Data Processing Agreement

Parties

• Controller: the legal entity or natural person acting in the course of business that has entered into an agreement with LeadTrackr for the use of the LeadTrackr platform (hereinafter: "Client").
• Processor: LeadTrackr B.V., located at Jan van Goyenplein 65, 2231 MM Rijnsburg, the Netherlands, registered with the Dutch Chamber of Commerce under registration number 42066573 (hereinafter: "LeadTrackr").

Whereas

• The parties have entered into an agreement under which LeadTrackr provides the LeadTrackr platform to Client (hereinafter: the "Main Agreement"), to which the General Terms and Conditions apply.
• In performing the Main Agreement, LeadTrackr processes personal data on behalf of Client within the meaning of Article 4(2) and Article 28 of the General Data Protection Regulation ("GDPR").
• Article 28(3) GDPR requires the parties to record their arrangements regarding that processing in a data processing agreement, hereinafter: this "Agreement".
• This Agreement is an integral part of the Main Agreement and is concluded at the same moment as the Main Agreement. Where Client acts as a processor towards its own customers, this Agreement serves as a sub-processing agreement and LeadTrackr acts as a sub-processor.
• The provisions of this Agreement take precedence over all other arrangements between the parties with respect to the processing of personal data, insofar as they differ from what is laid down here, except for written deviations expressly agreed between the parties in accordance with Article 2.4 of the General Terms and Conditions.

Article 1. Definitions

• 1.1. Terms defined in the General Terms and Conditions have the same meaning in this Agreement.
• 1.2. The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning assigned to them in Article 4 GDPR.
• 1.3. Sub-processor: a third party engaged by LeadTrackr that processes personal data on behalf of Client under this Agreement.
• 1.4. Third-Party Platform: an advertising platform, analytics service, CRM or other third-party service that Client connects to the LeadTrackr platform, as defined in the General Terms and Conditions.

Article 2. Subject and Duration

• 2.1. The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex I to this Agreement.
• 2.2. This Agreement takes effect on the commencement date of the Main Agreement and remains in force for as long as LeadTrackr processes personal data on behalf of Client. It ends once LeadTrackr has returned or deleted all personal data in accordance with Article 12.
• 2.3. This Agreement cannot be terminated separately from the Main Agreement.
• 2.4. The obligations of Articles 5, 12 and 13 remain in force after termination of this Agreement.

Article 3. Instructions and Roles

• 3.1. Client is the controller and determines the purposes and means of the processing. LeadTrackr is the processor and has no independent authority over the purpose and means of the processing of personal data under this Agreement.
• 3.2. LeadTrackr processes personal data solely on the documented instructions of Client. The Main Agreement, this Agreement, the configuration Client applies within the platform and the integrations Client activates together constitute Client's documented instructions.
• 3.3. LeadTrackr will not process the personal data for its own purposes, will not enrich it with data from other sources for its own benefit, and will not sell or otherwise make it available to third parties, except as provided for in this Agreement or where required by law.
• 3.4. If LeadTrackr is required by Union or Member State law to process personal data beyond Client's instructions, LeadTrackr will inform Client of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
• 3.5. If, in LeadTrackr's opinion, an instruction from Client infringes the GDPR or other data protection provisions, LeadTrackr will inform Client without delay and may suspend the execution of that instruction until Client confirms or amends it.
• 3.6. LeadTrackr may generate aggregated and anonymised statistics derived from the processing, provided these can no longer be related to a data subject or to Client, in accordance with Article 12.5 of the General Terms and Conditions.

Article 4. Obligations and Warranties of Client

• 4.1. Client warrants that the personal data it has LeadTrackr process is collected and provided lawfully, that a valid legal basis under Article 6 GDPR exists, and that the information obligations of Articles 13 and 14 GDPR have been met towards the data subjects.
• 4.2. Client warrants that it has a valid legal basis for forwarding personal data to each Third-Party Platform it activates, and that this forwarding complies with the terms and policies of that Third-Party Platform.
• 4.3. Client shall not submit special categories of personal data within the meaning of Article 9 GDPR, personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR, government identification numbers or payment card data to the platform. The platform is not designed for such data and the technical and organisational measures described in Annex II have not been calibrated for it.
• 4.4. Client is responsible for the correct configuration of the platform, including which data fields are captured, which integrations are activated, and which retention period is applied to its data.
• 4.5. Client indemnifies LeadTrackr against all claims by data subjects and third parties, and against all fines and sanctions imposed on LeadTrackr by a supervisory authority, resulting from a breach of this article by Client or by third parties acting under its responsibility.

