GDPR & Data Subject Rights

1. Overview

Savvana CRM, operated by Choroha Technologies, is committed to compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR. This page explains your rights as a data subject and how to exercise them.

For full details on what data we collect and why, please read our Privacy Policy.

2. Data Controller Information

Where you use Savvana CRM to manage data about your own customers, you act as the data controller for that customer data, and we act as a data processor on your behalf. We process such data only on your documented instructions.

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)): processing necessary to provide the Service you have subscribed to — account management, billing, authentication, and core CRM functionality.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, abuse detection, product analytics (anonymised), and improving service quality.
• Legal obligation (Art. 6(1)(c)): retaining billing records and responding to lawful requests from authorities.
• Consent (Art. 6(1)(a)): marketing communications and non-essential cookies (where we rely on consent, you may withdraw it at any time without affecting prior processing).

4. Summary of Your Rights

Under the GDPR you have the following rights regarding your personal data:

To submit a request, email dpo@savvanacrm.com or use the Account Settings → Privacy section of the application. We may request proof of identity before processing your request.

5. Right of Access (Art. 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, a copy of that data along with:

• The purposes of processing
• The categories of data processed
• Recipients or categories of recipients
• The retention periods
• Your other rights under the GDPR
• The right to lodge a complaint with a supervisory authority

You can export much of your data directly from the application. For a full data subject access request, email dpo@savvanacrm.com.

6. Right to Rectification (Art. 16)

If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. You can update most of your data directly in your account profile. For data you cannot update yourself, contact us at dpo@savvanacrm.com.

7. Right to Erasure (Art. 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and no other legal basis exists
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Exceptions: We may retain data where required by legal obligation (e.g. financial records), to defend legal claims, or where deletion would affect the rights of others.

Account deletion can be initiated from Account Settings → Danger Zone → Delete Account, or by emailing dpo@savvanacrm.com.

8. Right to Data Portability (Art. 20)

Where we process your data by automated means on the basis of contract or consent, you have the right to receive that data in a structured, commonly used, machine-readable format (JSON or CSV). You may also request that we transmit the data directly to another controller where technically feasible.

Use the Export Data feature in Account Settings, or submit a portability request to dpo@savvanacrm.com.

9. Right to Restriction (Art. 18)

You may request restriction of processing when:

• You contest the accuracy of your data (restriction applies while we verify accuracy)
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it to establish, exercise, or defend legal claims
• You have objected to processing and we are verifying whether our legitimate grounds override your objection

While processing is restricted, we will only store the data and process it with your consent or for legal claims, or to protect others' rights.

10. Right to Object (Art. 21)

You have the right to object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims.

You have an absolute right to object to processing for direct marketing purposes. We will stop immediately upon receiving such an objection.

11. Automated Decision-Making & Profiling

Savvana CRM does not make automated decisions that produce legal or similarly significant effects. All consequential decisions involving your personal data are made by humans. We may use automated tools for features such as lead scoring or spam detection, but these are advisory only and subject to human review.

12. International Data Transfers

Your data may be processed in countries outside the EEA, including the United States, where our infrastructure providers (AWS, Stripe, Twilio) operate. We ensure appropriate safeguards are in place for such transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules of our sub-processors where available

You may request a copy of the safeguards by emailing dpo@savvanacrm.com.

13. Data Retention Periods

14. Right to Lodge a Complaint

If you believe we have processed your personal data in violation of applicable data protection law, you have the right to lodge a complaint with your local supervisory authority:

• EU/EEA: Your national data protection authority (e.g. CNIL in France, BfDI in Germany)
• UK: Information Commissioner's Office (ICO) — ico.org.uk

We encourage you to contact us first so we can resolve any concerns directly.

15. Data Protection Officer