Manchester-based UK CRM (Zestia Ltd) with a free tier, public DPA, and AWS hosting; post-Brexit jurisdiction.
- FROM
- —
- CLOUD ACT
- MATERIAL
Zusammenfassung aus Eigentümerschaft und CLOUD-Act-Risiko.
Long-running Norwegian Nordic-enterprise CRM (SuperOffice AS, Oslo) with EU/EEA hosting and on-premise edition; Axcel-owned with Carlyle backing.
SuperOffice aus der Kategorie CRM bietet EU-Hosting mit Norway als Hosting-Standort, doch ein US-Mutterkonzern oder Unterauftragsverarbeiter hinterlässt ein materielles CLOUD-Act-Risiko.
Long-running Norwegian Nordic-enterprise CRM (SuperOffice AS, Oslo) with subsidiaries across NO/SE/DK/DE/NL/CH/LT and customer data hosted 'in Europe', but the privacy statement still references the invalidated Privacy Shield framework (last updated May 2023), the underlying hosting provider is not publicly named, and the 2025 continuation-fund round was led by Carlyle AlpInvest with US Carlyle as ultimate parent. Together these produce material CLOUD Act exposure: US-PE ownership at the fund layer, an unnamed hosting provider, and an outdated transfer-mechanism reference are the three verified gaps.
Wie stark Kundendaten US-Behörden nach dem CLOUD Act (Clarifying Lawful Overseas Use of Data Act) ausgesetzt sind.
Wo die letztliche Kontrolle über das Betreiberunternehmen liegt.
SuperOffice is one of the longest-running European CRM vendors, founded in 1989 in Oslo and operated by SuperOffice AS (Wergelandsveien 27, 0167 Oslo, Norway) with subsidiaries in Sweden, Denmark, Germany, the Netherlands, Switzerland, and Lithuania. The product targets Nordic enterprise B2B with three modules: Sales (deal management and forecasting), Marketing (campaign management and lead generation), Service (customer support), plus AI-assisted summaries and content generation, and 1,000+ integrations including Microsoft Dynamics, SharePoint, Slack, Trello, and Zapier. The company emphasises 30+ years of European CRM expertise.
Ownership is layered: in April 2020 Norwegian SuperOffice AS was acquired by Axcel, the Danish private-equity firm; on 3 June 2025 Axcel secured a €266M continuation fund led by Carlyle AlpInvest, with US-headquartered Carlyle as the ultimate parent of the AlpInvest sub-fund. So while the operating entity sits firmly in Norway/EEA and earlier ownership was fully Nordic, the continuation-fund layer adds meaningful US-PE exposure that procurement-grade buyers should understand. CEO as of 2026 is Bjørn Røsten.
Compliance disclosures are partial. The privacy statement (last updated 1 May 2023) names Google Analytics, Facebook, and LinkedIn as marketing-site sub-processors and references a "directory of approved sub-processors" inside the DPA in the Trust Center, not directly resolvable as a public URL at audit. The same statement still cites the EU-U.S. Privacy Shield Framework as an alternative legal basis, which has been invalidated since Schrems II (July 2020) and replaced by the Data Privacy Framework; outdated wording is a transparency red flag. The hosting provider for customer CRM data is described only as "Europe" without a specific provider, region, or city. Per the directory's strict CLOUD Act stance these gaps produce material exposure pending vendor confirmation of the underlying cloud provider and a refreshed transfer-mechanism reference.
Pricing in EUR is enterprise-grade: Sales Essentials starts at €71/user/month with annual billing (monthly, quarterly, semi-annual, and annual cycles available); higher Sales / Service / Marketing tiers above; an interactive demo replaces a self-serve free trial. Best fit: Nordic and DACH mid-market and enterprise B2B teams that want a long-running European CRM with deep Microsoft-stack integration. Procurement-led EU-only buyers should request the Trust Center sub-processors list, the AVV/DPA, and a written commitment on the underlying cloud region before signing.
Product analytics and usage statistics (processed in Frankfurt)
Email service provider for campaigns and ticket replies (processed in Frankfurt)
Azure document storage; SuperOffice AI language analytics (processed in NL and IE)
In-product user onboarding and activation
App Store applications (Bookmycalendar, Contract Manager, Activity Board, Map4You Pro)
Calendar synchronization with Microsoft 365 / Google Workspace
Hosting and operations of all servers/infrastructure; database storage (Norway)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amplitude Inc. | United States | Product analytics and usage statistics (processed in Frankfurt) | US |
| Mailgun Technologies Inc. | United States | Email service provider for campaigns and ticket replies (processed in Frankfurt) | US |
| Microsoft Corporation | United States | Azure document storage; SuperOffice AI language analytics (processed in NL and IE) | US |
| Userflow Inc. | United States | In-product user onboarding and activation | US |
| i-Centrum AB | Sweden | App Store applications (Bookmycalendar, Contract Manager, Activity Board, Map4You Pro) | EU |
| InfoBridge B.V. | Netherlands | Calendar synchronization with Microsoft 365 / Google Workspace | EU |
| Visma IT & Communications AS | Norway | Hosting and operations of all servers/infrastructure; database storage (Norway) | EU |
Manchester-based UK CRM (Zestia Ltd) with a free tier, public DPA, and AWS hosting; post-Brexit jurisdiction.
Cologne-based German SMB CRM (42he GmbH), all-German hosting on Hetzner + Core-Backbone + Telekom, free tier for 3 users.
Konstanz-based German CRM (combit Software, since 1989), founder-owned, on-prem + cloud, German Mittelstand vendor.