Data Processing Agreement
Last updated: August 18, 2026
This Data Processing Agreement ('DPA') forms part of the Agreement between Sales-Surge B.V. ('Sales Surge', 'Processor') and the client ('Client', 'Controller') and applies whenever Sales Surge processes personal data on behalf of the Client. It is concluded pursuant to Article 28(3) of the General Data Protection Regulation (Regulation (EU) 2016/679, 'GDPR'). Where this DPA conflicts with the General Terms and Conditions, this DPA prevails. Capitalised terms not defined here have the meaning given in the GDPR or in the General Terms and Conditions.
1. Roles and subject matter
2. Processing on documented instructions (Article 28(3)(a))
3. Confidentiality (Article 28(3)(b))
4. Security of processing (Article 28(3)(c) and Article 32)
5. Sub-processors (Article 28(2) and 28(3)(d))
6. Assistance with data subject rights (Article 28(3)(e))
7. Assistance with security, breaches and impact assessments (Article 28(3)(f))
8. Deletion or return (Article 28(3)(g))
9. Audits and information (Article 28(3)(h))
10. International transfers
11. Liability
12. Duration, amendments and contact
Annex I: Description of the processing
Annex II: Technical and organisational measures
Annex III: Sub-processors
Sales Surge
s CRM, in order to keep the Client
1.1 The Client is the controller and Sales Surge is the processor within the meaning of Article 4(7) and 4(8) GDPR. The Client determines the purposes and means of the processing; Sales Surge processes only on behalf of the Client. 1.2 Where Sales Surge determines purposes and means for its own account, for example for its own invoicing, accounting or the security of its own systems, it acts as an independent controller and this DPA does not apply to that processing. 1.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I. 1.4 This DPA takes effect on the date the Agreement takes effect and remains in force for as long as Sales Surge processes personal data on behalf of the Client.
2.1 Sales Surge processes personal data only on documented instructions from the Client, including with regard to transfers to a third country, unless required to do so by Union or Member State law. In that case Sales Surge informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. 2.2 The Agreement, the signed proposal or statement of work, this DPA and the configuration the Client makes in the software together constitute the Client's documented instructions. Instructions given by other means are only binding once confirmed in writing. 2.3 Sales Surge informs the Client immediately if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. Sales Surge may suspend the execution of that instruction until the Client withdraws or confirms it. 2.4 Sales Surge does not use personal data processed on behalf of the Client for its own purposes, does not sell it, and does not use it to train models or algorithms.
3.1 Sales Surge ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation survives the end of their engagement. 3.2 Access is granted on a need-to-know basis. Sales Surge maintains an authorisation process and withdraws access when the ground for it ends. 3.3 Sales Surge instructs the persons concerned on the applicable data protection obligations and on the specific risks of the processing.
4.1 Sales Surge implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. 4.2 The measures in force at the date of this DPA are described in Annex II. Sales Surge may amend them, provided that the level of protection is not reduced. Material changes are communicated to the Client. 4.3 Sales Surge evaluates the effectiveness of the measures periodically and after any significant change to the systems or the processing.
5.1 The Client grants Sales Surge general written authorisation to engage sub-processors. The sub-processors engaged at the date of this DPA are listed in Annex III. 5.2 Sales Surge informs the Client of any intended addition or replacement of a sub-processor at least thirty (30) days in advance. The Client may object on reasonable grounds relating to data protection within fourteen (14) days of that notice. 5.3 If the Client objects and the parties cannot reach a solution, the Client may terminate the affected part of the Services in writing, without penalty and with a pro rata refund of fees paid in advance for the period after termination. 5.4 Sales Surge imposes on every sub-processor, by contract, the same data protection obligations as those set out in this DPA. Sales Surge remains fully liable to the Client for the performance of each sub-processor's obligations.
6.1 Taking into account the nature of the processing, Sales Surge assists the Client by appropriate technical and organisational measures, insofar as possible, in fulfilling the Client's obligation to respond to requests for exercising the rights of data subjects under Chapter III GDPR. 6.2 If a data subject contacts Sales Surge directly with such a request, Sales Surge does not respond substantively and forwards the request to the Client without undue delay, and in any event within five (5) working days. 6.3 Assistance is provided at no additional cost where it can be delivered through the standard functionality of the software. Assistance requiring substantial manual work is charged at the rates in the Agreement, after prior notice to the Client.
