Support and CRM
GDPR Pipedrive
In an indie stack, Pipedrive is used for CRM and sales pipeline. Entity cited: Pipedrive, Inc. is the US recipient named in the DPA. The notice refers to Pipedrive, Inc. and its affiliates. Legal name of the entity that signs for a European Union customer: not disclosed.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 5, 2026. Verified on October 5, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Pipedrive
Yes. Public Data Processing Addendum, incorporated into the terms, Article 28.
Stated role
The DPA states that, unless otherwise agreed, the customer is controller and Pipedrive is processor of the personal data contained in the Client Data.
Personal data
The DPA generally cites name, title, address, email, phone, customer history, IP addresses, free-text notes entered by the customer, and any other data the customer chooses to record. It states that it does not anticipate sensitive data. Persons cited: the customer's officers, employees, customers, suppliers, and contacts.
Sub-processors of Pipedrive
Public list authorized by the DPA.
Transfers outside the EU
Hosting / location
The DPA states that Pipedrive, Inc. is a recipient of personal data in the United States, and that affiliates and sub-processors may process where they operate. Intra-group transfers go through an internal agreement and standard contractual clauses. Single storage region: not disclosed.
EU–United States Data Privacy Framework
The DPA and the notice state that Pipedrive Inc. is registered under the EU-U.S. Data Privacy Framework and the United Kingdom extension. The exact status displayed on the participant entry (Active or under review) was not read on 5 October 2026. Status: not disclosed.
Cookies
Cookie names: not disclosed.
Typical use, written by StackLégal and not by the vendor: CRM and sales pipeline.
History
Last update: October 5, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 5, 2026.
Frequently asked questions
Is Pipedrive a processor within the meaning of the GDPR?
The DPA states that, unless otherwise agreed, the customer is controller and Pipedrive is processor of the personal data contained in the Client Data.
What DPA does Pipedrive publish?
Yes. Public Data Processing Addendum, incorporated into the terms, Article 28. https://www.pipedrive.com/en/privacy/dpa
Which further sub-processors does Pipedrive publish?
Public list authorized by the DPA. https://www.pipedrive.com/en/subprocessors
Where does Pipedrive state that it processes data, including outside the EU?
The DPA states that Pipedrive, Inc. is a recipient of personal data in the United States, and that affiliates and sub-processors may process where they operate. Intra-group transfers go through an internal agreement and standard contractual clauses. Single storage region: not disclosed.
Is Pipedrive registered under the EU–United States Data Privacy Framework?
The DPA and the notice state that Pipedrive Inc. is registered under the EU-U.S. Data Privacy Framework and the United Kingdom extension. The exact status displayed on the participant entry (Active or under review) was not read on 5 October 2026. Status: not disclosed.
Which personal data does Pipedrive mention?
The DPA generally cites name, title, address, email, phone, customer history, IP addresses, free-text notes entered by the customer, and any other data the customer chooses to record. It states that it does not anticipate sensitive data. Persons cited: the customer's officers, employees, customers, suppliers, and contacts.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.