Article 5. Confidentiality

• 5.1. Personal data processed by LeadTrackr under this Agreement is always considered Confidential Information. The confidentiality provisions of Article 14 of the General Terms and Conditions apply accordingly.
• 5.2. LeadTrackr ensures that persons authorised to process the personal data are bound by an obligation of confidentiality, whether by contract or by statute, and that this obligation continues after the end of their engagement.
• 5.3. LeadTrackr grants access to the personal data only to those persons for whom access is necessary for the performance of the Main Agreement.

Article 6. Security

• 6.1. LeadTrackr implements appropriate technical and organisational measures as referred to in Article 32 GDPR to ensure a level of security appropriate to the risk. The measures in place at the date of this Agreement are described in Annex II.
• 6.2. The measures take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the likelihood and severity of the risks to the rights and freedoms of natural persons.
• 6.3. LeadTrackr may amend the measures described in Annex II, provided the level of security is not reduced. LeadTrackr will publish the current version of Annex II on this page.
• 6.4. Client has assessed the measures described in Annex II and considers them appropriate for the personal data it has LeadTrackr process. If Client requires a higher level of security than described, the parties will consult on the implementation and the reasonable costs thereof.

Article 7. Sub-processors

• 7.1. Client grants LeadTrackr general written authorisation to engage Sub-processors for the processing of personal data under this Agreement. The current Sub-processors are listed in Annex III and, in their most recent form, at leadtrackr.io/sub-processors.
• 7.2. LeadTrackr will inform Client of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to the address registered with the Account.
• 7.3. Client may object to an intended change in writing within 14 days of the notification, on reasonable grounds relating to data protection. The parties will then consult in order to reach a solution. If no solution is reached and LeadTrackr proceeds with the engagement, Client may terminate the Main Agreement in writing with effect from the date the Sub-processor is actually engaged, without becoming liable for damages and against a pro rata refund of any fees paid in advance for the remaining part of the subscription period.
• 7.4. LeadTrackr will impose on each Sub-processor, by way of contract, data protection obligations that are equivalent to those set out in this Agreement.
• 7.5. LeadTrackr remains fully liable towards Client for the performance of the obligations of its Sub-processors, as if it had performed them itself.
• 7.6. A Third-Party Platform to which Client instructs LeadTrackr to forward personal data is not a Sub-processor of LeadTrackr. LeadTrackr transmits the data on Client's instruction and has no relationship with that platform in respect of Client's data. The role of that platform under data protection law — processor, joint controller or independent controller — follows from the agreement between Client and that platform. Where the platform acts as Client's processor, Client is responsible for concluding the required agreement under Article 28 GDPR directly with that platform. Article 4.2 applies to the forwarding in all cases.

Article 8. Transfer of Personal Data

• 8.1. Personal data processed under this Agreement is stored in a database located within the European Economic Area ("EEA"). LeadTrackr configures the hosting platform so that the application operations processing that data run in European regions, and will notify Client before making a change that moves those operations outside the EEA.
• 8.2. A number of the Sub-processors listed in Annex III are incorporated outside the EEA, principally in the United States, and may access personal data from there for support and operational purposes. For those transfers LeadTrackr ensures that an appropriate mechanism under Chapter V GDPR applies, being the European Commission's Standard Contractual Clauses, an adequacy decision, or another mechanism permitted under the GDPR. The applicable mechanism per Sub-processor is stated in Annex III.
• 8.3. Where Client instructs LeadTrackr to forward personal data to a Third-Party Platform established outside the EEA, that transfer takes place under Client's own responsibility and on the basis of the agreement between Client and that Third-Party Platform.
• 8.4. At Client's request, LeadTrackr will inform Client within a reasonable period about the countries in which personal data is processed.

Article 9. Personal Data Breaches

• 9.1. Client is responsible for reporting a personal data breach to the competent supervisory authority and, where required, to the data subjects concerned.
• 9.2. LeadTrackr will notify Client of a personal data breach affecting personal data processed under this Agreement without undue delay after becoming aware of it, by email to the address registered with the Account. LeadTrackr will do so in time to allow Client to meet its own notification obligation under Article 33(1) GDPR, insofar as that is within LeadTrackr's control.
• 9.3. The notification shall contain at least the information referred to in Article 33(3) GDPR, to the extent known to LeadTrackr: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information cannot be provided at once, LeadTrackr will provide it in phases without further undue delay.
• 9.4. LeadTrackr will take all reasonable measures to limit the consequences of the breach and to prevent recurrence, and will document all breaches together with the facts, effects and remedial action taken.
• 9.5. LeadTrackr will provide Client with the cooperation reasonably necessary to enable Client to comply with its obligations under Articles 33 and 34 GDPR. LeadTrackr will not notify a supervisory authority or data subjects on Client's behalf unless Client instructs it to do so in writing.

Article 10. Rights of Data Subjects

• 10.1. The platform provides Client with functionality to access, rectify, export and delete the personal data it has LeadTrackr process, so that Client can handle requests from data subjects itself.
• 10.2. Taking into account the nature of the processing, LeadTrackr will assist Client with appropriate technical and organisational measures, insofar as possible, in fulfilling Client's obligation to respond to requests under Articles 15 to 22 GDPR. Where such assistance goes beyond the functionality referred to in paragraph 1, LeadTrackr may charge the reasonable costs involved.
• 10.3. If a data subject addresses a request directly to LeadTrackr, LeadTrackr will forward it to Client without undue delay and will not respond to the request itself, other than to inform the data subject that the request has been forwarded.

Article 11. Assistance, Impact Assessments and Audits

• 11.1. LeadTrackr will assist Client, taking into account the nature of the processing and the information available to it, in complying with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority. LeadTrackr may charge the reasonable costs of such assistance.
• 11.2. LeadTrackr makes available to Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by Client or an auditor mandated by Client.
• 11.3. An audit takes place only after Client has requested and reviewed any documentation, reports and certifications available from LeadTrackr, and those do not provide sufficient clarity on compliance with this Agreement.
• 11.4. An audit is announced at least 2 weeks in advance, takes place during regular business hours, is conducted in a way that minimises disruption to LeadTrackr's operations, and is carried out by Client or by an independent auditor mandated by Client, in either case bound by confidentiality. Client may conduct an audit no more than once per calendar year, unless there is a specific and demonstrable indication of non-compliance, or an audit is required by a supervisory authority.
• 11.5. The costs of the audit, including the reasonable costs incurred by LeadTrackr for its cooperation, are borne by Client, unless the audit reveals a material failure by LeadTrackr to comply with this Agreement, in which case LeadTrackr bears its own costs and remedies the findings at its own expense.
• 11.6. The findings of the audit will be discussed by the parties and implemented in mutual consultation.

Article 12. Return and Deletion

• 12.1. Client can export the personal data processed under this Agreement from the platform at any time during the term of the Main Agreement, and for 30 days after its termination in accordance with Article 17.6 of the General Terms and Conditions.
• 12.2. After that period, LeadTrackr will delete all personal data processed on behalf of Client from its active systems within 30 days, unless Union or Member State law requires further storage.
• 12.3. Instead of deletion, Client may request in writing that the personal data be returned to Client or to a third party designated by Client. LeadTrackr will provide the data in a structured, commonly used and machine-readable format within 30 days of the request. This right applies regardless of the reason for which the Main Agreement ended, and regardless of whether Client still has access to the platform under Article 17.6 of the General Terms and Conditions. The request must be made within 60 days of the end of the Main Agreement.
• 12.4. Personal data present in backups is deleted in accordance with the regular backup rotation, within a maximum of 90 days after deletion from the active systems. Until deletion, that data remains subject to the security measures of Annex II and is not used for any purpose other than restoring the platform.
• 12.5. Client may delete individual leads or apply a shorter retention period within the platform at any time.
• 12.6. At Client's request, LeadTrackr will confirm the deletion in writing.

Article 13. Liability

• 13.1. The liability provisions of Article 15 of the General Terms and Conditions apply to this Agreement.
• 13.2. The limitation of liability does not affect the liability of either party towards data subjects and supervisory authorities under Articles 82 and 83 GDPR.
• 13.3. Each party is responsible for damage resulting from its own breach of applicable data protection law and indemnifies the other party against third-party claims and costs resulting from such a breach. LeadTrackr's obligation under this paragraph is subject to the limitation of Article 13.1; Client's obligation under this paragraph is not.

Article 14. Final Provisions

• 14.1. LeadTrackr may amend this Agreement in accordance with the procedure of Article 19 of the General Terms and Conditions. Amendments to Annex II and Annex III may be made in accordance with Articles 6.3 and 7.2 respectively.
• 14.2. If any provision of this Agreement is null or voidable, this does not affect the other provisions. The provision concerned will be replaced by a provision that most closely reflects the intention of the parties and the requirements of Article 28 GDPR.
• 14.3. This Agreement is governed by Dutch law. Any disputes will be submitted to the competent court in The Hague, the Netherlands.

