CRM

What is a CRM?

CRM (customer relationship management) refers to a software system in which a company records its customers and prospects, their contact persons, all sales opportunities and the course of the business relationship in one central place. In a broader sense the term also covers the management of customer relationships as a whole, for which the system is the tool. Put simply, the CRM is the shared memory of sales: what was discussed and agreed with a customer is preserved there, even if the responsible employee changes.

The CRM is the data source for sales management and for a large part of the metrics that investors and buyers examine. These include the sales pipeline with the open sales opportunities, the conversion rates in the sales funnel from first contact to closing, win rates, sales cycles and the origin of new customers. Because it contains personal data of contact persons, it is at the same time subject to the EU General Data Protection Regulation (GDPR; in German Datenschutz-Grundverordnung, DSGVO). When an investment or a sale is pending, it is therefore a subject of commercial, financial and legal review (due diligence).

Functions and integration

The core of a CRM includes the management of companies and contacts and the recording of activities such as conversations, appointments and emails. Added to this are the management of sales opportunities with stage, value and expected closing date, as well as reports and forecasts. Many systems additionally offer functions for marketing automation, customer service and contract management.

A CRM develops its full value only in connection with the other systems. Won contracts should pass into invoicing without being entered again by hand, and cancellations and contract changes from invoicing back into the CRM. Without this link, two sets of data about the same customer arise. Metrics such as annual recurring revenue (ARR) or the cancellation rate (churn rate) then turn out differently depending on the source.

Data quality as an area of review

A CRM is only as meaningful as its data. In due diligence, investors and buyers therefore also examine the data quality itself, usually along the following criteria:

• Completeness: whether mandatory information such as value, stage, source and expected closing date is present for all opportunities.
• Accuracy: whether contract values and terms match the signed contracts and the invoicing.
• Timeliness: whether opportunities without activity are closed and cancellations are recorded promptly.
• Uniqueness: whether companies and contacts are kept without duplicates, so that customers are not counted twice.
• Consistency: whether stages, loss reasons and segments are assigned according to fixed definitions.
• Traceability: whether a change history shows when stages, values and closing dates were changed.

The change history is particularly revealing for investors. It shows whether opportunities were moved to higher stages shortly before quarter-end or closing dates were repeatedly pushed back. A pipeline that looks good only on the reporting date stands out in this way.

Data protection

Names, roles, telephone numbers and email addresses of contact persons are personal data, even if they are used for business purposes. Their processing needs a legal basis under Article 6(1) GDPR. For contact persons of corporate customers this is usually legitimate interests (point (f)), because the contractual partner is not the person themselves but their employer. For sole traders, performance of a contract (point (b)) may come into consideration. For advertising by email, the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG) in Section 7(2) additionally requires, as a rule, prior express consent. It then also forms the basis under data protection law (point (a)). The processing must be included in the record of processing activities under Article 30 GDPR, and the data subjects must be informed under Articles 13 and 14 GDPR.

If the CRM is operated as a cloud service, a data processing agreement under Article 28 GDPR must be concluded with the provider. If data is transferred to countries outside the EU and the EEA, a basis under Articles 44 et seq. GDPR is needed, such as an adequacy decision or standard contractual clauses. In addition come a deletion concept that takes commercial and tax retention obligations into account, a roles and permissions concept and procedures with which rights of access, erasure and objection are met within the deadlines.

Which legal basis and which storage period apply to a specific data field and a specific purpose has to be determined in the individual case. This allocation is a task of the data protection review in the company, in which an appointed data protection officer is to be involved.

Significance for the data room and due diligence

In due diligence, the CRM export is among the central documents of the commercial review. Pipeline analyses, cohorts, win rates and sales cycles are calculated from it. The financial review reconciles the customer list and contract values with invoicing and accounts receivable accounting. Every metric in the data room must be traceable to this source; deviations between CRM, accounting and presentation are queried and cost time and trust.

Personal data belongs in the data room only to the extent that the review requires it. Anonymised or aggregated analyses are common in early phases and restricted disclosure in later ones. If the acquirer is a competitor, competitively sensitive customer data is often made accessible only to a shielded circle of advisers (clean team). If the buyer acquires the shares (share deal), the data stock remains with the company. If it buys individual assets (asset deal), the transfer of customer data to the acquirer is a separate processing operation that needs a legal basis.

