DealFunnelDealFunnel is a sales management platform operated by Broadbrand. This policy explains what personal information we collect, why we hold it, and what you can ask us to do with it. It covers the DealFunnel web application at thedealfunnel.com and the DealFunnel mobile apps for iOS and Android.
1. Who is responsible for your information
DealFunnel is sold to organisations, and almost everything in the platform is put there by the organisation you work for. That gives two different relationships.
| Information | Who decides how it is used |
|---|---|
| Your account: name, work email, phone number, role and sign-in history | Broadbrand, so that we can run the service and support you |
| Everything in the CRM: deals, accounts, contacts, activities, tasks and notes | Your employer, who instructs us to store and process it on their behalf |
Where your employer decides, we act only on their instructions. If you want CRM records changed or removed, ask your organisation's DealFunnel administrator first, because they control that data and can act on it immediately.
2. What we collect
Information you give us
- Your name, work email address and, if you add one, your phone number and profile photo.
- Your password, which is stored only as a one-way hash and is never readable by us.
- The sales information you enter: deals, accounts, contacts, activities, notes, tasks and calendar entries.
- Contacts you choose to import from your phone. This happens only when you tap Import Contacts, and only the contacts you select are copied into the CRM.
Information collected automatically
- A push notification token for your device, used to deliver alerts you have switched on.
- Device and app information: operating system version, app version and device model.
- Usage and diagnostic data, including crash reports, so that we can find and fix faults.
- Your IP address and the time of each sign-in, held as a security record.
What we do not collect
- We do not collect your location. The app does not request location permission.
- We do not read your camera roll, microphone or calendar.
- We do not track you across other companies' apps or websites, and the app contains no advertising or advertising identifiers.
3. Why we hold it
| Purpose | What it covers |
|---|---|
| Running the service | Signing you in, showing your pipeline, saving what you enter and syncing it across your devices |
| Notifications | Sending the deal and task alerts you have chosen to receive |
| Support | Answering your questions and investigating faults you report |
| Security | Detecting unauthorised access and keeping an audit record of who changed what |
| Improvement | Understanding which features are used, so we build the right things |
Our lawful bases are the contract we have with your organisation, our legitimate interest in keeping the platform secure and working, and your consent where you have given it, such as for contacts import and push notifications. You may withdraw either consent at any time in your device settings without losing access to anything else.
4. Who we share it with
We do not sell your personal information, and we do not share it with advertisers or data brokers.
Inside the platform, your information is visible to other members of your own organisation according to the permissions your administrator sets. Each organisation's data is kept separate, so no customer can see another customer's records.
Outside the platform, we rely on a small number of suppliers who process data strictly on our instructions:
| Supplier | What they handle | Do they see CRM content |
|---|---|---|
| Expo | Delivers over-the-air app updates and routes push notifications | No, only a device token |
| Google Firebase | Delivers push notifications to Android devices | No, only a device token and the alert text |
| Apple | Delivers push notifications to iOS devices | No, only a device token and the alert text |
| Our hosting provider | Runs the servers and stores the database and file uploads | Stored, never inspected |
We will also disclose information where the law requires it, or where it is necessary to establish or defend a legal claim. If we are ever compelled to hand over customer data, we will tell the affected organisation unless we are legally prohibited from doing so.
5. Where it is stored and how it is protected
- All traffic between the apps and our servers runs over HTTPS with modern TLS. Nothing is sent in the clear.
- Sign-in tokens are held in the iOS Keychain and the Android Keystore, not in ordinary app storage.
- Passwords are stored only as salted one-way hashes.
- The app supports Face ID, Touch ID, a fingerprint unlock, a PIN lock and two-factor authentication. We recommend turning at least one on.
- Access to production systems is restricted to named staff who need it, and every access is logged.
Data is stored on servers in South Africa. If we ever move it, we will update this page before the move takes effect.
6. How long we keep it
- CRM records are kept for as long as your organisation's account is open, because they belong to your organisation.
- When an organisation closes its account, we delete its data within 30 days, except for records we are required by law to retain.
- When you delete your own account, we remove your personal profile within 30 days. Deals and activities you created stay with your organisation, attributed to your name, because they are your employer's business records.
- Security and audit logs are kept for 12 months.
- Backups are overwritten on a rolling 30-day cycle, so deleted data disappears from backups within that period.
7. Your rights
Under the Protection of Personal Information Act, and under the GDPR where it applies, you may:
- Ask what personal information we hold about you and receive a copy of it.
- Have inaccurate information corrected.
- Have your information deleted, subject to what your employer and the law require us to keep.
- Object to processing, or ask us to restrict it.
- Receive your information in a portable, machine-readable format.
- Complain to the Information Regulator of South Africa, or to your local supervisory authority.
Write to [email protected] and we will respond within 30 days. For CRM records, we will refer you to your organisation's administrator, because that data is theirs.
Deleting your account
To delete your DealFunnel account and the personal information attached to it, email [email protected] from your work address with the subject "Delete my account". We will confirm within 2 working days and complete the deletion within 30 days. Your organisation's administrator can also remove your account from the platform at any time.
8. Children
DealFunnel is a workplace tool for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
9. Changes to this policy
When this policy changes we update the date at the top of the page. Where a change materially affects how we use your information, we will notify you in the app or by email before it takes effect.
10. Contact us
Broadbrand
Email: [email protected]