Nexpand CRM — Data Processing Agreement
Last updated: 18 July 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Zsigmond Gergely, egyéni vállalkozó (sole proprietor; registered seat: 1026 Budapest, Guyon köz 5., Hungary; registration number: 59673189) ("Processor") and the customer ("Controller") and is concluded pursuant to Article 28 GDPR. It applies to all personal data the Controller imports into or collects through the Nexpand CRM service ("Customer Data"). It is accepted electronically together with the Terms; no signature is required.
1. Subject matter, duration, nature and purpose
The Processor processes Customer Data on the Controller's behalf for the sole purpose of providing the Nexpand CRM service described in the Terms: hosting, storing, organising, enriching, displaying, exporting and backing up the Controller's prospecting database, and executing the automation tasks the Controller initiates. Processing lasts for the duration of the service agreement plus the deletion period in Section 8.
2. Categories of data subjects and data
- Data subjects: the Controller's business contacts, prospects and leads (typically employees and representatives of companies the Controller prospects), and persons appearing in the Controller's LinkedIn network and message history.
- Categories of personal data: name; job title and employment history as publicly presented; employer and its attributes; LinkedIn profile URLs and identifiers; location, industry, headline; connection/follower counts; tags, notes and statuses the Controller records; LinkedIn message content exchanged between the Controller and the data subject; business contact details the Controller imports (e.g. business email).
- No special categories of data (Art. 9 GDPR) are intended to be processed; the Controller must not import them.
3. Controller's responsibilities
The Controller warrants that it has a valid legal basis for the processing of Customer Data (for B2B prospecting typically Art. 6(1)(f) GDPR — legitimate interest), that it provides data subjects with the information required by Arts. 13–14 GDPR where applicable, and that its instructions (including automation it initiates) comply with applicable law. The Controller's instructions are given through the features of the service.
4. Processor's obligations
The Processor shall:
- process Customer Data only on the Controller's documented instructions (the Terms, this DPA and the Controller's use of the service features), unless required by EU or Member State law — in which case the Processor informs the Controller unless prohibited;
- ensure persons authorised to process the data are bound by confidentiality;
- implement the technical and organisational measures in Annex 2 (Art. 32 GDPR);
- assist the Controller, insofar as reasonably possible, in fulfilling data-subject requests (Arts. 12–23) — the service's export, correction and deletion features are the primary means of such assistance — and in the Controller's obligations under Arts. 32–36;
- notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, providing the information reasonably available;
- make available the information necessary to demonstrate compliance with Art. 28 and allow audits as set out in Section 7;
- not sell Customer Data or use it for its own purposes (the shared enrichment cache operated by the Processor as controller is described in the Privacy Policy, §6 — it contains only publicly available professional attributes and no Controller-private content such as notes, statuses or messages).
5. Subprocessors
The Controller grants general authorisation to engage the subprocessors listed in Annex 1. The Processor will notify customers (email or in-app) at least 14 days before adding or replacing a subprocessor; the Controller may object on reasonable data-protection grounds, in which case the parties will seek a solution and, failing one, the Controller may terminate the affected service. The Processor imposes data-protection obligations on subprocessors equivalent to this DPA and remains liable for their performance.
6. International transfers
Customer Data is hosted in the EU. Where a subprocessor processes personal data outside the EEA, the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses (2021/914), as noted in Annex 1.
7. Audit
Upon written request, at most once per year (or after a personal data breach), the Processor will provide documentation of its compliance with this DPA. If this is insufficient, the Controller may conduct or mandate an audit during business hours, with 30 days' notice, without access to other customers' data, at the Controller's cost.
8. Deletion and return
The Controller can export Customer Data (CSV/XLSX) and delete records at any time through the service; trashed records are purged after 14 days. Upon termination of the agreement, the Processor deletes all Customer Data within 30 days of the account's deletion, except where EU or Member State law requires longer storage. Data disappears from rolling backups within a further 30 days as backups rotate.
9. Liability and precedence
Liability under this DPA is subject to the limitations of the Terms, except where the GDPR mandates otherwise (Art. 82). In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.
Annex 1 — Approved subprocessors
| Subprocessor | Processing | Location / transfer mechanism |
|---|---|---|
| Rackhost Zrt., 6722 Szeged, Tisza Lajos krt. 41., Hungary | Infrastructure hosting (application servers, database, backups) | EU (Hungary) |
| Resend (Plus Five Five, Inc.), USA | Transactional email delivery (e.g. job-change digest emails that may name the Controller's contacts) | USA — Standard Contractual Clauses |
| HubSpot, Inc., USA | Only where the Controller connects its own HubSpot portal: contact and message data the Controller selects for sync (transfer at the Controller's direction to the Controller's own HubSpot account) | EU/USA — EU–US Data Privacy Framework |
Stripe processes only the Controller's own billing data (as independent controller) and never Customer Data; it is therefore listed in the Privacy Policy, not here. The Nexpand desktop agent runs on the Controller's own hardware and is not a subprocessor.
Annex 2 — Technical and organisational measures (Art. 32 GDPR)
- Encryption in transit: all web and agent traffic over TLS (HTTPS).
- Access control: password authentication (bcrypt hashes), email verification, session cookies (HttpOnly, SameSite); desktop agents authenticate with random per-device tokens stored only as hashes; administrative access restricted to the Provider's authorised personnel.
- Tenant isolation: every Customer Data record is bound to the owning account and every query is scoped to it; cross-tenant access is not possible through the application.
- Infrastructure: EU-located virtual private servers, firewalled, key-based SSH access only; the servers never hold LinkedIn credentials.
- Backups & recoverability: automated, layered backups (on-server, off-site copy on separate EU infrastructure, and an offline copy), rotated on a rolling schedule; restore procedures tested.
- Data minimisation on the client: LinkedIn sessions live only in the customer's own browser profile on the customer's machine.
- Logging: security-relevant events and all automation actions are logged per account (action log).
- Deletion: soft-delete with 14-day trash, scheduled purge; account deletion removes all tenant rows.
- Organisational: confidentiality obligations for personnel; least-privilege administration; security patches applied promptly.
Log in · Create account · Part of the nexpand suite · nexpand.hu