Worked example

A software provider reports annual recurring revenue of EUR 3.10 million in the data room, calculated from the contracts marked as active in the CRM. The investor's financial review recalculates the ARR from invoicing. Because all customers pay monthly, the recurring invoices of the last month × 12 give the comparison figure: EUR 2.86 million. The difference of EUR 240,000 is clarified:

• Cancelled contracts still carried as active in the CRM: EUR 130,000
• Discounts granted, recorded in the CRM at list price: EUR 70,000
• Signed contracts with a later start of service, not yet invoiced: EUR 40,000
• Sum of the deviations: EUR 130,000 plus EUR 70,000 plus EUR 40,000 = EUR 240,000
• Adjusted ARR from the CRM: EUR 3.10 million minus EUR 130,000 minus EUR 70,000 = EUR 2.90 million
• Cross-check from invoicing: EUR 2.86 million plus EUR 40,000 = EUR 2.90 million

The reported figure was EUR 200,000 or about 6.9% above the adjusted one. If the company is valued at six times ARR, the deviation corresponds to EUR 1.2 million of company value. In addition, the cancellation rate rises, because the cancelled contracts have to be recorded retrospectively.

The adjusted figure includes the EUR 40,000 from signed contracts that have not yet started. Such contracts are often not counted towards ARR but shown separately as contracted revenue; the ARR is then EUR 2.86 million. What matters is that the chosen definition is disclosed and applies uniformly throughout the data room.

Distinction from related terms

• ERP system: manages orders, invoicing, purchasing and accounting. The CRM covers the path to the contract and the maintenance of the customer relationship; revenue is determined in the ERP and in accounting.
• Marketing automation: manages campaigns, forms and email dispatch to prospects. It delivers leads to the CRM but does not replace it.
• Sales pipeline: a report from the CRM, namely the stock of open sales opportunities on a reporting date.
• Accounts receivable accounting: keeps receivables and incoming payments per customer. It is the accounting cross-check on the contract data in the CRM.

Common mistakes

• Too many mandatory fields. Fields that nobody fills in carefully in everyday sales produce dummy data that distort reports.
• Parallel spreadsheets. If people work in spreadsheets alongside the CRM, two sets of data arise, and in due diligence it is unclear which one applies.
• Cancellations not fed back. If the link to invoicing is missing, cancelled contracts stay active in the CRM and inflate ARR and customer numbers.
• Loss reasons not recorded. Without them, recurring causes of lost opportunities, such as price, missing features or wrong contact persons, cannot be identified.
• Data protection arranged afterwards. The data processing agreement, the entry in the record of processing activities and the deletion concept belong before the first data capture, not in the preparation of due diligence.
• Access rights too broad. If all users have access to all data and exports, the risk rises that customer data leaves with sales staff when they depart.

Frequently asked questions

When does a company need a CRM?

At the latest when more than one person sells or when the open sales opportunities can no longer be kept in view in a single, carefully maintained list. Before a financing round, the CRM should have been in use long enough for rates to be analysed over several quarters.

Which CRM system is the right one?

The one that is actually used in sales. A simple system with well-maintained data is more valuable for management and due diligence than an extensive one with gaps. A change history, export functions and a connection to invoicing are important.

Is a data processing agreement needed with the CRM provider?

Yes, as a rule. If the provider processes personal data on behalf of the company, Article 28 GDPR prescribes a contract with defined minimum content. If the provider is based outside the EU or subcontractors access from there, the review of transfers to third countries is added.

Is CRM data protected when sales staff leave?

Only if the company has made provision. Customer lists and contract data can be protected as a trade secret under the German Trade Secrets Act (Gesetz zum Schutz von Geschäftsgeheimnissen, GeschGehG), but only if appropriate confidentiality measures have been taken, such as access restrictions and confidentiality agreements. Buyers ask about these measures in due diligence, because the customer base is among the essential values of the company.

What reports from the CRM do investors expect?

Above all the pipeline by stage and value, with positions at several reporting dates, as well as win rates and sales cycles by channel and segment. Added to this are loss reasons and a customer list with contract values that can be reconciled with invoicing.

The Roemer Capital view

In engagements as a fractional CFO (a finance function for a limited period) and in the preparation of transactions, Roemer Capital reconciles the sales metrics from the CRM with invoicing and accounting. This happens before they appear in the financial model, pitch deck or data room. Every figure an investor sees should be traceable down to the individual contract.

Because a data room is meant to be ready to provide within 24 hours, Roemer Capital defines the standard exports from the CRM early: customer list with contract values, pipeline positions at several reporting dates, loss reasons and rates by channel. The data protection design of these exports is clarified by the company with its law firm; Roemer Capital makes sure that the figures in them are free of contradictions.