Last Updated: 21 June 2026
This Data Protection declaration summarises how Bizlumo ERP processes personal data in compliance with applicable data-protection laws, including the EU/UK General Data Protection Regulation (GDPR). It complements our Privacy Policy and, for customers who require one, is supported by a separate Data Processing Agreement (DPA).
1. Roles of the Parties
For account, billing and website data, Bizlumo ERP acts as a data controller. For personal data contained in Customer Data that you process using the Services, you (the customer) are the controller and Bizlumo ERP acts as a processor, processing such data only on your documented instructions and as needed to provide the Services.
2. Subject Matter & Nature of Processing
We process Customer Data to provide CRM, HRM/payroll, accounting, project, POS and related functionality. The categories of data subjects and personal data are determined by you and may include your staff, customers and vendors (e.g. names, contact details, employment and financial records).
3. Sub-Processors
We engage vetted sub-processors (for example cloud hosting, payment processing, email/SMS delivery, analytics and support tooling) under written contracts imposing data-protection obligations no less protective than those we owe you. We maintain a list of sub-processors, available on request, and will give notice of intended changes so you may object on reasonable grounds.
4. Security Measures
- Encryption of data in transit (TLS) and hashing of credentials.
- Role-based access controls and least-privilege access.
- Network and application protections, logging and monitoring.
- Regular backups and tested restoration procedures.
- Personnel bound by confidentiality and security training.
5. Confidentiality of Personnel
Our personnel authorised to process personal data are subject to appropriate confidentiality obligations.
6. International Transfers
Where personal data is transferred across borders, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.
7. Assistance with Data-Subject Requests
Taking into account the nature of the processing, we provide reasonable assistance to help you respond to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability and objection).
8. Personal-Data Breach Notification
We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Data, and provide information reasonably available to help you meet your notification obligations.
9. Data Protection Impact Assessments
We provide reasonable assistance with data-protection impact assessments and prior consultations with authorities where required, given the information available to us.
10. Return & Deletion
On termination of the Services, and subject to legal retention requirements, you may export Customer Data; thereafter we will delete or return Customer Data in accordance with our Terms and any DPA.
11. Audits
We will make available information reasonably necessary to demonstrate compliance and, subject to confidentiality and reasonable scheduling, allow for audits as set out in the DPA.
12. Requesting a DPA & Contact
To request a Data Processing Agreement or to contact our data-protection function, use the support options in your account dashboard.
