A CRM system stores personal data — name, email, phone number, purchase history. Since the GDPR (2018), strict rules apply to how this data is handled. Anyone who ignores them risks fines of up to 20 million euros.
The 7 most important GDPR rules for your CRM
1. Legal basis for storage
You need a reason to store data: a contract, legitimate interest or explicit consent. "We store everything that comes in" is not enough.
2. Purpose limitation
Data may only be used for the purpose for which it was collected. Newsletter addresses must not be used for cold outreach.
3. Right of access
Every customer can ask at any time: What data do you hold about me? You must be able to respond within 30 days.
4. Right to erasure
Customers can request the deletion of their data. Your CRM must make this technically possible — including backups and linked records.
5. Data minimisation
Only store what you really need. Recording a customer's date of birth just because "there happens to be a field for it" is not GDPR-compliant if you never use it.
6. Data processing
If your CRM runs in the cloud (with a third-party provider), you need a data processing agreement (DPA). With Kontira, we host on German servers (Hetzner, data centres in Germany).
7. Technical security
Encryption, access controls, regular backups. Your CRM must be technically secure — not just on paper.
How Kontira implements data protection
- German servers: Hetzner data centres in Germany, data does not leave Germany
- Encryption: TLS in transit, encrypted backups
- Deletion function: Customers can be completely deleted with one click
- Access rights: Role-based permission system
- DPA included: The data processing agreement is part of the subscription