Data and Security

Working with GTMOne may involve access to CRM records, operating documentation, workflow information, and other business data. We define what information is needed, how it will be used, and who can access it before an engagement begins.

Access Defined by the Engagement

We request access relevant to the agreed assessment or monitoring scope. Depending on the engagement, this may include CRM records, lifecycle definitions, ownership information, timestamps, workflow configurations, reports, and stakeholder input.

We do not require unrestricted access by default. Where practical, work takes place within the client’s environment using named accounts and permissions appropriate to the task.

Read-only Assessments

Assessment access is read-only by default. GTMOne investigates operating conditions and prepares findings without changing CRM records, configurations, or automation.

Implementation or other system changes require separate authorization and an agreed scope. Submitting a website enquiry does not authorize access to your systems.

Minimum Necessary Data

We limit the information collected to what is relevant to the agreed work. When exports are necessary, we aim to limit the fields, records, and time periods included.

Where analysis does not require personal identifiers, we remove or mask them where practical. Information that can still be linked to a person remains subject to appropriate protection.

Storage and Access Controls

Our operating requirements include approved business storage, restricted access, protected devices, secure transfer methods, and multifactor authentication where available.

Access is limited to people who need the information for the agreed purpose. Additional collaborators and service providers are subject to appropriate confidentiality, access, and contractual requirements.

Please do not send passwords, access tokens, or customer exports through the website enquiry form. Access and file-transfer arrangements are established separately.

AI and Client Information

We do not put identifiable client CRM data or confidential client material into general-purpose AI tools by default.

Any use of AI involving such material requires prior written client authorization and review of the provider, purpose, data scope, retention, and training settings. We do not use client information to train general-purpose AI models.

Providers and Processing Locations

GTMOne operates from India. Depending on the providers used, information may also be processed in other countries. We do not promise India-only storage.

Providers handling client data, relevant processing locations, and any client-specific restrictions are documented as part of the engagement arrangements before access begins. Applicable cross-border requirements are assessed where relevant.

Retention and Access Removal

Return and deletion arrangements are agreed in writing. Our default is to return or delete active working copies within 30 days after the engagement ends, unless an earlier action is requested or a different lawful period is agreed.

Access is revoked when no longer needed. Backup expiry and legally required retention exceptions are documented separately. Deletion from active storage does not necessarily mean immediate deletion from backups.

Limited business records may be retained for legal, accounting, or dispute-resolution needs. This does not justify retaining entire CRM exports.

Security Incidents

Suspected incidents are investigated and addressed through containment, assessment, and appropriate follow-up. Affected clients, individuals, or authorities are notified as required by applicable law and contractual commitments.

No system can be guaranteed completely secure. GTMOne does not claim security certifications unless they are expressly identified and verifiable.

Written Data-handling Terms

Before receiving client data or system access, the engagement documentation defines the permitted purpose, scope, access, responsibilities, and relevant data-handling arrangements. Confidentiality and data-processing terms are established as appropriate to the engagement.

This page summarizes our approach. It does not replace a signed service agreement or grant permission to access or process client information.

Questions About Your Data

To discuss access requirements, provider arrangements, retention, or a data-security concern, contact hello@withgtmone.com.

For information about website enquiries and personal-information requests, read our Privacy Policy.