Annex I — Details of the Processing

Subject matter and nature of the processing

The collection, storage, structuring, enrichment with attribution data, consultation and onward transmission of data relating to Client's (prospective) customers, for the purpose of measuring which advertising interactions lead to qualified leads and revenue, and of returning that outcome to the advertising platforms Client has selected.

Purposes of the processing

• capturing leads submitted through Client's forms, calls and other channels;
• linking those leads to the advertising click or session that preceded them, on the basis of attribution identifiers;
• enabling Client to qualify leads and record their status and commercial value;
• transmitting the qualified outcome to the Third-Party Platforms activated by Client, as offline or server-side conversions;
• providing Client with dashboards, reports, exports and notifications about its own leads;
• providing support to Client at its request.

Categories of data subjects

• (prospective) customers of Client who submit a form, place a call, or otherwise interact with Client's websites, campaigns or landing pages;
• where Client is a Reseller: the (prospective) customers of Client's own customers.

The personal data of Client's own employees and representatives who use the platform is not processed under this Agreement. LeadTrackr acts as a controller for that data, as set out in Article 13.4 of the General Terms and Conditions and in the Privacy Policy.

Categories of personal data

• Identifying data: first name, last name, company name;
• Contact details: email address, telephone number;
• Content submitted by the data subject: form name and the content of form fields, including any free-text message;
• Attribution data: advertising click identifiers such as GCLID, GBRAID, WBRAID, FBCLID, MSCLKID and LinkedIn identifiers, campaign and source parameters, referrer, landing page and the sequence of channels preceding the lead;
• Device and technical data: IP address, user agent, device characteristics, timestamps;
• Commercial data: lead status, qualification, deal value, notes entered by Client, and the event history of the lead;
• Derived data: SHA-256 hashes of email address and telephone number, generated for transmission to advertising platforms.

Duration of the processing

For the duration of the Main Agreement, plus the export and deletion periods set out in Article 12. Within that period, Client determines the retention period of its own data and can delete leads at any time.

Frequency of the transfer

Continuous, on the basis of the events generated by Client's own channels.

Annex II — Technical and Organisational Measures

LeadTrackr applies at least the following measures. LeadTrackr may amend this Annex in accordance with Article 6.3, provided the level of security is not reduced.

Access control and authentication

• access to the platform requires an authenticated account; access to Client's data is restricted to the members explicitly linked to Client's project;
• data is logically segregated per project, and every read and write operation is scoped to the project of the authenticated user;
• access by LeadTrackr personnel to production systems is granted on a need-to-know basis, is limited to the persons for whom it is necessary, and is withdrawn when it is no longer required;
• personnel and engaged third parties are bound by a written obligation of confidentiality.

Encryption

• traffic to and from the platform is encrypted in transit using TLS;
• credentials and access tokens for Third-Party Platforms are encrypted at rest using AES-256-GCM with authenticated encryption;
• email addresses and telephone numbers are hashed with SHA-256 before transmission to advertising platforms, so that those platforms do not receive the plain values;
• the database is encrypted at rest by the hosting provider.
• the measures of the hosting, database and email providers are those the relevant provider publishes for the service tier LeadTrackr uses; LeadTrackr does not warrant measures beyond those.

Storage and hosting

• the database in which personal data is stored is hosted within the European Economic Area;
• the application runs on a managed hosting platform whose function regions are configured to European locations; the regions in use and the applicable transfer mechanisms are stated in Annex III;
• access to the underlying infrastructure is restricted to authenticated administrator accounts.

Logging and monitoring

• every status change and every transmission to a Third-Party Platform is recorded per lead in an event history, including the result and any error message;
• processing jobs and integration jobs are logged, so that failed transmissions can be identified and retried;
• the event history is available to Client within the platform.

Continuity

• the database is backed up regularly by the hosting provider;
• backups are subject to the same access restrictions and encryption as the production environment;
• backups are rotated in accordance with Article 12.4.

Development and change management

• changes to the platform are made through version-controlled source code;
• production credentials are stored as protected environment variables and are not included in the source code;
• it is LeadTrackr's policy not to use production personal data in test and development environments; where production data is exceptionally required to reproduce a defect, access is limited to the personnel handling the defect and the data is removed once the defect is resolved.

Annex III — Sub-processors

The current list of Sub-processors, including their role, the categories of personal data involved, their processing location and the applicable transfer mechanism, is published and kept up to date at leadtrackr.io/sub-processors. That page forms part of this Agreement. Changes are notified in accordance with Article 7.2.