Data Processing Agreement (DPA)

This Data Processing Agreement applies where CVR Pilot acts as a processor on the Customer's behalf (e.g. hosting the Customer's own workspace/account data and any data the Customer uploads or configures). For the B2B lead dataset CVR Pilot builds from public sources, CVR Pilot is an independent controller and the Customer becomes an independent controller on export – that relationship is governed by the Privacy Policy, not by this DPA. See §2 (Roles) for the split.

Parties

• Processor: CVR Pilot ApS, CVR no. 46694562, Kastanien 8, 2. tv, 7120 Vejle Øst, Denmark. Contact: privacy@cvrpilot.dk.
• Controller ("Customer"): the business that has accepted CVR Pilot's Terms of Service and, by that acceptance, enters into this DPA.

This DPA forms part of and is incorporated by reference into the CVR Pilot Terms of Service. Where this DPA conflicts with the Terms in respect of the processing of personal data by CVR Pilot as processor, this DPA prevails. It gives effect to Article 28(3) GDPR (Regulation (EU) 2016/679).

1. Definitions

Terms not defined here have the meaning given in the GDPR. "GDPR" means Regulation (EU) 2016/679 and, where applicable, the Danish Data Protection Act (databeskyttelsesloven). "Customer Personal Data" means personal data CVR Pilot processes on the Customer's behalf under the Terms (see Annex I). "Sub-processor" means a third party engaged by CVR Pilot to process Customer Personal Data. "Data Subject", "processing", "controller", "processor", "personal data breach" and "supervisory authority" have their GDPR meanings. The competent supervisory authority is Datatilsynet (the Danish DPA).

2. Roles and scope

2.1 For Customer Personal Data (Annex I), the Customer is the controller and CVR Pilot is the processor. CVR Pilot processes Customer Personal Data only to provide the Service and only on the Customer's documented instructions (§3).

2.2 For the B2B lead/prospect dataset CVR Pilot assembles from public sources (public company websites and directories, Google Maps/Places, and the CVR business register), CVR Pilot is an independent controller. When the Customer exports leads into its own systems, the Customer becomes an independent controller for its own use of that data and is responsible for the lawfulness of its outreach (GDPR + Danish markedsføringsloven § 10). That processing is not governed by this DPA; see the Privacy Policy §4–§5. This DPA does not make CVR Pilot the Customer's processor for the lead dataset.

2.3 Where the lead/prospect dataset concerns sole proprietorships (enkeltmandsvirksomheder) or other personally-owned businesses (PMV), the relevant business-contact data may constitute personal data under the GDPR – unlike incorporated entities such as ApS/A/S, which are separate legal persons. CVR Pilot processes such data as independent controller under the Privacy Policy (legitimate interests, Art. 6(1)(f), with a maintained balancing test), applies the data-subject rights and CVR reklamebeskyttelse screening described there, and does not collect or resell owners'/employees' private email addresses or mobile numbers without a valid legal basis – it limits itself to publicly available business master-data. When role search is switched on, CVR Pilot also collects, as independent controller, named employees' work contact data from the company's own website: name, job title and, where the company printed them next to the name, a direct phone number and a work e-mail on the company's own domain. That processing is likewise outside this DPA (see Privacy Policy §4a). On export, the Customer becomes independent controller for its own use of any such personal data.

2.4 CVR Pilot CRM. For the companies, contacts, deals, tasks, notes, e-mails, calendar bookings and call logs the Customer stores in CVR Pilot CRM (crm.cvrpilot.dk, included in the Growth plan), the Customer is the controller and CVR Pilot is the processor. This includes the content of e-mails synced from the mailbox the Customer connects and of e-mails sent through sequences. Annex I describes this processing.

3. Controller instructions

3.1 CVR Pilot processes Customer Personal Data only on the Customer's documented instructions, including as to international transfers, unless required otherwise by EU or Danish law (in which case CVR Pilot informs the Customer of that legal requirement before processing, unless the law prohibits it on important grounds of public interest).

