Privacy Policy

1. Introduction

YourWayCRM ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our customer relationship management (CRM) service.

We operate in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Greek data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

We collect information that you provide directly to us, including:

• Account Information: Name, email address, phone number, and password when you register
• Business Information: Organization name, business details, and service offerings
• Client Data: Information about your clients that you store in the CRM. Depending on the matter this may include special category data, or data relating to criminal convictions and offences. See section 4 below.
• Payment Information: Billing details processed through our payment provider (Stripe)
• Usage Data: Information about how you interact with our service
• Communications: Messages you send to us or through our platform

4. Legal Basis for Processing

We process your personal data based on the following legal grounds (GDPR Article 6):

• Contract Performance: Processing necessary to provide our services to you
• Legitimate Interests: For business operations, security, and service improvement
• Legal Obligations: Compliance with applicable laws and regulations
• Consent: For optional features like marketing communications

Special Category and Criminal Offence Data (GDPR Articles 9 and 10)

A client file held by a law office can contain information that the GDPR gives additional protection to: special category data under Article 9, and data relating to criminal convictions and offences under Article 10. Whether it does depends entirely on the matter you are handling.

• Our respective roles: where you store data about your own clients, you act as the data controller and we act as a data processor on your behalf.
• Your responsibility: as controller, you are responsible for having a valid condition for that processing — for special category data this is commonly Article 9(2)(f), the establishment, exercise or defence of legal claims. You are also responsible for informing your clients how their data is handled.
• Our processing: we process this information only to provide the service to you and on your instructions. We do not use client data for analytics, profiling, advertising, or to train machine learning models.
• Data minimisation: you should only enter information that is necessary for running your office. Our service is not designed to be a case management or document management system of record.
• Access: records are restricted to your organisation. Matter notes are visible only to the lawyer who wrote them, and are not shown to colleagues. Other client information — contact details, appointments, packages and uploaded files — is available to the colleagues you invite to your organisation, so you remain responsible for who you grant access to.

5. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve our CRM services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

• Account Data: Retained while your account is active and up to 30 days after deletion
• Customer Data: Retained according to your data management preferences
• Payment Records: Retained for 7 years as required by Greek tax law
• Usage Logs: Retained for up to 12 months

7. Data Sharing

We may share your information with:

• Service Providers: Third parties that help us operate our business (hosting, payment processing)
• AI assistant (optional): If your organisation's owner switches on Jenny B., our in-app AI assistant, the messages you type to her and the records she reads to answer them are sent to Anthropic for processing. Jenny B. is off by default.
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at support@yourwaycrm.com

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• All traffic encrypted in transit using TLS
• Passwords stored using one-way hashing, never in readable form
• Third-party integration credentials you provide (such as payment or messaging tokens) encrypted in our database
• Strict separation between organisations, so each practice can access only its own data
• Matter notes readable only by the lawyer who wrote them
• Regular security updates and daily backups

10. Where Your Data Is Stored

Your account and client data — including client records, appointments, notes and uploaded files — is stored on servers located in Germany, within the European Union. We do not replicate this data outside the EU.

A small number of service providers support specific features and may process limited data. Where any of these operate outside the EEA, the transfer relies on appropriate safeguards such as Standard Contractual Clauses or an EU adequacy decision:

• Hosting: our servers and database (Germany, EU)
• Payment processing: Stripe, for subscription billing and — where you enable it — online payments from your clients
• Email delivery: our email provider, used to send appointment confirmations and reminders
• AI assistant (only if switched on): Anthropic (United States), which processes the messages sent to Jenny B. and the records she reads to answer them. It stays off until the organisation owner switches it on in Settings; the transfer relies on Standard Contractual Clauses, and under Anthropic's commercial terms the data is not used to train its models.

Where you connect your own WhatsApp Business account to send reminders, those messages are sent using your own credentials and your own agreement with that provider.

11. Cookies

We use essential cookies to provide our service functionality. These cookies are necessary for the website to function and cannot be switched off. For more information, see our cookie notice in the application.

12. Supervisory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Significant changes will be communicated via email.