cloud, with the change process described above;
• roles per list, a deactivation switch for members and tenant separation by company account;
• global search by email address or phone number, in-place correction, Excel and JSON export per list, and Trash with permanent deletion;
• an Activity log for changes to CRM records and workspace configuration, readable by roles that have access; and
• an open-source core under the AGPL that you can self-host.

Not provided, so ask for it elsewhere if you need it:

• Customermates has no compliance certification and no contractual guarantee that all data stays in one region;
• it has no field-level permissions and no export of a whole account in one step;
• its Activity log does not cover sign-ins, API keys or inbox content, and it has no export button.

Self-hosting changes who is responsible. The AGPL core runs with Docker and PostgreSQL on your infrastructure, and the DPA covers only the managed service: you pick the hosting and the providers and you hold your own Art. 28 contracts and transfer safeguards. TLS and encryption at rest are yours to set up. Self-hosting uses the Starter feature set, without the inbox and without Mate, and it is not air-gapped: the first address entry for a country downloads that country's public postal-code file from GeoNames unless you set POSTAL_CODE_DATA_URL to off or to a mirror. The self-hosting guide has the details, and the open-source CRM page explains the licence boundary.

To check the points above against your own case, read the DPA and the subprocessor list first, then start your 14-day trial: Pro, no credit card. Import a few test records before real customer data, and run the access request steps once.

Common questions about the GDPR and a CRM

Law and third-party sources checked on 11 November 2026: Regulation (EU) 2016/679 on EUR-Lex, the ePrivacy Directive, the European Commission's principles of the GDPR and the EDPB's Guidelines 07/2020. Statements about Customermates come from its DPA, subprocessor list and security documentation as published on that date.