The CRM, explained
Choosing a European CRM
Where your data is stored, which law applies to the companies that hold it, and how you get it back if you leave.
A European CRM is published by a company established in the EU and stores your data there. Both points matter, yet neither makes a CRM GDPR compliant on its own: the GDPR does not require data to stay in Europe, and it does not settle which other laws apply to the companies that host it. Here is what to check, and how Lea answers.
What the GDPR guarantees, and what it does not
The GDPR sets the rules for using personal data: a legal basis for each use, clear information for the people concerned, their rights of access, rectification, erasure and objection, security obligations, and a contract with every vendor that processes the data for you. American vendors serving European companies are bound by it too, through that contract and the rules on transfers. What it does not do is keep data in Europe: transfers outside the EU are lawful under conditions, such as an adequacy decision or standard contractual clauses. Nor does it settle conflicts of laws: a company subject to a non-EU country’s law can receive a request for data from that country’s authorities.
Four questions to ask a CRM vendor
Ask them in writing. In which country is the data stored? Which company hosts it, and which country’s law is that company subject to? Ask the same of any other provider that can access the data. Who publishes the software, and where is that company established? Can you export your data yourself, at any time, without asking support? Clear answers to all four tell you more than a “GDPR-compliant” badge on a website.
Reversibility, the test that matters most
The everyday risk is not espionage but lock-in: a CRM that makes exporting hard keeps you, because leaving would mean losing your history. Check that contacts, organizations and deals can be exported in an open format such as CSV, and ask what the export leaves out. Do not count on the GDPR here: its right to data portability belongs to individuals, for the data they have provided about themselves, not to your company for its whole database. Check the product, and the contract.
Where Lea stands
Lea CRM is published by N.Y.B.K. SAS, a French company. The application and its database (contacts, organizations, deals, notes) run in Amsterdam, in the Netherlands, on servers operated by Railway Corp., an American company: that is our answer to the second question, and yours to weigh. Other providers handle specific tasks, such as storing attachments and sending emails; ask us for the list. Any user can export contacts and organizations to CSV from the application, at any time, without asking support; account administrators can also export deals. The interface is available in six languages, and a built-in do-not-contact list covers people who have asked not to be contacted again: emails and SMS from your team are blocked, and an import cannot bring them back.
Frequently asked questions
Does the GDPR require a CRM to be hosted in Europe?
No. Personal data may leave the EU under conditions, such as an adequacy decision or standard contractual clauses. Hosting in Europe keeps things simpler but is not a legal requirement, and it says nothing about the law that applies to the hosting company.
What makes a CRM GDPR compliant?
No software is compliant on its own: it depends on how your company uses it. A CRM can give you tools, such as an export you run yourself and a do-not-contact list to respect objections, and its vendor should answer in writing about where your data lives.
Is Lea a European alternative to HubSpot?
If “European” means a publisher and data in the EU, yes: Lea is published by a French company and its database runs in Amsterdam. The company that operates those servers, Railway Corp., is American, and we say so. Put the same four questions to every vendor you compare, HubSpot included, and judge the written answers, not the labels.
How can I check what a CRM vendor claims?
Ask for the name of the hosting company and the country of storage in writing, in the contract or the privacy policy. A claim on a website commits a vendor to little; a contract clause does.