Privacy

Privacy Policy

Controller / contracting party: S. Simon Communication, trading as Pomio CRM (“Pomio”).

Pomio CRM is a trading name of S. Simon Communication, the legal provider of the Pomio CRM service.

Last updated: 4 November 2026 (Europe/Amsterdam)
Language: English (default)

1. Who we are

Pomio CRM (“Pomio”, trade name/brand) is the provider of the Pomio SaaS multi-tenant Customer Relationship Management (CRM) for leads, companies, contacts and pipeline (not an Applicant Tracking System / ATS) (EU / Made in Europe positioning). The controller and contracting party for this Privacy Policy is S. Simon Communication, trading as Pomio CRM, Dutch Chamber of Commerce (KvK) number 62685252, VAT identification number NL002218668B93, Pier Christiaanswei 11A, 8508 SB Delfstrahuizen, the Netherlands. This includes our own customer administration (accounts, subscriptions, invoicing and support).

Privacy contact: via the contact page (forms on this site). Email for legal and privacy questions (including data subject requests): legal@pomiocrm.com. For support, please use the support form on the contact page.

2. Roles under GDPR / AVG

Context	Who is controller?
Pomio marketing website, trial/demo/contact intake, our own customer administration (account administration, subscriptions, invoicing), support about the product	Pomio (controller)
Personal data that you (the customer) store or process inside the Pomio CRM on behalf of your own organisation or clients	You (the customer) are controller; Pomio acts as processor; the data processing agreement (DPA / verwerkersovereenkomst) applies from the start of the trial and is accepted at registration

This Privacy Policy mainly covers processing where Pomio is controller. CRM customer-content processing is governed by the Terms and the DPA.

3. What we process and why

3.1 Account & subscription

Data: name, email, organisation, seat count, plan, payment status / billing references, billing details (legal name, address, VAT number, KvK or registration number)
Purpose: create and manage your Pomio CRM subscription, authenticate users, invoice
Legal basis: performance of contract (Art. 6(1)(b) GDPR); for tax records: legal obligation (Art. 6(1)(c) GDPR)
Recipients: Google/Firebase (hosting and sign-in), Stripe (payments), WeFact (invoices), Resend (service emails); a VAT number provided is checked via VIES (see §6)
VAT check: where a VAT identification number is provided, we record: the VIES result (including the consultation number and the name and address returned by VIES), the country code of your IP address (not the full IP address), the country of your payment card (from Stripe) and the VAT decision. Purpose: statutory VAT obligations and fraud prevention. Legal basis: Art. 6(1)(c) GDPR; for IP and card country also Art. 6(1)(f) GDPR (you may object). Source: VIES and Stripe.

3.2 CRM service delivery (as processor)

Data: whatever you enter into Pomio (contacts, notes, activities, etc.)
Purpose: host and operate the CRM for you
Legal basis (your side): determined by you as controller; our processing is on your documented instructions (Art. 28 GDPR) under the DPA (applies from the start of the trial, accepted at registration)

3.3 Support

Data: contact details, ticket content, technical logs needed to diagnose issues; via the support form: company name, name, business email, subject, request type, priority, description, page or error message and any attachment. Never include passwords, codes, card details or API keys.
Purpose: respond to support requests
Legal basis: contract and/or legitimate interest in assisting customers (Art. 6(1)(b)/(f))
Recipients: Typeform (support form) and Google Workspace (support mailbox)

3.4 Trial / demo / contact / support / privacy intake (Typeform)

Data: fields you submit via Typeform (typically name, email, company, message, request type)
Purpose: handle trial, demo, contact, support, and privacy requests
Legal basis: pre-contractual steps / contract (Art. 6(1)(b)) or legitimate interest in responding to enquiries (Art. 6(1)(f)); consent where we ask for marketing follow-up
Note: Typeform (Typeform SL, Barcelona) is a processor of Pomio for these forms; form responses are stored in the US (see §6 and §7)

3.5 Cookies & similar technologies

We use necessary first-party cookies (for example session and security) to operate the site and app. Cloudflare may set necessary or security-related cookies to protect and deliver the site.

Non-essential cookies or analytics — which may include Google Analytics where enabled on the site — are only set after consent. You can manage or withdraw consent via the cookie settings / banner on the site when available. Details of specific cookies follow the cookie settings on the site; we do not publish a fixed name/duration table in this policy.

3.6 Marketing (if any)

Where we send product or marketing communications: only with consent or soft-opt-in where Dutch/EU law allows for existing customers, with a clear opt-out
Legal basis: consent (Art. 6(1)(a)) and/or legitimate interest with opt-out where applicable

3.7 Sign-up and bot protection (Cloudflare Turnstile)

Data: technical signals from your browser and device (such as IP address and browser characteristics) when signing up for a trial in the app
Purpose: prevent automated sign-ups and abuse
Legal basis: legitimate interest in securing the service (Art. 6(1)(f) GDPR)
Note: Turnstile is only used on the app’s sign-up page, not on this website. Cloudflare is a processor for this and, for improving Turnstile, acts as an independent controller (see §6).

4. Categories of data (summary)

Identity & contact data
Organisation / role data
Account & subscription data
Support communications
Typeform intake / privacy-request data
Technical / log data (IP, user agent, timestamps — as needed for security and operations)
Cookie/analytics identifiers (non-essential only with consent)
CRM content: processed as your data under your controllership (see §2)

We do not intentionally collect special categories of personal data for our own purposes as controller. Do not submit such data via marketing forms unless necessary and lawful on your side.

5. Retention

We retain personal data only for as long as needed for the purposes described in this policy, to perform the contract, and to meet applicable legal obligations (including fiscal and accounting duties where they apply). We also retain data as needed to handle deletion or other rights requests.

Data	Approach
Account & subscription / billing	For the subscription relationship and as long as required for legal / tax obligations: invoices, VAT records and VIES evidence 7 years (Art. 52 Dutch AWR), 10 years for OSS records where applicable
CRM customer content	Per your instructions as controller, until you delete it or the account ends, then for a reasonable period to allow export (see Terms), subject to legal holds
Environment after a trial without a paid subscription	For the retention period (10-day read-only grace period) after the trial ends, then deleted in a controlled manner, subject to statutory retention obligations and any legal hold
Support communications	For as long as needed to resolve the request and for a reasonable follow-up / archive period, up to 12 months after the request is resolved
Typeform privacy / lead forms	Until handled, then for a reasonable period, or earlier on request where applicable
Security / operational logs	For as long as needed for security, abuse prevention and operations
Cookies	According to the cookie settings / banner on the site

6. Recipients and subprocessors

Pomio shares data only with service providers engaged by Pomio, to the extent necessary. For the processing described in this Privacy Policy they act as processors for Pomio, unless stated otherwise below. To the extent they process CRM customer data, the same providers are subprocessors under the DPA.

Google Cloud / Firebase (Google) — hosting, database, file storage, backend functions and sign-in (Firebase Authentication). Storage and processing: the database and CRM files are stored in the EU (Netherlands); tenant logos are stored in the US. Most backend functions run in the US (including billing, mailbox, privacy requests, trial, communications, documents, CRM file downloads, Stripe webhooks and user management) and process personal data there, including the content of CRM files when downloaded. Firebase Authentication processes data in the US. Processor under the Cloud Data Processing Addendum (cloud.google.com/terms/data-processing-addendum) and the Firebase Data Processing and Security Terms (firebase.google.com/terms/data-processing-terms); subprocessors: cloud.google.com/terms/subprocessors.
Google Workspace (Google) — business email, including the support mailbox and support correspondence. Processor under the same Cloud Data Processing Addendum; subprocessors: workspace.google.com/intl/en/terms/subprocessors.html. No data region set; processing may also take place in the US and other countries (see §7).
Resend (Plus Five Five, Inc., US) — sending transactional email from the service. Processor; email data is stored in the US, even when sending runs through an EU region. DPA: resend.com/legal/dpa; subprocessors: resend.com/legal/subprocessors.
Stripe (Stripe Payments Europe, Limited, Ireland) — payment processing. Stripe is a processor for payment processing and, for certain purposes (such as fraud prevention, anti-money-laundering and identity checks, legal obligations and improving its services), acts as an independent controller under its own privacy policy (stripe.com/privacy). DPA: stripe.com/legal/dpa; service providers: stripe.com/legal/service-providers.
WeFact — creating and sending invoices. Processor; processing within the EEA. Data processing agreement: www.wefact.nl/verwerkersovereenkomst/.
Cloudflare — CDN, security and site delivery, and Cloudflare Turnstile for the bot check at sign-up in the app (see 3.7). Processor; for improving Turnstile, Cloudflare acts as an independent controller. DPA: www.cloudflare.com/cloudflare-customer-dpa/; Turnstile Privacy Addendum: www.cloudflare.com/turnstile-privacy-policy/; subprocessors: www.cloudflare.com/gdpr/subprocessors/.
Typeform (Typeform SL, Barcelona) — forms for contact, support, demo and privacy requests. Processor; our Typeform account uses Typeform’s default storage in the US. DPA: www.typeform.com/dpa/; subprocessors: help.typeform.com/hc/en-us/articles/360029617191.
Google Analytics — optional analytics where enabled (only with consent)
Other processors as reasonably needed to operate Pomio CRM (for example professional advisers under confidentiality)
Authorities where legally required (including the Dutch Tax Administration) and our accountant

External source (not a processor): to check a VAT identification number provided to us, Pomio consults VIES, the European Commission’s public VAT validation system (ec.europa.eu/taxation_customs/vies/). The VAT number and country are queried. The European Commission is not a processor of Pomio.

This list may be updated from time to time. The current list is also set out in the DPA. We do not sell personal data.

7. International transfers

Part of the processing takes place in the United States, including at Google/Firebase (most backend functions, including when CRM files are downloaded, the storage of tenant logos and Firebase Authentication), Resend (storage of email data), Typeform (storage of form responses), Stripe and Cloudflare. Pomio does not offer full data storage or processing within the EU.

For transfers to the US or another country outside the EEA without an adequacy decision, the following safeguards apply:

Google (Cloud, Firebase, Workspace): the EU–U.S. Data Privacy Framework (DPF) via Google’s Alternative Transfer Solution (cloud.google.com/terms/alternative-transfer-solution), with the EU Standard Contractual Clauses (SCCs) as fallback
Resend: SCCs in Resend’s DPA; in addition the DPF, to the extent Resend’s certification is active
Stripe: the DPF and SCCs, under Stripe’s Data Transfer Addendum (stripe.com/legal/dta)
Cloudflare (incl. Turnstile): the DPF, with SCCs as fallback
Typeform: Typeform SL (Spain) stores data with sub-processors in the US on the basis of SCCs (module 3) that Typeform concludes with them under its DPA; Typeform is not DPF-certified

A provider’s DPF certification can be checked at www.dataprivacyframework.gov/list.

8. Your rights (GDPR / AVG)

Where Pomio is controller, you may request:

Access, rectification, erasure
Restriction of processing
Data portability (where applicable)
Objection to processing based on legitimate interest
Withdrawal of consent (without affecting prior lawful processing)
Complaint to the Dutch Autoriteit Persoonsgegevens (or your local EU supervisory authority)

Submit privacy requests via the contact page. We respond within one month; that period may be extended in the cases permitted by the GDPR. We may ask you to confirm your identity.

For data inside your CRM tenant, contact your organisation (the controller) first; we assist as processor per the DPA/Terms.

9. Security

We apply appropriate technical and organisational measures for a multi-tenant SaaS CRM, including access control, encryption in transit, tenant isolation measures, and backups as configured. No measure is perfect; report suspected incidents via the contact page.

10. Children

Pomio is a B2B CRM. We do not knowingly offer the service to children. Marketing forms are not directed at minors.

11. Changes

We may update this policy. Material changes will be announced on the site and/or by email where appropriate. The “Last updated” date will change on each revision.

12. Contact

S. Simon Communication, trading as Pomio CRM
KvK number 62685252 · VAT identification number NL002218668B93
Email (legal and privacy questions only): legal@pomiocrm.com
Privacy and other contact: via the contact page.

End of Privacy Policy (EN).