3.2 The Customer's complete and final instructions are: (a) this DPA and the Terms; (b) the configuration and features the Customer uses in the Service; and (c) any further written instruction the Customer gives via privacy@cvrpilot.dk. The Service, its documentation, and this DPA reflect the ordinary instructions for the agreed subject-matter (Annex I).

3.3 CVR Pilot will inform the Customer if, in its opinion, an instruction infringes the GDPR or other data-protection law (GDPR Art. 28(3), final paragraph). CVR Pilot may suspend the processing concerned until the instruction is confirmed or amended.

4. Subject-matter, duration, nature and purpose (Art. 28(3) chapeau)

• Subject-matter: provision of the CVR Pilot B2B lead-generation SaaS to the Customer.
• Duration: for the term of the Terms/subscription and until deletion/return under §11.
• Nature and purpose: hosting and operating the Customer's workspace and account; storing and securing account, authentication, billing-metadata and configuration data; enabling exports and CRM integrations the Customer sets up; providing support; and operating, securing and troubleshooting the Service. Full details in Annex I.
• Type of personal data and categories of data subjects: see Annex I.

For CVR Pilot CRM the nature and purpose additionally comprise: storing the Customer's CRM records; reading e-mail from, and sending e-mail through, the mailbox the Customer connects (Gmail, Microsoft 365 or IMAP), subject to the Customer's blocklist of senders and domains; measuring opens and clicks on sequence e-mails; pulling meetings from Calendly, Google Calendar, Microsoft 365 or an iCal feed; storing call logs from the Customer's own Twilio account; and serving CRM data to the API tokens and outgoing webhooks the Customer creates.

5. Confidentiality

CVR Pilot ensures that persons authorised to process Customer Personal Data are bound by confidentiality (contractual or statutory) and process the data only as instructed. Access is on a least-privilege, need-to-know basis.

6. Security of processing (Art. 32)

CVR Pilot implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The measures actually in place are set out in Annex II and include, in summary: EU data residency; TLS/HTTPS in transit with HSTS; passwords hashed with scrypt (memory-hard, work factor 2^15); authenticated encryption of stored OAuth/integration tokens (stdlib encrypt-then-MAC, HMAC-SHA256) keyed off a secret held only in the environment, never in the database; client-side AES-256 encrypted, off-box backups in the EU; tenant isolation; session tokens that are random, HttpOnly and revocable, with expiry; strict HTTP security headers; rate-limiting and a bot shield; least-privilege access; and a tamper-evident audit log. CVR Pilot may update measures provided the level of security is not materially reduced.

7. Sub-processors (Art. 28(2), 28(4))

7.1 The Customer gives general authorisation for CVR Pilot to engage sub-processors. The current list is reproduced at Annex III. CVR Pilot imposes on each sub-processor, by written contract, data-protection obligations equivalent to those in this DPA (in particular Art. 32 security), and remains fully liable to the Customer for a sub-processor's failure to meet those obligations.

7.2 Change notification. Before adding or replacing a sub-processor, CVR Pilot will give the Customer at least 30 days' prior notice (by email and/or by updating the sub-processor list with a dated entry), so the Customer has a reasonable opportunity to object on reasonable data-protection grounds. If the Customer objects and the parties cannot resolve it, the Customer may terminate the affected part of the Service.

8. Assistance with data-subject rights (Art. 28(3)(e))

Taking into account the nature of the processing, CVR Pilot assists the Customer with appropriate technical and organisational measures, insofar as possible, to fulfil the Customer's obligation to respond to requests to exercise Data-Subject rights (access, rectification, erasure, restriction, portability, objection). In practice, for Customer Personal Data: the Customer can self-serve via the in-app Settings → Billing and data (export the workspace data as JSON; delete the account and its data); CVR Pilot additionally assists on request via privacy@cvrpilot.dk. Where CVR Pilot receives a request from a Data Subject that relates to Customer Personal Data, it will not respond directly (save to acknowledge and redirect) but will forward it to the Customer without undue delay, per CVR Pilot's internal data-subject-rights workflow.

