Klytic

Home›Guides›CRM & sales data

CRM & sales data · Understand

Who owns CRM data, and why it matters as much as your accounts

CRM data belongs to the company that collects it: under the GDPR, it is the controller, and the software vendor or host that processes the data on its behalf is the processor. This file is not just an address book. Records, quotes and invoices form a snapshot of the business as telling as a general ledger, and deserve the same level of protection.

Updated October 20268 minOfficial sources cited

Who holds the customer file

People speak of data “ownership” for convenience. For personal data, the law reasons differently: it asks who decides and who carries out. The GDPR defines the controller as the body which “determines the purposes and means of the processing”, and the processor as the one which “processes personal data on behalf of the controller” (Article 4, points 7 and 8).

In a hosted CRM, the company that prospects and invoices is the controller. The provider that runs the software is the processor: it acts on instructions and does not choose how the file is used.

Three practical consequences follow:

  • The provider acts only on instructions. Article 28 requires the processor to process the data “only on documented instructions from the controller”. A CRM whose vendor reused your records for its own purposes would fall outside this framework.
  • Leaving is a right, not a favor. At the end of the contract, the processor must, “at the choice of the controller”, delete the data or return it, and delete existing copies, unless the law requires them to be retained.
  • The contract says who uses the data. The data processing agreement (often called a DPA) sets out the instructions, security measures, sub-processors and return of data. That is what you should read before choosing a CRM, not the home page.

The question “who can open my data, which law applies, how do I leave” is covered in detail in the guide What is a sovereign cloud?. Remember one rule: reversibility is written in at signature, with the format, the timeframe and deletion, not at termination.

What is sensitive in a CRM

Start from the objects every sales CRM manages, rather than a theoretical list of fields: prospects, customers, contacts, opportunities, quotes, orders, invoices, credit notes and reminders. Each carries a different type of information.

ObjectWhat it containsWhy it is sensitive
ContactsNames, job titles, emails, phone numbersPersonal data under the GDPR, useful to anyone wanting to approach your contacts
Relationship historyCalls, meetings, notes, follow-upsReveals the state of each relationship, sometimes a dispute or dissatisfaction
OpportunitiesAmounts, probabilities, deadlinesShows where you are about to sign, and at what price
Quotes and ordersPrices, discounts, termsExposes your pricing policy customer by customer
Invoices, credit notes, remindersRevenue, late paymentsHints at the financial health of a customer account

Free-text notes require particular attention. Salespeople sometimes write more there than they should. The GDPR requires data to be adequate and limited to what is necessary: a note that does not help the business relationship has no place in the record.

The people whose details appear in the file have rights: access, rectification, erasure, restriction, objection and, where applicable, portability (Articles 15 to 21 of the GDPR). A prospect who asks what you know about them must receive a complete answer. You therefore need to be able to find and extract their data without searching through ten tools.

What the whole reveals

A single record says little. The file as a whole says almost everything about the sales side of the business:

  • The pipeline: what you are going to sign, when, and with what probability.
  • Concentration: how many customers account for most of the revenue, and which ones.
  • Seasonality: when in the year you sell, follow up and collect payment.
  • Commercial terms: discounts, payment terms, negotiated prices.

It is a snapshot of the business, just like a general ledger. Accounting says how much the company earned. The CRM says with whom, how and what comes next. For a competitor preparing a targeted offer, or for an employee leaving with the idea of poaching a team or a portfolio, the latter is often more useful than the former.

Example. A 40-person industrial maintenance SME generates 60% of its revenue from twelve customers. A full CRM export provides, in a single file, the twelve names, the contacts, the prices charged and the contract renewal dates. No accounting document provides these four pieces of information together.

The CRM should therefore be handled under the same rules as finance: few people authorized to see everything, rights reviewed when someone changes role, and a record of changes.

Protecting it: who sees, who exports, who changes role

Protecting the customer file depends less on a technical setting than on three questions asked regularly: who sees which records, who has the right to export, and who is a contractor or changing role. Klytic CRM customers will find the corresponding settings in Who sees which customers in Klytic CRM and Preventing portfolio exports and reviewing changes.

Encryption: what it protects in a CRM

A CRM must read records to work: search for a customer, compute a dashboard, generate a quote, send an invoice. Its data is therefore encrypted at rest, with keys the service can use.

The guide What is a sovereign cloud? distinguishes two regimes:

  • Encryption at rest, with keys operated by the provider. It protects disks and media that are stolen or improperly recycled. It does not make the data unreadable to the service itself. This is the regime of a CRM.
  • Encryption where the customer alone holds the key. This is the case for documents encrypted at the source or for messages signed and encrypted with S/MIME. The provider cannot read the content, but it cannot process it either.

Presenting a CRM as “end-to-end encrypted” would be misleading. What protects the customer file, beyond encryption at rest, is access rights, logs, the contract and the law applicable to the provider.

E-invoicing: an intended and regulated outflow

In France, the e-invoicing reform requires companies to route their business-to-business invoices through a certified platform (plateforme agréée), registered by the tax authorities. This platform issues, transmits and receives invoices, and passes certain data on to the authorities.

