GDPR compliance
GDPR support for Mizu CRM customers: DPA, data subject rights tooling, and subprocessors documented in our Trust Center. Compliance is an ongoing program - not a one-time certificate.
Data Processing Agreement
Our DPA is available immediately no NDA required. It covers all the requirements of GDPR Article 28 including processing instructions, security measures, subprocessor management, and data subject rights assistance.
Your data subject rights
We respond to all data subject requests within 30 days, as required by GDPR Article 12.
Right to access
Art. 15You can request a copy of all personal data we hold about you. We respond within 30 days.
How: Email privacy@mizucrm.com or use the in-app data export tool
Right to rectification
Art. 16You can request correction of inaccurate personal data at any time.
How: Update directly in your account settings or email privacy@mizucrm.com
Right to erasure
Art. 17You can request deletion of your personal data where we no longer have a lawful basis to process it.
How: Email privacy@mizucrm.com we action deletion within 30 days
Right to data portability
Art. 20You can receive your personal data in a structured, machine-readable format (JSON or CSV).
How: Use the in-app data export tool or email privacy@mizucrm.com
Right to restrict processing
Art. 18You can request that we limit how we process your data while a dispute is being resolved.
How: Email privacy@mizucrm.com with your specific restriction request
Right to object
Art. 21You can object to processing based on legitimate interests, including direct marketing.
How: Use the unsubscribe link in marketing emails or email privacy@mizucrm.com
Submit a data subject request
Email privacy@mizucrm.com we acknowledge within 72 hours and respond in full within 30 days.
Lawful basis for processing
We only process personal data where we have a clear lawful basis under GDPR Article 6.
International data transfers
When personal data is transferred outside the EU/EEA, we use approved transfer mechanisms to ensure an adequate level of protection.
Standard Contractual Clauses (SCCs)
Transfers from EU/EEA to third countries
UK International Data Transfer Addendum
Transfers from the United Kingdom
EU data residency
Primary CRM data in eu-west-1 (Ireland)
UK data residency
Primary CRM data in eu-west-2 (London)
Post-create region migration
Enterprise orgs may migrate between supported regions via controlled export/import
Data retention
We retain personal data only for as long as necessary for the purpose it was collected.
Breach notification
72-hour supervisory authority notification
In the event of a personal data breach, we notify the relevant supervisory authority within 72 hours of becoming aware, as required by GDPR Article 33.
Customer notification
Where a breach is likely to result in a high risk to individuals, we notify affected customers without undue delay per GDPR Article 34. Our target is within 24 hours of confirming the breach.