GDPR Compliance

Overview

Close has implemented processes and procedures to ensure we meet both our Data Controller and Data Processor obligations under the European Union’s (EU) General Data Protection Regulation (GDPR).

To determine our readiness for GDPR, Close conducted a risk-based gap analysis of current capabilities and validated the assessment with an independent, third-party, GDPR expert. Our relevant policies are available upon request.

It's important to note: GDPR does not have an accredited certification method, which means there is no GDPR-approved way to demonstrate compliance. If you have questions regarding our compliance please reach out to [email protected] and our Chief Cybersecurity Officer (CCO) or independent Data Privacy Officer (DPO) will gladly answer any questions you may have.

Security

• Close has strong data protection controls including encryption of data in transit and at rest, in order to safeguard Data Subject’s data from unintended disclosure or misuse.
  
• Close follows industry standard best information security practices and rigorously tests its products to proactively remedy bugs and vulnerabilities.
  
• Close maintains incident response and notification processes which are reviewed and tested annually.
  
• Close has procedures in place to ensure data recovery and data integrity, so that customer data is not lost or inadvertently corrupted.
  
• Close provides assurances that the customer retains full control of their data.
  
• Close's key data sub-processors, e.g. Amazon Web Services (AWS), all maintain rigorous security standards (SOC2 and/or ISO 27001 certifications, where possible), and undergo annual vendor reviews.
  

Contractual Agreements

Close provides Data Processing Agreements to any customer who may need them. Included in the Data Processing Agreement are standard contractual clauses for data transfer to third-party countries. These clauses ensure our customers can transfer data to countries outside of the European Economic Area (EEA) in order to be able to use the Close platform. Furthermore, Close has Data Processing Agreements in place with all sub-processors where required by law.

Recommendations for Close Customers

We believe security and privacy are a shared responsibility between vendor and customer. Close is committed to helping you successfully meet your GDPR privacy requirements. It is important to understand your obligations related to the GDPR regardless of where your organization resides.

• Read through and understand the regulation. Multiple languages and formats are available here.
  
• Perform a gap, or impact, analysis to determine if there are any controls or processes which need to be put in place to adhere to the regulation. If necessary, implement those changes.
  
• Review the personal information shared with Close, including any integrations you may have, and ensure you are not sharing or storing any unneeded or sensitive (SSN, driver’s license, credit card #, passport #, etc.) personal data.
  
• Determine if you require consent from Data Subjects in order to process their information. If so, update your consent collection and any forms or APIs if necessary.
  
• Review any processors, including Close, which may store or process sensitive information. Ensure they have the proper processes and controls in place and establish Data Processing Agreements where necessary.
  
• Update your privacy policy to reflect your use of Close as a data processor for the purpose of improving and managing your sales processes.
  
• Ensure you have the proper consent in order to track email opens or record calls. If not, we encourage you to turn those features off.
  
• Make sure to include unsubscribe links or notices within any emails which are required by law. Learn more
  
• If you have received a Right to be Forgotten request from a Data Subject, simply delete the lead within Close and within 30 days that information will be completely removed from our systems, including the Event Log API.
  
• If you or your company wish to have their data completely removed from our systems please email [email protected].
  

Data Removal Request

Name

This field is required.

Email Address

Please provide a valid email.

Request

Please say something

Submit

Thank you!

Please check your inbox to verify your email address and complete the submission process.

Oops! Something went wrong while submitting the form.