The timetable published by the French Ministry of the Economy is as follows:

  • September 1, 2026: all companies, regardless of size, must be able to receive e-invoices. Large companies and mid-sized companies must also issue them.
  • September 1, 2027: the obligation to issue extends to SMEs and micro-enterprises.

For the CRM, this means that billing data deliberately leaves the tool for a third party designated by law. This is not a leak: the destination, format and content are defined. The usual structured formats are CII, UBL and Factur-X. Before choosing, check which platform the CRM connects to, who operates it, and where invoice statuses (submitted, rejected, paid) are sent back.

Common mistakes

  • Confusing hosting with holding. Hosting with a third party does not transfer responsibility: the company remains the controller.
  • Giving every salesperson a view of the whole file, for convenience, at project start, and never revisiting it.
  • Leaving the export right with everyone. Reading a record and downloading the whole portfolio are two different rights.
  • Forgetting copies: exports on workstations, backups, ticket attachments. At the end of a contract, they count too.

Frequently asked questions

Can my CRM provider use my customer records?

As a processor, it may only process them on your documented instructions. Check this in the data processing agreement, and read our GDPR page.

Is encryption enough to protect a CRM?

No. It protects the media. Rights and the contract protect how data is used. The sovereign cloud guide explains the difference.

How do I stop a salesperson from walking away with the portfolio?

By separating the right to read from the right to export. See Preventing portfolio exports.

How do I separate the customers of two companies in a group?

See Who sees which customers in Klytic CRM.

Where Klytic stands

Klytic CRM manages prospects, customers, contacts, opportunities, quotes, orders, invoices, credit notes and reminders. Inventory, purchasing, projects and expense reports can be added as needed. The service can be used on its own, without Klytic Mail or Klytic Docs.

  • Role. For CRM records entrusted to the service, Klytic acts as a processor within the meaning of Article 28 of the GDPR. A data processing agreement is signed with each customer.
  • Use of data. Klytic states that data is never used for commercial purposes or by third parties.
  • Hosting. In any geographic zone matching the applicable jurisdiction, subject to service availability, notably in Europe or Mauritius, or on the customer’s own servers. See Hosting and sovereignty.
  • Encryption. At rest, with keys the service uses. This is not encryption where the customer alone holds the key.
  • Onboarding and exit. Assisted import from a spreadsheet or another software package. At the end of the contract, data remains exportable for 30 days in standard formats, with assistance, and is then deleted.
  • E-invoicing. CII, Factur-X and UBL formats, connection to EsaLink (Hubtimize) and SuperPDP. Details on the Klytic CRM page.
  • Backup. Every hour, kept for 30 days, restoration through support, included or charged depending on the cause. Klytic CRM has no recycle bin by default: the optional “recycle bin” extension lets you recover a deleted record yourself and helps support the open-source project on which it is based. See Security and backup.

Klytic is not SecNumCloud-qualified. If your sector requires it, it is not the right choice.

This page describes a general framework. It does not replace an analysis of your contract or legal advice.

Legal status as of October 11, 2026. The e-invoicing timetable cited here is the one published by the French Ministry of the Economy. It has been changed in the past: check the official page before making any decision.

Sources

Consulted in October 2026.

  • GDPR, Article 4, points 7 and 8: definitions of controller and processor. cnil.fr
  • GDPR, Articles 15 to 21: rights of access, rectification, erasure, restriction, portability and objection. cnil.fr
  • GDPR, Article 28: documented instructions, deletion or return of data at the end of the service; Article 32: encryption among security measures. cnil.fr
  • Regulation (EU) 2016/679, official text, Recitals 81 (return or deletion by the processor) and 83 (encryption). eur-lex.europa.eu
  • E-invoicing timetable: receipt by all companies from September 1, 2026, issuance by SMEs and micro-enterprises from September 1, 2027. economie.gouv.fr
  • Role of certified platforms: issuing, transmitting and receiving invoices, and transmitting data to the authorities. impots.gouv.fr
  • Klytic CRM: objects managed, modules, e-invoicing formats and platforms, hosting. klytic.com
  • Encryption at rest of CRM data and the difference with a customer-held key; reversibility. klytic.com
  • Klytic’s role as processor, data processing agreement, 30-day reversibility. klytic.com

Review your customer file

Import, access rights, hosting and e-invoicing: describe your situation and we will tell you what Klytic CRM does and does not cover.

Contact us →

Discover Klytic CRM

Further reading

Use · CRM & sales dataWho sees which customers in Klytic CRMOne account per person, rights per module, a scope per salesperson. And, to separate two companies in a group, a dedicated instance for each.6 min readRead →Use · CRM & sales dataPreventing portfolio exports and reviewing changesReading a record and exporting the whole file are two separate rights in Klytic CRM. Remove the second, and know what the log records.6 min readRead →GuidesWhat is a sovereign cloud?A sovereign cloud is judged by its operator, the applicable law, control over access and data exit. The datacenter’s location is not enough.GuidesRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing