GDPR Compliance

Last updated: April 1, 2026

Our Commitment to GDPR

Good4Spot, operated by CRP SAS (based in France), is fully committed to complying with the General Data Protection Regulation (GDPR) and all applicable data protection laws. We recognize the critical importance of privacy and data security for our customers and strive to maintain the highest standards of compliance.

Data Protection Officer (DPO)

We have appointed a Data Protection Officer to oversee our data processing activities. You can contact our DPO at any time with questions about your data protection:

Your Rights Under GDPR

You have important rights regarding your personal data:

  • Right of Access: You have the right to access your personal data and receive a copy of the information we hold about you.
  • Right to Rectification: You can request the correction of inaccurate or incomplete personal data.
  • Right to Erasure (Right to be Forgotten): You can request the deletion of your personal data under certain conditions, including when the data is no longer necessary.
  • Right to Restrict Processing: You can request that we limit the processing of your data in certain circumstances.
  • Right to Data Portability: You have the right to receive your personal data in a structured and commonly used format, and to transfer it elsewhere.
  • Right to Object: You can object to certain processing activities, particularly processing based on our legitimate interests.
  • Right to Withdraw Consent: If your processing is based on prior consent, you can withdraw it at any time.

How to Exercise Your Rights

To exercise any of these rights, please send a written request to our DPO at admin@good4spot.com, including sufficient information to verify your identity. We will endeavor to respond to all requests within 30 calendar days from receipt of your request.

Data We Process

In the context of our services, we collect and process the following categories of data:

  • Account Information: First name, last name, email address, phone number (optional), company name.
  • Subscription Data: Subscription plan, payment history, subscription status.
  • HubSpot Identifiers: HubSpot portal IDs, access authorization to HubSpot portals.
  • Usage Logs: Access logs, activity history, dates and times of use.
  • Payment Information: Processed exclusively through Stripe (we do not directly retain credit card information).

Legal Bases for Processing

We process your personal data on the basis of one or more of the following legal grounds:

  • Contract Performance: To provide our services and perform the agreement you have entered with us.
  • Legitimate Interests: To improve our services, strengthen security, prevent fraud, and ensure legal compliance.
  • Legal Obligation: To comply with applicable laws and regulations.
  • Consent: When we request your explicit consent, for example for marketing communications.

Data Minimization

We apply the principle of data minimization, which means we collect and retain only the personal data strictly necessary to achieve the specified purposes. We regularly review our collection practices to eliminate unnecessary data.

Data Security

We implement robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

  • Encryption: Data in transit is encrypted via HTTPS/TLS (TLS 1.2 minimum).
  • Password Hashing: Passwords are hashed using bcrypt with a cost factor of 12.
  • HTTPS Protocol: All traffic to and from our servers is secured by HTTPS.
  • Session Management: User sessions are managed securely with regenerated tokens and inactivity timeouts.
  • Two-Factor Authentication (2FA): Available to strengthen account security.

Data Breach Notification

In the event of a security breach affecting your personal data, we commit to:

  • Notifying the supervisory authority (CNIL in France) within 72 hours of discovery of the breach, unless the data presents a low risk.
  • Informing you without undue delay if the breach creates a high risk to your rights and freedoms.

Sub-Processors and Data Transfers

We engage third parties (sub-processors) for certain services. All our sub-processors comply with the data protection obligations imposed by GDPR:

  • Stripe (United States): Payment processing. Stripe is regulated and provided with appropriate safeguards.
  • SMTP Provider: Sending transactional and marketing emails.
  • European Hosting: Our servers are hosted within the European Union to ensure data compliance.

International Data Transfers

Certain transfers of data to third countries (notably to the United States via Stripe) are made on the basis of:

  • European Commission adequacy decisions (where applicable).
  • Standard contractual clauses approved by the European Commission.
  • Other safeguard mechanisms recognized by GDPR.

Data Protection Impact Assessments (DPIA)

We regularly conduct Data Protection Impact Assessments (DPIA) for processing activities presenting high risks to ensure compliance and identify appropriate risk mitigation measures.

Cookie Management

Our site uses cookies to enhance your experience and ensure proper functionality. For more information about the cookies we use and how to manage them, please visit our Cookie Policy.

Right to Lodge a Complaint

If you believe we are not respecting your data protection rights, you have the right to lodge a complaint with the competent supervisory authority:

  • National Commission for Computing and Freedoms (CNIL) (France)
    3 Place de Fontenoy, 75007 Paris, France
    Website: www.cnil.fr

Contact Us

For any questions about our data protection policy or to exercise your rights, please contact us:

Good4Spot is a service provided by CRP SAS, an agency based in France. This GDPR compliance policy applies to all users regardless of their location and reflects our commitment to data protection on a global scale.