Sub-processors
Version 1.0 | 17 August 2026
This page is Annex III to the Data Processing Agreement. It lists the third parties that process personal data on behalf of our customers, and the parties we use for our own website and operations.
Sub-processors under the Data Processing Agreement
The parties below process personal data on behalf of our customers, under Article 7 of the Data Processing Agreement. Each of them is bound by contractual data protection obligations equivalent to the ones we accept towards our customers, and LeadTrackr remains fully liable for their performance.
| Party | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, content delivery, serverless execution and scheduled jobs | All categories listed in Annex I, in transit and during processing | European Union — functions execute in Paris (cdg1), Frankfurt (fra1) and Stockholm (arn1); static content is delivered from a global edge network | Standard Contractual Clauses and EU–US Data Privacy Framework, covering support access from the United States |
| Neon Inc., provisioned through the Vercel Marketplace | Managed PostgreSQL database in which lead and account data is stored | All categories listed in Annex I | European Economic Area (data at rest) | Standard Contractual Clauses and EU–US Data Privacy Framework, covering support access from the United States |
| Sinch Email, operating as Mailjet | Transactional email: account verification, lead notifications, reminders and service messages | Name and email address of Client users; lead name and status where included in a notification | European Union | Not applicable — processing takes place within the EEA |
Advertising platforms and other services you connect
When you activate an integration, LeadTrackr transmits data to that service on your instruction. Those services are not sub-processors of LeadTrackr — we have no relationship with them in respect of your data, and we do not determine what they do with it.
What we cannot do is tell you what role each of them plays under the GDPR, because that follows from your agreement with that service rather than from ours. The two common patterns:
- Advertising platforms — Google Ads, Meta, Microsoft Advertising, LinkedIn — generally act as a controller or joint controller for their own advertising purposes, on terms you accept when you open an advertising account. Note that Google offers processor terms for some services and controller terms for others, so the answer can differ per product and per configuration.
- CRMs and business applications — Pipedrive, HubSpot, Salesforce, Teamleader, Odoo, Zoho, Microsoft Dynamics — generally act as your processor, under a data processing agreement you conclude directly with them. In that case the data stays within your own controllership and you, not LeadTrackr, hold the Article 28 relationship with that provider.
Establishing which role applies to the services you connect, and having the arrangements that role requires in place, is your responsibility as the controller.
No data is transmitted to any of these services until you connect and enable it yourself. You are responsible for the legal basis for that transmission, as set out in Article 4.2 of the Data Processing Agreement. Where we transmit email addresses or telephone numbers to an advertising platform, we hash them with SHA-256 first, so the platform does not receive the plain values.
Processors for our own website, billing and operations
For the leadtrackr.io website, our billing and our own administration we act as a controller rather than a processor. The parties below process personal data in that context — the contact and billing details of the people who hold an account with us, and the visitors to our website. They have no access to the lead data our customers process through the platform, which is why they are not listed as sub-processors above.
| Party | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Stripe Payments Europe Ltd. | Subscription billing, payment processing and invoicing | Name, email address, company name and billing details of the account holder | Ireland, with support from Stripe Inc. in the United States | Standard Contractual Clauses and EU–US Data Privacy Framework, covering support access from the United States |
| FirstPromoter | Attribution of referrals within the LeadTrackr affiliate programme | Referral identifier, IP address, device data of visitors to leadtrackr.io | European Union | Not applicable — processing takes place within the EEA |
| YesWeTrack B.V. | Server-side tag management and appointment scheduling for the leadtrackr.io website | IP address, device data, page and campaign data of visitors; contact details submitted when booking a demo | European Union | Not applicable — processing takes place within the EEA |
Advertising and analytics partners for our own marketing
We advertise on Google Ads and Meta and use Google Analytics 4 for our own website. The parties below receive data about visitors to leadtrackr.io and about signups, so we can measure and optimise our own campaigns. They are not processors and not sub-processors: Google acts as an independent controller for its own advertising purposes, and for the Meta pixel and Conversions API we and Meta are joint controllers within the meaning of Article 26 GDPR.
This concerns our own marketing only. These parties receive no lead data that our customers process through the platform. The processing is based on consent and is described in full in our Privacy Policy.
| Party | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Google Ireland Ltd. | Google Ads campaign measurement and remarketing, and Google Analytics 4 for our own website | Online identifiers, IP address, device data, pages viewed, campaign parameters, and hashed email address and telephone number on signup | European Union and United States | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Meta Platforms Ireland Ltd. | Meta pixel and Conversions API for measurement and remarketing of our own ads | Online identifiers, IP address, device data, pages viewed, and hashed email address and telephone number on signup | European Union and United States | EU–US Data Privacy Framework and Standard Contractual Clauses |
Changes to this list
We announce the addition or replacement of a sub-processor at least 30 days in advance, by email to the address registered with your account. You can object within 14 days on reasonable grounds relating to data protection, in accordance with Article 7.3 of the Data Processing Agreement.
Questions about this list can be sent to support@leadtrackr.io.