Data Processing Policy

1. Introduction and Purpose

This Data Processing Policy ("DPP") describes how Clientop.io processes personal data on behalf of its customers ("data controllers") when providing our Client Operations Infrastructure Platform. This policy supplements our Privacy Policy and is designed to meet the requirements of the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws.

When you use Clientop to store and manage your clients' data, you act as the data controller and Clientop acts as a data processor. Our processing activities are governed by your instructions as set out in your subscription agreement and this policy.

2. Data Controller and Processor Roles

2.1 Your Role as Data Controller

As the data controller, you determine the purposes and means of processing personal data within Clientop. You are responsible for:

• Establishing a lawful basis for processing your clients' personal data
• Providing appropriate privacy notices to data subjects
• Responding to data subject rights requests from your clients
• Ensuring compliance with applicable data protection laws in your jurisdiction
• Obtaining necessary consents where required

2.2 Clientop's Role as Data Processor

As your data processor, Clientop processes personal data only on your documented instructions and for the purpose of providing our services. We will not process data for any other purpose without your written authorization, except where required by law.

3. Categories of Data Processed

Through the Clientop platform, we may process the following categories of personal data on your behalf:

• Contact information (names, email addresses, phone numbers, business addresses)
• Professional information (job titles, company information, industry)
• Communication records (email correspondence, call notes, meeting records)
• Service delivery records (project data, deliverable records, SLA tracking)
• Business relationship data (account status, relationship history, notes)
• Usage and engagement data relating to your clients

4. Technical and Organizational Security Measures

Clientop implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 encryption
• Role-based access control and principle of least privilege
• Regular security assessments, penetration testing, and vulnerability scanning
• Comprehensive security incident detection and response procedures
• Employee security training and background verification
• Physical security controls at our data center facilities
• Business continuity and disaster recovery planning

5. Sub-Processors

Clientop engages trusted sub-processors to assist in delivering our services. All sub-processors are bound by data processing agreements that provide equivalent data protection standards. We maintain an up-to-date list of sub-processors available upon request.

Sub-processors may include cloud infrastructure providers, payment processors, email service providers, analytics platforms, and customer support tools. We will notify you of any intended changes to our sub-processor list with reasonable advance notice.

6. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) or other jurisdictions with data transfer restrictions, Clientop implements appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions issued by relevant supervisory authorities
• Binding Corporate Rules where applicable
• Other legally recognized transfer mechanisms

7. Data Subject Rights Assistance

Clientop will assist you in fulfilling data subject rights requests from your clients, including rights of access, rectification, erasure, restriction, portability, and objection. We will provide the necessary technical assistance and respond to your requests within commercially reasonable timeframes.

8. Data Breach Notification

In the event of a personal data breach affecting data we process on your behalf, Clientop will notify you without undue delay and within 48 hours of becoming aware of the breach. Notifications will include the nature of the breach, affected data categories, and our remediation measures, to enable you to fulfill your regulatory notification obligations.

9. Data Retention and Deletion

Personal data processed through Clientop is retained for the duration of your subscription agreement. Upon termination, we will retain data for 30 days to facilitate export, after which data will be securely deleted unless required by law to retain it longer. We will certify deletion upon your written request.

10. Audit Rights

Clientop will provide you with the information necessary to demonstrate compliance with data processing obligations. Enterprise customers may request audit reports or conduct data processing audits with reasonable advance notice, subject to confidentiality arrangements.

11. Data Processing Agreement (DPA)

Enterprise customers requiring a formal Data Processing Agreement (DPA) to satisfy GDPR or other regulatory requirements may request one from our legal team at support@clientop.io. We maintain a standard DPA that can be executed as an addendum to your service agreement.

12. Contact Our Data Protection Team

For data processing inquiries, DPA requests, or privacy-related questions: support@clientop.io