7.1 Sales Surge notifies the Client of a personal data breach without undue delay and in any event within forty-eight (48) hours of becoming aware of it. The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. 7.2 Where not all information is available at once, Sales Surge provides it in phases without further undue delay, so that the Client can meet its own deadline under Article 33 GDPR. 7.3 Sales Surge does not notify a supervisory authority or data subjects on its own initiative in respect of processing carried out on behalf of the Client; that assessment rests with the Client. 7.4 Sales Surge assists the Client with data protection impact assessments and prior consultations under Articles 35 and 36 GDPR, taking into account the nature of the processing and the information available to Sales Surge.
8.1 On termination of the Services, Sales Surge deletes or returns all personal data processed on behalf of the Client, at the Client's choice, and deletes existing copies, unless Union or Member State law requires storage. 8.2 The Client makes that choice known within thirty (30) days of termination. Absent a choice within that period, Sales Surge deletes the data. 8.3 Deletion takes place within ninety (90) days, save for data in backups, which is deleted with the ordinary backup rotation. Data awaiting deletion in a backup remains subject to this DPA. 8.4 Sales Surge confirms deletion in writing on request.
9.1 Sales Surge makes available to the Client all information necessary to demonstrate compliance with the obligations in Article 28 GDPR. 9.2 The Client may audit, or have audited by an independent third party bound by confidentiality, once per calendar year and additionally after a personal data breach affecting the Client. The Client gives at least thirty (30) days' notice, and the audit takes place during business hours in a manner that does not unreasonably disrupt operations. 9.3 Sales Surge may satisfy an audit request by providing an existing report or certification that reasonably covers the subject matter of the audit. 9.4 Each party bears its own costs. Where an audit reveals a material shortcoming attributable to Sales Surge, Sales Surge bears the reasonable costs of the audit.
10.1 Sales Surge processes personal data within the European Economic Area unless stated otherwise in Annex III. 10.2 Where a transfer to a third country is necessary, it takes place only on the basis of a valid transfer mechanism under Chapter V GDPR, being an adequacy decision or the Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented where necessary by additional measures following a transfer impact assessment. 10.3 Where the Standard Contractual Clauses apply, Module Two (controller to processor) applies between the Client and Sales Surge, and Module Three (processor to processor) between Sales Surge and its sub-processor. Annex I and Annex II of this DPA serve as the corresponding annexes to those clauses. The governing law is Dutch law and the competent court is the court in Amsterdam.
11.1 Liability under this DPA is governed by the limitations in the General Terms and Conditions, save that those limitations do not apply to liability that cannot be limited by mandatory law, including liability under Article 82 GDPR towards data subjects and administrative fines imposed under Article 83 GDPR. 11.2 Where a party has paid full compensation for damage caused by processing, it is entitled to claim back from the other party that part of the compensation corresponding to that party's part of the responsibility, in accordance with Article 82(5) GDPR.
12.1 This DPA remains in force for as long as Sales Surge processes personal data on behalf of the Client. The provisions that by their nature are intended to survive, including Articles 3, 8 and 11, remain in force after termination. 12.2 Amendments required by a change in data protection legislation or by a decision of a supervisory authority take effect thirty (30) days after notification, unless the Client objects in writing on reasonable grounds. 12.3 Contact for all matters under this DPA: Sales-Surge B.V. 1183 DJ Amstelveen The Netherlands Email: info@sales-surge.nl Chamber of Commerce (KvK): 99261758 Establishment number: 000064354466
Subject matter The provision of the Services described in the Agreement, including CRM implementation and configuration, data hygiene and deduplication, sales and marketing automation, integrations, dashboards and advisory work. Duration For the duration of the Agreement, followed by the deletion or return period in Article 8. Nature and purpose Reading, storing, comparing, enriching, correcting, merging and deleting records in and around the Client's CRM, in order to keep the Client's commercial administration complete, correct and usable. Types of personal data Contact details (name, salutation, email address, telephone number, postal address), employment details (employer, job title, department), commercial data (deal titles, values, stages, owner, notes, activities and correspondence attached to a record), technical data (record identifiers, timestamps, source system, domain) and, where the Client places them there, any further fields the Client has configured in its own CRM. Categories of data subjects Contacts, leads, customers, donors, suppliers and other relations of the Client, and employees of the Client who use the systems. Special categories of personal data Not intended. Sales Surge does not request special categories of personal data within the meaning of Article 9 GDPR and does not design its services around them. Where the Client nevertheless enters such data in free fields of its own CRM, the Client remains responsible for the lawfulness of that processing and informs Sales Surge in advance so that additional measures can be agreed.
Access control Access to client environments is invite-only and per organisation. Authorisation is separated into membership of an organisation and the role within it. Access is granted on a need-to-know basis and withdrawn when the ground for it ends. Separation of client data Every client has its own environment within the platform. Separation is enforced at database level with row level security tied to the user's membership, so that a query on behalf of one client cannot return the records of another. Encryption Traffic between the user, the platform and connected systems runs over TLS. Data is encrypted at rest by the hosting provider. Access tokens for connected systems, such as CRM API tokens, are stored encrypted with a separate key and are never sent to the browser. Payment data Sales Surge does not process card details. Payments run through the hosted payment page and widget of the payment provider, on the provider's own domain. Secrets Credentials and API keys are held in the hosting provider's managed secret store, not in source code or configuration files in the repository. Logging and traceability Irreversible operations, in particular the merging of records, are recorded in an audit log stating what was merged, which record survived, when, and on whose authority. Errors are recorded separately with the context needed to investigate them. Human confirmation of irreversible actions Merging records cannot be undone in the source CRM. The software therefore performs no merge without explicit confirmation by a user, and shows beforehand which record disappears. Continuity Databases are backed up by the hosting provider. Restore procedures are tested when the platform changes materially. Development and change management Changes are version controlled and peer reviewed. The test suite runs before every release. Security-relevant changes are reviewed separately.
Sales Surge engages the following sub-processors for the hosting and operation of its platform: Lovable (Lovable Labs Incorporated) — application hosting, build and deployment. Processing location: European Union. Supabase (Supabase Inc.) — managed PostgreSQL database and authentication, provided through Lovable Cloud. Processing location: European Union. Cloudflare (Cloudflare, Inc.) — edge hosting and delivery of the application. Processing location: European Union, with global edge routing under the Standard Contractual Clauses. Netlify (Netlify, Inc.) — hosting of the public website. Processing location: European Union, with global edge routing under the Standard Contractual Clauses. Revolut (Revolut Payments UK Limited) — subscription billing and payment processing. Processes the billing contact details of the Client, not the personal data of the Client's data subjects. Additional sub-processors may apply to specific services agreed with the Client, such as an integration platform or an email provider. These are named in the proposal or statement of work for that service. The current list is available on request via info@sales-surge.nl. Changes are notified in accordance with Article 5 of this DPA.
Sales Surge - Align • Automate • Accelerate
width=device-width, initial-scale=1.0, maximum-scale=5.0
application/ld+json
Knowledge Hub
Pipedrive Implementatie
Pipedrive Implementation
CRM inrichting door Platinum Partner
CRM setup by Platinum Partner
HubSpot Implementatie
HubSpot Implementation
Inbound & marketing automation
Zoho CRM Implementatie
Zoho CRM Implementation
Flexibel CRM voor groeiende teams
Flexible CRM for growing teams
HubSpot naar Pipedrive Migratie
HubSpot to Pipedrive Migration
Volledige migratie, vaste prijs
Full migration, fixed price
Pipedrive Workflow Automatisering
Pipedrive Workflow Automation
Stop met admin, automatiseer follow-ups
Stop the admin, automate follow-ups
Pipedrive Integraties
Pipedrive Integrations
Custom gebouwd en uit de marketplace
Custom built and from the marketplace
Sales Automatisering
Sales Automation
Outbound, sequencing & workflows
Outbound Sales Funnel
End-to-end outbound funnel, vaste prijs
End-to-end outbound funnel, fixed price
Marketing Automatisering
Marketing Automation
Lead nurturing, scoring & campagnes
Lead nurturing, scoring & campaigns
AI Sales Agents
Intelligente agents voor je salesteam
Intelligent agents for your sales team
Revenue Dashboards
Real-time KPI's gekoppeld aan je CRM
Real-time KPIs connected to your CRM
RevOps Consultancy
Strategie, alignment & dashboards
Strategy, alignment & dashboards
Pipeline Repareren
Fix Sales Pipeline
Stop lekkages in je funnel
Stop leaks in your funnel
Outbound Opschalen
Scale Outbound Sales
Meer meetings, minder handwerk
More meetings, less manual work
Lead Conversie Verbeteren
Improve Lead Conversion
Van lead naar klant, sneller
From lead to customer, faster
Sales Automatiseren
Automate Sales Processes
Elimineer repetitief werk
Eliminate repetitive work
CRM Migratie
CRM Migration
Veilig overstappen zonder dataverlies
Switch safely without data loss
CRM & Implementatie
CRM & Implementation
Groei & Automatisering
Growth & Automation
Case Studies
Alle resources
All resources
Gidsen, playbooks en kennisbank
Guides, playbooks and knowledge hub
Alle vergelijkingen
All comparisons
CRM-vergelijkingen op een rij
CRM comparisons in one place
Pipedrive vs HubSpot
Pipedrive vs Salesforce
Pipedrive vs Zoho CRM
HubSpot vs Zoho CRM
Pipedrive vs GoHighLevel
Over Ons
flex flex-col gap-0.5 px-3 py-2.5 rounded-lg hover:bg-gray-50 transition-colors group
(min-width: 1024px)
Gratis Check
Free Check
fixed top-0 left-0 right-0 z-50 transition-all duration-300
h-full w-full object-contain
flex items-center gap-1.5 text-sm font-medium transition-colors hover:opacity-70
left-1/2 -translate-x-1/2
h-3.5 w-3.5 transition-transform duration-200
absolute top-full pt-3
bg-white rounded-xl shadow-[0_8px_30px_rgb(0,0,0,0.12)] border border-gray-100 p-3
absolute inset-0 transition-all duration-300
max-w-6xl mx-auto
mt-4 inline-flex items-center gap-2 px-3 py-1.5 bg-white/5 border border-white/10 rounded-full text-xs text-white/60
mailto:info@sales-surge.nl
noopener noreferrer
text-white/70 hover:text-white transition-colors flex items-center gap-1.5
text-[10px] font-bold bg-primary/20 text-teal-on-dark px-1.5 py-0.5 rounded-full uppercase tracking-wider
We've Seen Hundreds of Pipedrive Accounts.
block group
text-[10px] font-bold bg-primary/30 text-teal-on-dark px-2 py-0.5 rounded-full uppercase tracking-wider
inline-flex items-center gap-1.5 bg-primary/20 text-teal-on-dark font-semibold text-sm px-4 py-2 rounded-xl group-hover:bg-primary/30 transition-colors
w-4 h-4 group-hover:translate-x-0.5 transition-transform
Pipedrive Platinum Partner. Wij richten uw CRM, automatisering en outbound zo in dat sales voorspelbaar groeit.
Pipedrive Platinum Partner. We set up your CRM, automation and outbound so sales grows predictably.
RevOps Aanpak
Alle producten
All products
Platforms & Partners
↳ Pipedrive Marketplace Profiel
↳ Pipedrive Marketplace Profile
Resources hub
Pipedrive Gids
Pipedrive Guide
Outbound Gids
Outbound Guide
RevOps Gids
RevOps Guide
AI Sales Agent Gids
AI Sales Agent Guide
Pipedrive Partner Kiezen
Choose a Pipedrive Partner
Tool Gidsen
Tool Guides
Alle CRM vergelijkingen
All CRM comparisons
Pipedrive Prijzen Gids
Pipedrive Pricing Guide
HubSpot naar Pipedrive Checklist
HubSpot to Pipedrive Checklist
RevOps KPI Woordenlijst
RevOps KPI Glossary
Wat je CRM je zou vertellen als het eerlijk was
What Your CRM Would Tell You If It Were Honest
Niemand antwoordt op een e-mail die klinkt als een e-mail
Nobody Replies to an Email That Sounds Like an Email
We hebben honderden Pipedrive-accounts gezien.
Elk gesprek is data. Tenzij niemand het logt.
Every Conversation Is Data. Unless Nobody Logs It.
Waarom Sales Surge
Why Sales Surge
Visiting address
Pipedrive Setup Advisor
Beantwoord 12 vragen → ontvang een gratis maatwerk CRM blueprint met pipeline, velden & automatiseringen
Answer 12 questions → get a free custom CRM blueprint with pipeline, fields & automations
Start gratis
Start free
Alle rechten voorbehouden.
All rights reserved.
Partner Badge
SALES SURGE
Dutch Engineering
info@sales-surge.nl
AI Sprint
Pipedrive Partner
Apollo + Pipedrive
Instantly + Pipedrive
Make + Pipedrive
Clay + Pipedrive
AI Tool