Privacy Policy
Effective version of May 14, 2026 · GDPR-compliant, in line with the Law of Ukraine "On Personal Data Protection"
1. Controller and Purpose
Personal data controller: FOP Sudak Valerii Valeriiovych ("we", "us"). For privacy questions, contact: info@nextcrm.com.ua.
This Policy describes what personal data we collect, why, how we store it, who we share it with, and what rights the data subject has.
2. What Data We Collect
2.1. Customer Registration Data
- Email — for authentication and notifications;
- Phone number — for support communication;
- First and last name — for communication purposes;
- Company / store name — for reporting.
2.2. Technical Data
- IP address (anonymized to subnet level after 30 days);
- Browser User-Agent (type, version);
- Service request logs (action, timestamp, status code);
- Cookies (see the Cookies section).
2.3. Data of the Customer's Clients
The Customer may enter their own clients' data into the Service: name, phone number, email, delivery address, order history, correspondence. The Customer is the controller of this data, and we act as the processor. We do not use this data beyond providing the Service.
2.4. Payment Data
We do not store full card details. Payments are processed by PCI-DSS certified payment systems (Monobank, PrivatBank, Wayforpay). We only receive the transaction status and a masked card number (****1234).
3. Legal Bases for Processing (GDPR Article 6)
- Performance of a contract (Art. 6(1)(b)) — to provide the Service;
- Legitimate interests (Art. 6(1)(f)) — for security, product analytics, and fraud prevention;
- User consent (Art. 6(1)(a)) — for marketing communications (can be withdrawn with one click);
- Legal obligation (Art. 6(1)(c)) — for reporting to tax authorities.
4. How We Use the Data
- Providing the Service: registration, authentication, order processing, integrations;
- User support: responding to inquiries, account configuration;
- Security: detecting suspicious activity, protecting against attacks;
- Product improvement: anonymized behavioral analytics (not tied to an individual);
- Billing: invoicing and reporting;
- Marketing communications (only with consent): newsletters, update notifications.
5. Storage and Security
Details are in the "Security" section. In short:
- Servers in the EU (Hetzner, Frankfurt) — ISO 27001 / SOC 2;
- Encryption at rest (LUKS AES-256) and in transit (TLS 1.3);
- Regular security audits and penetration testing;
- Employee access — on a need-to-know basis only, via 2FA, with logging of all actions.
6. Retention Periods
| Category | Retention period |
|---|---|
| Active account | While the subscription is active |
| After account deletion | 30 days (soft delete), then full deletion |
| Payment documents | 3 years (tax law) |
| Log files | 90 days |
| Backups | 90 days, rotating |
7. Disclosure to Third Parties
We do not sell your data. Disclosure is only possible to the following categories:
7.1. Technical Providers (Sub-processors)
- Hetzner Cloud (Germany) — server hosting;
- Cloudflare (EU/US, DPA in place) — CDN, DDoS protection;
- Cloudflare R2 (EU) — backup storage;
- Resend (EU) — transactional emails;
- Brevo (France) — marketing mailings (with consent only).
7.2. Integration Platforms
If you connect Instagram, Telegram, Viber, or Nova Poshta to NextCRM, data is transferred to them to the extent necessary for the integration to function. Each platform has its own privacy policy.
7.3. Payment Systems
Monobank, PrivatBank, Wayforpay — for payment processing. They receive the amount, payment purpose, and the Customer's identifier. Card data is processed exclusively by them.
7.4. Legal Requests
Upon an official request from law enforcement with a Ukrainian court decision. We always notify the Customer unless prohibited by law.
8. Your Rights (GDPR + Law of Ukraine "On Personal Data Protection")
- Right to access — obtain a copy of all your data. Request via: info@nextcrm.com.ua. Response within 30 days.
- Right to rectification — correct inaccurate data in your account or upon request.
- Right to erasure ("right to be forgotten") — full deletion of your data upon request. See "Data Deletion".
- Right to restriction of processing — suspend processing of your data on request.
- Right to data portability — receive your data in a machine-readable format (CSV / JSON) to transfer to another service.
- Right to object — opt out of marketing communications (one click in an email or in the account).
- Right to withdraw consent — at any time.
- Right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or an EU GDPR supervisory authority (if you are an EU resident).
9. International Transfers
Data is processed within the EU. Transfers outside the EU (e.g., to the US — Cloudflare) are carried out on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission.
10. Changes to This Policy
We will notify you of material changes via email and in your account at least 30 days before they take effect. Continued use of the Service constitutes acceptance of the new version.