Data Processing Agreement

1. Roles and scope

For personal data in the lists, files and leads the Customer gives Leedrush (by upload, API, webhook or CRM connection), the Customer is the controller and Leedrush is the processor, within the meaning of Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR. The details of the processing are in Annex 1.

This DPA does not cover data Leedrush processes as a controller — the Customer’s own account and billing data, and the business contacts Leedrush collects for Leads as a Service. These are described in the Privacy Policy.

The Customer confirms that it has a lawful basis for the personal data it gives Leedrush and has given the people concerned the information the law requires.

2. Instructions

Leedrush processes the Customer’s personal data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use and settings of the service (for example uploading a file, choosing an integration or pushing leads to a CRM) are those instructions. Leedrush will tell the Customer if it believes an instruction breaks data protection law, and may refuse to follow it.

If the law requires Leedrush to process the data otherwise, Leedrush will tell the Customer first, unless the law forbids it.

3. Confidentiality

Anyone Leedrush authorises to process the Customer’s personal data is bound by confidentiality. Leedrush does not sell the Customer’s personal data, does not use it for its own purposes and does not add it to its own databases.

4. Security

Leedrush implements the technical and organisational measures in Annex 2 to protect the Customer’s personal data, appropriate to the risk (Article 32 GDPR). Leedrush may improve these measures over time but will not reduce the overall level of protection.

5. Sub-processors

The Customer gives Leedrush general authorisation to use the sub-processors listed in Annex 3. Leedrush will update Annex 3 and tell Customers by email at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that time; if the parties cannot resolve the objection, the Customer may end the affected service and receive a pro-rata refund of any prepaid period it cannot use.

Leedrush imposes data protection obligations on each sub-processor that are no less protective than this DPA, to the extent applicable to the service it provides, and remains responsible to the Customer for their performance.

Services the Customer connects itself (for example its CRM, a webhook or Apollo with its own API key) are not Leedrush’s sub-processors; the Customer’s own agreement with them applies.

6. Assistance

Taking into account the nature of the processing, Leedrush will help the Customer, as far as reasonably possible:

• to answer requests from people exercising their rights (Leedrush forwards any request it receives about the Customer’s data to the Customer and does not answer it itself, unless the Customer asks it to);
• with security, breach notifications, data protection impact assessments and consultations with supervisory authorities (Articles 32 to 36 GDPR).

The Customer can view, export and delete its data in the app at any time.

7. Personal data breaches

Leedrush will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer’s personal data. The notice will describe, as far as then known, the nature of the breach, the data and people concerned, the likely consequences and the measures taken or proposed. Leedrush will give further information as it becomes available.

8. Return and deletion

The Customer can export its data at any time. When the Customer deletes its account, Leedrush erases the Customer’s personal data after a 30-day grace period during which the Customer can cancel the deletion; during the service, data is also deleted on the retention periods in the Privacy Policy. Copies in database backups are deleted as those backups are deleted and are used only to restore the service. Leedrush keeps data only where the law requires it to.

9. Information and audits

Leedrush will make available to the Customer the information reasonably needed to show compliance with this DPA and Article 28 GDPR, by answering written questions within a reasonable time. Where that is not enough, or where a supervisory authority requires it, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, with at least 30 days’ notice, during business hours, at most once a year and at the Customer’s cost.

10. International transfers

Leedrush’s servers and database are in Germany. Where a sub-processor processes the Customer’s personal data outside the EEA (Annex 3), the transfer relies on an adequacy decision of the European Commission where one exists, or otherwise on the European Commission’s Standard Contractual Clauses where the sub-processor offers them. Leedrush limits what it sends: for example, the AI scoring provider never receives names or full email addresses.

11. Liability and order of precedence

Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it. If this DPA conflicts with the Terms on the processing of personal data, this DPA applies. This DPA lasts as long as Leedrush processes personal data on the Customer’s behalf.

Annex 1 — Processing details

Annex 2 — Technical and organisational measures

• Encryption in transit: all traffic to the website, app and API uses HTTPS (TLS).
• Access control: customers see only their own data; passwords are stored as salted PBKDF2 hashes; two-factor sign-in is available; API keys are stored hashed; sign-in attempts are rate-limited and accounts are locked after repeated failures.
• Credentials: credentials of services the Customer connects are stored encrypted (Fernet, AES-128 with HMAC).
• Administrative access: only the operator has access to the production systems, over SSH with key authentication; the database is not reachable from the internet.
• Data minimisation: the AI provider receives no names or full email addresses; error monitoring receives no IP addresses or personal identifiers.
• Availability: daily database backups to separate storage; automatic restart of failed services; monitoring and alerts.
• Retention and deletion: automatic deletion on the retention periods in the Privacy Policy; full erasure 30 days after account deletion.
• Logging: account and administrative actions are logged.

Annex 3 — Sub-processors

Companies’ public websites are read directly by Leedrush’s own servers; no third party is involved.