9. Assistance with controller obligations (Art. 28(3)(f), Art. 32–36)

CVR Pilot assists the Customer, taking into account the nature of processing and the information available to it, in ensuring compliance with the Customer's obligations under Art. 32–36, i.e. security of processing, personal-data-breach notification, communication to data subjects, data protection impact assessments and prior consultation.

10. Personal-data-breach notification (Art. 33(2))

CVR Pilot notifies the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal-data breach affecting Customer Personal Data. The notice will describe, to the extent known: the nature of the breach and categories/approximate numbers of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact point. CVR Pilot will provide further information as it becomes available and cooperate so the Customer can meet its own Art. 33/34 obligations. (CVR Pilot reports breaches affecting data for which it is controller directly to Datatilsynet under Art. 33.)

11. Return or deletion on termination (Art. 28(3)(g))

11.1 On termination of the Service, and at the Customer's choice, CVR Pilot deletes or returns all Customer Personal Data and deletes existing copies, unless EU or Danish law requires storage (e.g. bookkeeping records kept under the Danish Bookkeeping Act, typically 5 years).

11.2 Deletion mechanics. Account/workspace deletion is a two-step, email-confirmed erasure that removes the workspace data from the live database immediately, cancels the Stripe customer, and purges CRM tokens, integration state and tied contact/support records. Deletions propagate to encrypted backups within the backup-retention window (target 30 days); because backups are point-in-time, CVR Pilot maintains an out-of-band erasure log that is replayed on restore/boot so that restoring an older backup does not resurrect erased data.

11.3 CVR Pilot confirms deletion in writing on request.

11.4 CVR Pilot CRM. Records the Customer deletes in the CRM stay in a trash for 30 days and are then purged. When the Customer's Growth plan ends, the CRM is locked to read and export for 30 days and the workspace's CRM data is then erased. On account deletion the CRM workspace is erased within 30 days. The Customer can export its CRM data at any time. CRM backups are taken nightly and roll off within the backup-retention window in §11.2.

12. Audit rights (Art. 28(3)(h))

12.1 CVR Pilot makes available to the Customer the information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

12.2 In practice, CVR Pilot first satisfies audit requests by providing this DPA, the sub-processor list, Annex II security documentation, and any available reports/certifications. If that is insufficient, the Customer may request an audit on reasonable prior written notice (at least 30 days), no more than once per 12 months (unless required by a supervisory authority or following a breach), during business hours, without unreasonable disruption, and subject to confidentiality. Each party bears its own costs of an audit.

13. International transfers (Chapter V)

13.1 CVR Pilot processes and stores Customer Personal Data in the EU by default (hosting and backups in Frankfurt/fra1; email via EU providers) – see Annex III.

13.2 Where a sub-processor processes Customer Personal Data outside the EU/EEA, the transfer is covered by an appropriate Chapter V safeguard, namely the Standard Contractual Clauses (SCCs) and/or the recipient's EU-US Data Privacy Framework certification, together with any supplementary measures required. This applies in particular to the US sub-processors: Anthropic (AI enrichment), Google / Google Places (sign-in; company discovery) and Stripe (payments), and to Cloudflare (bot shield) and Slack (internal team notifications). The Customer authorises these transfers as instructions under §3. Copies of the relevant safeguards are available via privacy@cvrpilot.dk.

13.3 For CVR Pilot CRM, and only when the Customer connects the service in question, §13.2 also covers Google (Gmail API / Google Calendar API), Microsoft (Graph / Exchange Online) and Calendly. Twilio is engaged by the Customer directly (the Customer is Twilio's contracting party); CVR Pilot only stores the call logs the Customer's Twilio account returns.

14. Liability, term and general

This DPA takes effect when the Customer accepts the Terms and lasts as long as CVR Pilot processes Customer Personal Data. Liability is governed by the limitation-of-liability provisions of the Terms. Governing law: Denmark; disputes as per the Terms. If a provision is invalid, the rest stands. This DPA (with its Annexes, the Terms and the Privacy Policy) is the entire agreement on this subject-matter.

Annex I – Description of processing

• Categories of data subjects: the Customer's authorised users (account owner and invited team members); the Customer's billing/administrative contacts; and any individuals whose personal data the Customer uploads to or configures in its workspace.
• Categories of personal data: account data (name, email, hashed password, workspace, email-verification state); authentication data (Google sign-in identity where used; session tokens); billing metadata (plan, credit balance, transaction/event records – not card numbers, which go directly to Stripe); usage & technical data (runs performed, leads processed, IP address, request and error logs); support communications; and CRM/integration OAuth tokens and configuration the Customer sets up.
• Special categories of data: none processed. The Service is not directed at children.
• Nature and purpose of processing: hosting, securing and operating the Customer's workspace; authentication; metered billing; enabling data export and CRM push the Customer configures; support; and operating, securing, debugging and improving the Service.
• Duration: for the subscription term and until deletion/return under §11.

CVR Pilot CRM (crm.cvrpilot.dk, Growth plan):

• Categories of data subjects: the Customer's contacts and the people at the companies the Customer stores; people who exchange e-mail with the Customer's connected mailbox (other than blocklisted senders/domains); attendees of meetings pulled from the Customer's calendar or Calendly; and people the Customer calls or is called by through its own Twilio account.
• Categories of personal data: contact details (name, e-mail, phone, title, company); e-mail content and metadata synced from the connected mailbox and e-mails sent through sequences, including sending state and open/click events; calendar bookings (title, time, attendees); call logs (number, direction, duration); deals, tasks and notes the Customer writes; access tokens and credentials for the services the Customer connects (Google, Microsoft, IMAP, Calendly, Twilio); API tokens and webhook endpoints.
• Location: a per-workspace SQLite database on a DigitalOcean droplet in Frankfurt (EU), with nightly backups.
• Duration: while the Growth plan is active, plus 30 days of read/export access after it ends; deleted records are kept in a trash for 30 days; see §11.4.

Annex II – Technical and organisational security measures (Art. 32)

• Encryption in transit: TLS/HTTPS everywhere, with HSTS; strict HTTP security headers.
• Password protection: stdlib scrypt (memory-hard) hashing, work factor 2^15, per-user salt.
• Encryption of secrets at rest: stored OAuth/CRM/integration tokens are protected with authenticated encryption (stdlib encrypt-then-MAC using an HMAC-SHA256 keystream in CTR mode plus an HMAC-SHA256 integrity tag), keyed off a secret which lives only in the environment and never in the database – a stolen DB/backup yields no usable tokens.
• Backups: hourly, client-side AES-256 encrypted (openssl, PBKDF2), stored off-box in the EU (DigitalOcean Spaces, fra1/Frankfurt), with pruning/retention and periodic restore drills; an out-of-band erasure log is shipped alongside so restores re-apply erasures.
• Data residency: application, database and backups in the EU (Frankfurt).
• Access control: least-privilege, need-to-know operator access; secrets root-only on the host; confidentiality obligations on authorised persons.
• Tenant isolation: multi-tenant data segregated by workspace.
• Sessions: random, HttpOnly, Secure, SameSite=Lax session tokens with expiry and revocation on logout/password-reset.
• Abuse/availability: rate-limiting; Cloudflare Turnstile bot shield on signup/login.
• Integrity/accountability: tamper-evident audit log (hash-chained); consent capture at signup with a versioned, audited record.
• Resilience & testing: health checks; automated test suite gates deploys; monitoring with downtime and cost-spike alerts.

Annex III – Authorised sub-processors

As at the date above, the authorised sub-processors are:

For CVR Pilot CRM (added 14 September 2026) additionally, each only when the Customer itself connects the service: