⛨Security and data protection

In a data centre in Germany. Each installation of Aurora Hive Sales has its own database; two installations cannot see each other, even if they run on the same machine.

With Aurora Hive Sites, several websites share one installation; within it they are strictly separated from each other. Aurora Hive Live stores data on your customer’s web space — we have no server there.

The exact details for your installation — data centre, location, sub-processors used — are set out in your data processing agreement (AVV) and in the legal texts of your instance.

Yes, if someone processes personal data on your behalf, and that applies to the operator of your instance.

The agreement governs what may be done with the data, which sub-processors are involved, which technical and organisational measures apply and what happens when the contract ends. Without it, the processing lacks a basis under Art. 28 GDPR.

Aurora Hive Sales generates a draft from your master data, together with an annex on the technical measures. Have it checked before you use it — it is a draft, not legal advice.

That depends on which modules are switched on for you, and that is exactly why the list in Aurora Hive Sales is derived from the actual configuration of your instance, not from a fixed template. Whatever is listed there really is switched on.

Typically involved are: the operator of the servers, your mail provider (because you send via its mailbox), and — if switched on — the AI service and the search services for research.

You will find the list under Legal; it belongs as an annex to the data processing agreement.

Only what is needed for the step you have triggered — and only when you trigger it. There is no background process that looks through your data.

Two places are deliberately built without AI, even though it would be the obvious choice there:

• Column recognition during import. There it is calculated, not asked — no value from your file goes to an AI service. With contact data, that is not a minor detail.
• The recognition of industries and sectors in research works without AI.

Wherever AI is used — generating texts, assessing profiles, translating — this is marked and chargeable.

For business use of the interfaces employed, content transmitted is not used for training. What has been contractually agreed for your installation is set out in your data processing agreement.

Regardless of that, the practical rule remains: whatever does not have to go out, does not go out. That is why column recognition during import is built without AI, and why every AI step passes on only the excerpt it needs.

Within your instance: everyone who has an account. The role controls which areas someone sees, not which records — a caller sees the same contacts as an admin.

From outside: the operator of the instance, within the framework of the data processing agreement and limited to what operation and troubleshooting require.

What makes every change traceable is the Access log: who, when, where, with what result. Reading is deliberately not logged, and neither is the content of a change — it would be a second, unprotected copy of all personal data.

Aurora Hive Sales deletes almost nothing of its own accord — that is intentional: automatic deletion in a system containing business transactions does more harm than good.

What you control:

• Contacts you delete yourself; notes, tasks, follow-ups and the mail history go with them.
• Attachments you archive or delete.
• Usage counters are kept for three months.

What you should settle is the counterpart: your own deletion policy, stating how long you keep which data. The GDPR does not require a particular period, but it does require that you have one and keep to it.

The contact’s detail view shows everything stored about this person: master data, notes, the complete mail history, calls, tasks and follow-ups. On top of that there is the CSV export.

Remember the information that goes beyond the data itself and is also part of the response: origin (shown in the Import history), purpose and recipients (from your own legal texts), and the storage period.

Do not set the response deadline too tight: one month is the rule, and time passes quickly if it first has to be clarified internally who is responsible.

Quickly and in an orderly way, in this order:

1. Block the account through which it may have happened.
2. Report it — to the operator of your instance, immediately. Do not first check whether it is really serious; that eats up the time needed for the reporting deadline.
3. Record what you noticed and when. The Access log helps with reconstruction.
4. Assess whether a report to the supervisory authority is necessary. The deadline is 72 hours from becoming aware — and it runs while you are still thinking it over.

What you should not do: tidy up traces. At that moment, logs are the most valuable thing you have.

The measures that carry the weight in operation:

• Separate instances for each customer — own database, own environment.
• Encrypted transmission and encrypted storage of mailbox credentials, which are never displayed again.
• Sign-in via the provider (instead of passing on passwords), where the mail provider supports it.
• Access log covering all operations that change data.
• Daily backups including a restore test.
• Rate limits against too many requests in a short time.

What the system cannot do is the part that lies with you: your own passwords, deactivated accounts for people who have left, care when exporting.

It can become one. An export takes personal data out of the protected system — afterwards the same obligations apply, but none of the technical safeguards.

In practice this means: do not send it unprotected by email, do not store it on a private computer, delete it after use. And: the export itself is recorded in the Access log — which is a good thing, because if in doubt it is the trail.

It depends on where.

• That software has been developed with AI support does not need to be labelled and does not belong in the legal notice (Impressum).
• AI in the product that affects people is a different matter. Anyone interacting with an AI system must be able to recognise this.
• Particularly strict is the use of AI in the selection of applicants: in Europe this falls under the high-risk classification and brings its own obligations — human oversight, traceability, informing the people affected.

If you use the AI matching in the applications module, clarify this point before using it in live operation.

In most cases, yes. The exemption for small businesses hardly applies once personal data is processed regularly, and a CRM does exactly that.

What belongs in it: purpose of processing, categories of data subjects and data, recipients, deletion periods, technical and organisational measures.

You already have most of the details for it: the list of services used is in the generated legal texts, the measures in the annex to the data processing agreement.

Mandatory from 20 people who constantly process personal data — that is also what it says next to the field in the master data. Regardless of the number, there may be an obligation if the processing is particularly extensive or sensitive.

If you appoint one, they belong in the master data: from there they appear in the legal notice and the privacy notice, and that is exactly where someone who wants to make a request will look for them.

For a specific application: after the process has been completed, for as long as claims could still be asserted — in practice, six months is usually assumed for this.

If you want to keep a profile in your network beyond that, you need the person’s consent. This is not a formality: a candidate pool without consent is open to challenge at the first request.

Decide how long a profile stays without contact, and keep to it.

The instances are operated in Germany. Anything beyond that depends on the modules switched on: AI analyses and paid search services run via providers whose processing is not limited to Europe.

That is why the list of services involved appears in the legal texts of your instance — derived from the actual configuration. If you do not want this transfer, the clean way is not to activate the modules concerned.

With three questions that you should answer in writing — the balancing of interests must be traceable:

1. Is there an interest? Winning customers is one. Up to this point it is easy.
2. Is the processing necessary for it? Do you really need all the details you store?
3. Do the interests of the person concerned outweigh yours? Here the individual case decides: a factual connection to the recipient speaks for you, a bought list with no connection against you.

Record the result. A balancing exercise that only took place in your head does not count in a dispute.

Four rules that together prevent most incidents:

• Only what is needed. One profile, not a whole export.
• Not unprotected by email. Email is an open postcard; for sensitive documents, a protected storage location is better.
• Check the recipient. Auto-complete in the mail program is the most common cause of mails going to the wrong person.
• Clarify the basis. Anyone processing on your behalf needs a contract.

The classic remains the distribution list in CC instead of BCC — that is a reportable incident, not a slip.

By what it wants from you. No system notice asks you to enter a password on a linked page or to open a file you were not expecting.

Practical checks:

• Read the address bar, not the displayed text of a link.
• Do not sign in from the mail; open the address of your instance yourself.
• If in doubt, ask — a quick call costs less than a hijacked account.

A hijacked account is the most likely route to a data leak, and phishing is the most likely route to a hijacked account.

Do not open it, do not forward it, and do not ask the sender using the reply function — with a forged address, the query lands with the attacker.

Report it internally, and if the message came in via a connected mailbox, tell the operator of your instance. Do not delete it straight away: as long as it is there, it is possible to trace what happened.

If someone has already opened the attachment, that is a suspected incident — then the procedure for a data leak applies.