1. Introduction & Roles
This Privacy Policy explains how RiroCRM Ltd (“RiroCRM”, “we”, “us”) collects, uses, and safeguards personal information when you use our website and software.
Under UK data protection law (UK General Data Protection Regulation and the Data Protection Act 2018):
- RiroCRM as Data Controller: We act as the Data Controller for your account registration details, billing records, and direct communications with us.
- RiroCRM as Data Processor: For customer records, contact lists, deals, and messages that you upload to your workspace, you are the Data Controller and RiroCRM acts strictly as your Data Processor.
2. Personal Information We Collect
A. Information You Provide Directly
- Account Information: Name, business name, email address, password hash, and company details.
- Customer Data (Workspace): Client names, phone numbers, email addresses, deals, notes, and task records created by your team.
- Inquiries & Communications: Messages sent via our contact forms, WhatsApp support line, or email.
B. Information Collected Automatically
- Usage & Telemetry: Log timestamps, IP address, browser type, and authentication session tokens required to keep your account secure.
- Cookies: Essential session cookies strictly necessary to maintain your logged-in workspace state. We do not use third-party cross-site advertising tracking cookies.
3. Lawful Basis for Processing
We process your data under the following legal bases recognized by the UK ICO:
- Contractual Performance: To create your account, provide CRM features, process payments, and authenticate your team.
- Legitimate Interests: To detect fraud, preserve system uptime, prevent brute-force attacks, and answer support inquiries.
- Consent: Where you have explicitly opted in to receive product release newsletters or updates.
- Legal Obligation: To maintain required financial and VAT records under UK tax law.
4. Data Storage & Security
All production databases, cloud functions, and file attachments are hosted in secure enterprise data centres in London, United Kingdom (Google Cloud Platform / Firebase).
Data in transit is protected using modern TLS 1.3 / 256-bit SSL encryption. Data at rest is encrypted with AES-256. Access to production environments is strictly restricted via multi-factor authentication.
5. Sub-Processors & Third-Party Services
We work with trusted infrastructure providers that comply with UK GDPR:
| Sub-Processor | Role & Activity | Location |
|---|---|---|
| Google Cloud / Firebase | Database, authentication, hosting, storage | London, United Kingdom (europe-west2) |
| Meta / WhatsApp Cloud API | Official WhatsApp Business message relay | United Kingdom & EEA |
| Brevo | Transactional email & newsletter delivery | European Union (GDPR compliant) |
6. Your Rights Under UK GDPR
As a UK or EEA resident, you have the right to:
- Access: Request a copy of the personal information we hold about you.
- Rectification: Correct any inaccurate or incomplete details.
- Erasure (“Right to be Forgotten”): Request complete deletion of your account and workspace data.
- Data Portability: Export all contact and deal records in a machine-readable CSV format.
- Object or Restrict: Limit how we process specific data.
To exercise any of these rights, contact our Data Protection Officer at dpo@rirocrm.com. We respond to all verified requests within 30 days free of charge.
7. Retention & Deletion
We retain your workspace records as long as your account remains active. If you choose to delete your workspace or account, your data is permanently removed from live production systems within 14 days.
8. Contact Our Data Protection Team
RiroCRM Ltd is registered in England & Wales. If you have any questions, concerns, or data requests, please write to: