VODOO CRMRetour

Legal

GDPR — Data Protection

Last updated: July 29, 2026 · Version 1.1

Our commitment: VODOO CRM is designed in compliance with the General Data Protection Regulation (GDPR — EU 2016/679). You remain the owner of your data. We process it solely to provide you with a quality service, never for resale purposes.

1. Context and scope

The GDPR is the European regulation on the protection of personal data, applicable since May 25, 2018. It applies to any processing of personal data concerning residents of the European Union, regardless of the location of the data controller.

ALTIORAT LLC, publisher of VODOO CRM, is committed to respecting GDPR principles for all its users, whether or not they are EU residents.

2. Roles in the processing chain

2.1 VODOO CRM as data processor

When you use VODOO CRM to manage your own clients' data (contacts, prospects, communication history...), you are the data controller and VODOO CRM is your data processor within the meaning of Article 28 of the GDPR.

As such, VODOO CRM commits to:

  • Process data only on your documented instructions
  • Guarantee the confidentiality of processed data
  • Notify you of a data breach within 72 hours
  • Assist you in exercising the rights of your own users
  • Delete or return data at the end of the contract

Data received from Meta platforms: when you connect a WhatsApp Business, Instagram or Messenger channel, VODOO CRM receives and stores on your behalf the conversations and messages exchanged with your customers (text content, attachments, timestamps) as well as the sender's identifier (WhatsApp number, Instagram or Messenger ID). This data is used solely to display, route and archive your conversations within the CRM: it is never sold or used for advertising purposes, and it is erased together with your organization (see section 4).

2.2 VODOO CRM as data controller

For your account data (personal information, billing, platform usage), as well as for waitlist signups on try.vodoocrm.com, VODOO CRM is the data controller. Details are described in our Privacy Policy.

3. Your GDPR rights

As a data subject, you benefit from the following rights:

Right of access (Art. 15)

You can obtain confirmation that your data is being processed and receive a copy. In VODOO CRM, you can export your data directly from your account settings.

Right of rectification (Art. 16)

You can correct inaccurate data about you directly from your profile, or by contacting us.

Right to erasure — "right to be forgotten" (Art. 17)

You can request the deletion of your data when its processing is no longer necessary, subject to legal retention obligations. The account owner can also trigger this deletion directly, without contacting us, from Settings → General → Delete organization.

Right to portability (Art. 20)

You can receive your data in a structured, commonly used and machine-readable format (CSV, JSON). Export is available in your account settings.

Right to object (Art. 21)

You can object to the processing of your data for commercial prospecting purposes or based on VODOO CRM's legitimate interest.

Right to restriction of processing (Art. 18)

You can request restriction of processing in certain circumstances (e.g., contesting data accuracy).

Right to withdraw consent (Art. 7)

When processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.

4. How to exercise your rights

To exercise one of these rights:

  1. By email: send your request to contact@vodoocrm.com clearly specifying the right you wish to exercise and attaching proof of identity if necessary.
  2. Directly in the application: exporting your data and editing your profile can be done from your account settings. Permanent deletion is self-service too, without going through us: Settings → General → Delete organization (restricted to the account owner, confirmed by typing the word "DELETE"). It immediately and irreversibly erases all related data: contacts, pipelines, automations, as well as conversations and messages received from WhatsApp, Instagram and Messenger.
  3. Waitlist: the "Unsubscribe in one click" link in every email removes you from the list immediately — no email to send, no reason to give.

We commit to responding to any request within one month (extendable by two months for complex requests, with notification).

5. Data transfers outside the EU

Some of our sub-processors are established in the United States (Vercel, Stripe, Resend, Twilio, Meta, Inngest). These transfers are governed by:

  • Standard Contractual Clauses (SCCs) adopted by the European Commission
  • The EU-US Data Privacy Framework (for certified sub-processors)
  • Appropriate contractual and technical guarantees

6. Security and data breaches

VODOO CRM implements technical and organizational measures to protect your data (TLS encryption, tenant isolation via Row Level Security, restricted access). In the event of a personal data breach likely to create a risk to your rights, we will notify the competent authority within 72 hours and inform you without undue delay if the risk is high.

7. Data Protection Officer (DPO)

VODOO CRM is not subject to the obligation to formally designate a DPO. However, any request relating to data protection can be addressed to: contact@vodoocrm.com

8. Complaint to a supervisory authority

If you believe your rights are not being respected, you may lodge a complaint with the data protection authority in your country of residence: