Data Processing Agreement

Last updated: August 18, 2026

This Data Processing Agreement ('DPA') forms part of the Agreement between Sales-Surge B.V. ('Sales Surge', 'Processor') and the client ('Client', 'Controller') and applies whenever Sales Surge processes personal data on behalf of the Client. It is concluded pursuant to Article 28(3) of the General Data Protection Regulation (Regulation (EU) 2016/679, 'GDPR'). Where this DPA conflicts with the General Terms and Conditions, this DPA prevails. Capitalised terms not defined here have the meaning given in the GDPR or in the General Terms and Conditions.

1. Roles and subject matter

2. Processing on documented instructions (Article 28(3)(a))

3. Confidentiality (Article 28(3)(b))

4. Security of processing (Article 28(3)(c) and Article 32)

5. Sub-processors (Article 28(2) and 28(3)(d))

6. Assistance with data subject rights (Article 28(3)(e))

7. Assistance with security, breaches and impact assessments (Article 28(3)(f))

8. Deletion or return (Article 28(3)(g))

9. Audits and information (Article 28(3)(h))

10. International transfers

11. Liability

12. Duration, amendments and contact

Annex I: Description of the processing

Annex II: Technical and organisational measures

Annex III: Sub-processors

Sales Surge

s CRM, in order to keep the Client

1.1 The Client is the controller and Sales Surge is the processor within the meaning of Article 4(7) and 4(8) GDPR. The Client determines the purposes and means of the processing; Sales Surge processes only on behalf of the Client. 1.2 Where Sales Surge determines purposes and means for its own account, for example for its own invoicing, accounting or the security of its own systems, it acts as an independent controller and this DPA does not apply to that processing. 1.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I. 1.4 This DPA takes effect on the date the Agreement takes effect and remains in force for as long as Sales Surge processes personal data on behalf of the Client.

2.1 Sales Surge processes personal data only on documented instructions from the Client, including with regard to transfers to a third country, unless required to do so by Union or Member State law. In that case Sales Surge informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. 2.2 The Agreement, the signed proposal or statement of work, this DPA and the configuration the Client makes in the software together constitute the Client's documented instructions. Instructions given by other means are only binding once confirmed in writing. 2.3 Sales Surge informs the Client immediately if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. Sales Surge may suspend the execution of that instruction until the Client withdraws or confirms it. 2.4 Sales Surge does not use personal data processed on behalf of the Client for its own purposes, does not sell it, and does not use it to train models or algorithms.

3.1 Sales Surge ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation survives the end of their engagement. 3.2 Access is granted on a need-to-know basis. Sales Surge maintains an authorisation process and withdraws access when the ground for it ends. 3.3 Sales Surge instructs the persons concerned on the applicable data protection obligations and on the specific risks of the processing.

4.1 Sales Surge implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. 4.2 The measures in force at the date of this DPA are described in Annex II. Sales Surge may amend them, provided that the level of protection is not reduced. Material changes are communicated to the Client. 4.3 Sales Surge evaluates the effectiveness of the measures periodically and after any significant change to the systems or the processing.

5.1 The Client grants Sales Surge general written authorisation to engage sub-processors. The sub-processors engaged at the date of this DPA are listed in Annex III. 5.2 Sales Surge informs the Client of any intended addition or replacement of a sub-processor at least thirty (30) days in advance. The Client may object on reasonable grounds relating to data protection within fourteen (14) days of that notice. 5.3 If the Client objects and the parties cannot reach a solution, the Client may terminate the affected part of the Services in writing, without penalty and with a pro rata refund of fees paid in advance for the period after termination. 5.4 Sales Surge imposes on every sub-processor, by contract, the same data protection obligations as those set out in this DPA. Sales Surge remains fully liable to the Client for the performance of each sub-processor's obligations.

6.1 Taking into account the nature of the processing, Sales Surge assists the Client by appropriate technical and organisational measures, insofar as possible, in fulfilling the Client's obligation to respond to requests for exercising the rights of data subjects under Chapter III GDPR. 6.2 If a data subject contacts Sales Surge directly with such a request, Sales Surge does not respond substantively and forwards the request to the Client without undue delay, and in any event within five (5) working days. 6.3 Assistance is provided at no additional cost where it can be delivered through the standard functionality of the software. Assistance requiring substantial manual work is charged at the rates in the Agreement, after prior notice to the Client.

7.1 Sales Surge notifies the Client of a personal data breach without undue delay and in any event within forty-eight (48) hours of becoming aware of it. The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. 7.2 Where not all information is available at once, Sales Surge provides it in phases without further undue delay, so that the Client can meet its own deadline under Article 33 GDPR. 7.3 Sales Surge does not notify a supervisory authority or data subjects on its own initiative in respect of processing carried out on behalf of the Client; that assessment rests with the Client. 7.4 Sales Surge assists the Client with data protection impact assessments and prior consultations under Articles 35 and 36 GDPR, taking into account the nature of the processing and the information available to Sales Surge.

8.1 On termination of the Services, Sales Surge deletes or returns all personal data processed on behalf of the Client, at the Client's choice, and deletes existing copies, unless Union or Member State law requires storage. 8.2 The Client makes that choice known within thirty (30) days of termination. Absent a choice within that period, Sales Surge deletes the data. 8.3 Deletion takes place within ninety (90) days, save for data in backups, which is deleted with the ordinary backup rotation. Data awaiting deletion in a backup remains subject to this DPA. 8.4 Sales Surge confirms deletion in writing on request.

9.1 Sales Surge makes available to the Client all information necessary to demonstrate compliance with the obligations in Article 28 GDPR. 9.2 The Client may audit, or have audited by an independent third party bound by confidentiality, once per calendar year and additionally after a personal data breach affecting the Client. The Client gives at least thirty (30) days' notice, and the audit takes place during business hours in a manner that does not unreasonably disrupt operations. 9.3 Sales Surge may satisfy an audit request by providing an existing report or certification that reasonably covers the subject matter of the audit. 9.4 Each party bears its own costs. Where an audit reveals a material shortcoming attributable to Sales Surge, Sales Surge bears the reasonable costs of the audit.

10.1 Sales Surge processes personal data within the European Economic Area unless stated otherwise in Annex III. 10.2 Where a transfer to a third country is necessary, it takes place only on the basis of a valid transfer mechanism under Chapter V GDPR, being an adequacy decision or the Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented where necessary by additional measures following a transfer impact assessment. 10.3 Where the Standard Contractual Clauses apply, Module Two (controller to processor) applies between the Client and Sales Surge, and Module Three (processor to processor) between Sales Surge and its sub-processor. Annex I and Annex II of this DPA serve as the corresponding annexes to those clauses. The governing law is Dutch law and the competent court is the court in Amsterdam.

11.1 Liability under this DPA is governed by the limitations in the General Terms and Conditions, save that those limitations do not apply to liability that cannot be limited by mandatory law, including liability under Article 82 GDPR towards data subjects and administrative fines imposed under Article 83 GDPR. 11.2 Where a party has paid full compensation for damage caused by processing, it is entitled to claim back from the other party that part of the compensation corresponding to that party's part of the responsibility, in accordance with Article 82(5) GDPR.

12.1 This DPA remains in force for as long as Sales Surge processes personal data on behalf of the Client. The provisions that by their nature are intended to survive, including Articles 3, 8 and 11, remain in force after termination. 12.2 Amendments required by a change in data protection legislation or by a decision of a supervisory authority take effect thirty (30) days after notification, unless the Client objects in writing on reasonable grounds. 12.3 Contact for all matters under this DPA: Sales-Surge B.V. 1183 DJ Amstelveen The Netherlands Email: info@sales-surge.nl Chamber of Commerce (KvK): 99261758 Establishment number: 000064354466

Subject matter The provision of the Services described in the Agreement, including CRM implementation and configuration, data hygiene and deduplication, sales and marketing automation, integrations, dashboards and advisory work. Duration For the duration of the Agreement, followed by the deletion or return period in Article 8. Nature and purpose Reading, storing, comparing, enriching, correcting, merging and deleting records in and around the Client's CRM, in order to keep the Client's commercial administration complete, correct and usable. Types of personal data Contact details (name, salutation, email address, telephone number, postal address), employment details (employer, job title, department), commercial data (deal titles, values, stages, owner, notes, activities and correspondence attached to a record), technical data (record identifiers, timestamps, source system, domain) and, where the Client places them there, any further fields the Client has configured in its own CRM. Categories of data subjects Contacts, leads, customers, donors, suppliers and other relations of the Client, and employees of the Client who use the systems. Special categories of personal data Not intended. Sales Surge does not request special categories of personal data within the meaning of Article 9 GDPR and does not design its services around them. Where the Client nevertheless enters such data in free fields of its own CRM, the Client remains responsible for the lawfulness of that processing and informs Sales Surge in advance so that additional measures can be agreed.

Access control Access to client environments is invite-only and per organisation. Authorisation is separated into membership of an organisation and the role within it. Access is granted on a need-to-know basis and withdrawn when the ground for it ends. Separation of client data Every client has its own environment within the platform. Separation is enforced at database level with row level security tied to the user's membership, so that a query on behalf of one client cannot return the records of another. Encryption Traffic between the user, the platform and connected systems runs over TLS. Data is encrypted at rest by the hosting provider. Access tokens for connected systems, such as CRM API tokens, are stored encrypted with a separate key and are never sent to the browser. Payment data Sales Surge does not process card details. Payments run through the hosted payment page and widget of the payment provider, on the provider's own domain. Secrets Credentials and API keys are held in the hosting provider's managed secret store, not in source code or configuration files in the repository. Logging and traceability Irreversible operations, in particular the merging of records, are recorded in an audit log stating what was merged, which record survived, when, and on whose authority. Errors are recorded separately with the context needed to investigate them. Human confirmation of irreversible actions Merging records cannot be undone in the source CRM. The software therefore performs no merge without explicit confirmation by a user, and shows beforehand which record disappears. Continuity Databases are backed up by the hosting provider. Restore procedures are tested when the platform changes materially. Development and change management Changes are version controlled and peer reviewed. The test suite runs before every release. Security-relevant changes are reviewed separately.

Sales Surge engages the following sub-processors for the hosting and operation of its platform: Lovable (Lovable Labs Incorporated) — application hosting, build and deployment. Processing location: European Union. Supabase (Supabase Inc.) — managed PostgreSQL database and authentication, provided through Lovable Cloud. Processing location: European Union. Cloudflare (Cloudflare, Inc.) — edge hosting and delivery of the application. Processing location: European Union, with global edge routing under the Standard Contractual Clauses. Netlify (Netlify, Inc.) — hosting of the public website. Processing location: European Union, with global edge routing under the Standard Contractual Clauses. Revolut (Revolut Payments UK Limited) — subscription billing and payment processing. Processes the billing contact details of the Client, not the personal data of the Client's data subjects. Additional sub-processors may apply to specific services agreed with the Client, such as an integration platform or an email provider. These are named in the proposal or statement of work for that service. The current list is available on request via info@sales-surge.nl. Changes are notified in accordance with Article 5 of this DPA.

Sales Surge - Align • Automate • Accelerate

width=device-width, initial-scale=1.0, maximum-scale=5.0

application/ld+json

Knowledge Hub

Pipedrive Implementatie

Pipedrive Implementation

CRM inrichting door Platinum Partner

CRM setup by Platinum Partner

HubSpot Implementatie

HubSpot Implementation

Inbound & marketing automation

Zoho CRM Implementatie

Zoho CRM Implementation

Flexibel CRM voor groeiende teams

Flexible CRM for growing teams

HubSpot naar Pipedrive Migratie

HubSpot to Pipedrive Migration

Volledige migratie, vaste prijs

Full migration, fixed price

Pipedrive Workflow Automatisering

Pipedrive Workflow Automation

Stop met admin, automatiseer follow-ups

Stop the admin, automate follow-ups

Pipedrive Integraties

Pipedrive Integrations

Custom gebouwd en uit de marketplace

Custom built and from the marketplace

Sales Automatisering

Sales Automation

Outbound, sequencing & workflows

Outbound Sales Funnel

End-to-end outbound funnel, vaste prijs

End-to-end outbound funnel, fixed price

Marketing Automatisering

Marketing Automation

Lead nurturing, scoring & campagnes

Lead nurturing, scoring & campaigns

AI Sales Agents

Intelligente agents voor je salesteam

Intelligent agents for your sales team

Revenue Dashboards

Real-time KPI's gekoppeld aan je CRM

Real-time KPIs connected to your CRM

RevOps Consultancy

Strategie, alignment & dashboards

Strategy, alignment & dashboards

Pipeline Repareren

Fix Sales Pipeline

Stop lekkages in je funnel

Stop leaks in your funnel

Outbound Opschalen

Scale Outbound Sales

Meer meetings, minder handwerk

More meetings, less manual work

Lead Conversie Verbeteren

Improve Lead Conversion

Van lead naar klant, sneller

From lead to customer, faster

Sales Automatiseren

Automate Sales Processes

Elimineer repetitief werk

Eliminate repetitive work

CRM Migratie

CRM Migration

Veilig overstappen zonder dataverlies

Switch safely without data loss

CRM & Implementatie

CRM & Implementation

Groei & Automatisering

Growth & Automation

Alle producten

All products

Elf tools die Pipedrive verder brengen

Eleven tools that push Pipedrive further

Surge Adopt

CRM adoption

Surge Reports

Surge Service

Klantenservice, beta

Customer service, beta

Surge Dedupe

Data quality

Surge Forms

Surge Reach

E-mail op schaal

Email at scale

Case Studies

Alle resources

All resources

Gidsen, playbooks en kennisbank

Guides, playbooks and knowledge hub

Alle vergelijkingen

All comparisons

CRM-vergelijkingen op een rij

CRM comparisons in one place

Pipedrive vs HubSpot

Pipedrive vs Salesforce

Pipedrive vs Zoho CRM

HubSpot vs Zoho CRM

Pipedrive vs GoHighLevel

Over Ons

flex flex-col gap-0.5 px-3 py-2.5 rounded-lg hover:bg-gray-50 transition-colors group

(min-width: 1024px)

Gratis Check

Free Check

fixed top-0 left-0 right-0 z-50 transition-all duration-300

h-full w-full object-contain

flex items-center gap-1.5 text-sm font-medium transition-colors hover:opacity-70

left-1/2 -translate-x-1/2

h-3.5 w-3.5 transition-transform duration-200

absolute top-full pt-3

bg-white rounded-xl shadow-[0_8px_30px_rgb(0,0,0,0.12)] border border-gray-100 p-3

absolute inset-0 transition-all duration-300

max-w-6xl mx-auto

mt-4 inline-flex items-center gap-2 px-3 py-1.5 bg-white/5 border border-white/10 rounded-full text-xs text-white/60

mailto:info@sales-surge.nl

noopener noreferrer

text-white/70 hover:text-white transition-colors flex items-center gap-1.5

text-[10px] font-bold bg-primary/20 text-teal-on-dark px-1.5 py-0.5 rounded-full uppercase tracking-wider

We've Seen Hundreds of Pipedrive Accounts.

block group

text-[10px] font-bold bg-primary/30 text-teal-on-dark px-2 py-0.5 rounded-full uppercase tracking-wider

inline-flex items-center gap-1.5 bg-primary/20 text-teal-on-dark font-semibold text-sm px-4 py-2 rounded-xl group-hover:bg-primary/30 transition-colors

w-4 h-4 group-hover:translate-x-0.5 transition-transform

Pipedrive Partner Advisory Council Member

Officieel lid van de advisory group van Pipedrive

Official member of the Pipedrive advisory group

Pipedrive Platinum Partner. Wij richten uw CRM, automatisering en outbound zo in dat sales voorspelbaar groeit.

Pipedrive Platinum Partner. We set up your CRM, automation and outbound so sales grows predictably.

RevOps Aanpak

Platforms & Partners

↳ Pipedrive Marketplace Profiel

↳ Pipedrive Marketplace Profile

Resources hub

Pipedrive Gids

Pipedrive Guide

Outbound Gids

Outbound Guide

RevOps Gids

RevOps Guide

AI Sales Agent Gids

AI Sales Agent Guide

Pipedrive Partner Kiezen

Choose a Pipedrive Partner

Tool Gidsen

Tool Guides

Alle CRM vergelijkingen

All CRM comparisons

Pipedrive Prijzen Gids

Pipedrive Pricing Guide

HubSpot naar Pipedrive Checklist

HubSpot to Pipedrive Checklist

RevOps KPI Woordenlijst

RevOps KPI Glossary

Wat je CRM je zou vertellen als het eerlijk was

What Your CRM Would Tell You If It Were Honest

Niemand antwoordt op een e-mail die klinkt als een e-mail

Nobody Replies to an Email That Sounds Like an Email

We hebben honderden Pipedrive-accounts gezien.

Elk gesprek is data. Tenzij niemand het logt.

Every Conversation Is Data. Unless Nobody Logs It.

Waarom Sales Surge

Why Sales Surge

Visiting address

Pipedrive Setup Advisor

Beantwoord 12 vragen → ontvang een gratis maatwerk CRM blueprint met pipeline, velden & automatiseringen

Answer 12 questions → get a free custom CRM blueprint with pipeline, fields & automations

Start gratis

Start free

Partner Badge

SALES SURGE

Dutch Engineering

info@sales-surge.nl

AI Sprint

Pipedrive Partner

Apollo + Pipedrive

Instantly + Pipedrive

Make + Pipedrive

Clay + Pipedrive

AI Tool

Data Processing Agreement | Sales Surge