Data Processing Addendum
When you use Leads Ranger, you decide what happens to the contact data in your workspace and we act on your instructions. This addendum is the contract that says so, in the form your legal, privacy or procurement team expects to see. It is already in force: accepting our Terms accepts this.
The short version
- You are the Controller of your workspace data. We are your Processor and act only on your instructions.
- We never sell that data, pool it, or use it to train AI models.
- Sub-processors are published, notified 30 days in advance, and you can object.
- We notify you of a personal data breach within 72 hours of becoming aware of it.
- Standard Contractual Clauses and the UK Addendum are incorporated for international transfers.
This summary is for convenience only. The numbered sections below are the binding text.
01Scope and how this fits together
This Data Processing Addendum ("DPA") forms part of the Terms & Conditions between you ("Customer") and Leads Ranger ("Processor", "we", "us"). It applies whenever we process Personal Data on your behalf in providing the Service.
It is accepted automatically when you accept the Terms, so there is nothing to sign for it to be in force. If your procurement process needs a countersigned copy on your own paper, write to us and we will arrange it.
In the event of a conflict, this DPA prevails over the Terms and the Privacy Policy in relation to the processing of Personal Data carried out on your behalf.
"Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Supervisory Authority" have the meanings given in the GDPR. "Data Protection Law" means the GDPR, the UK GDPR and the Data Protection Act 2018, applicable United States state privacy laws, and any other data protection or privacy law applicable to the processing.
02Roles of the parties
| Data | Customer | Leads Ranger |
|---|---|---|
| Personal Data inside your workspace (contacts, recipients, message content, notes, uploads) | Controller | Processor, acting only on your instructions |
| Your own account, billing and support data | Data Subject or Controller of your staff data | Independent Controller, governed by the Privacy Policy |
| Aggregated and de-identified service statistics | Not applicable | Controller, provided the data cannot be attributed to a Data Subject |
You are responsible for the lawfulness of the Personal Data you provide and of the instructions you give, including having a lawful basis for the processing and for the outreach itself, and for providing any notice or obtaining any consent required by Data Protection Law.
03Our processing obligations
- We process Personal Data only on your documented instructions, including for transfers, unless required to do otherwise by law that applies to us, in which case we will tell you first unless the law prohibits it.
- Your use of the Service, including the configuration you set up, constitutes your documented instructions. Additional instructions outside the ordinary functionality of the Service may be subject to agreement, including on cost.
- We will tell you if, in our opinion, an instruction infringes Data Protection Law.
- We do not sell Personal Data, do not share it for cross-context behavioural advertising, do not combine it with data from other sources for our own purposes, and do not use it to train artificial intelligence models.
- Our personnel who are authorised to process Personal Data are bound by written confidentiality obligations that survive the end of their engagement, and access is limited to those who need it to operate the Service.
04Details of the processing
| Item | Detail |
|---|---|
| Subject matter | Provision of the Leads Ranger lead generation, outreach and customer relationship Service. |
| Duration | For the term of the Terms, plus the retention period described in section 8. |
| Nature and purpose | Collection, organisation, storage, retrieval, use, transmission, enrichment, analysis, generation of content, and deletion, in each case as needed to provide the Service you have configured. |
| Categories of Data Subject | Your business contacts, prospects, leads and recipients; your Users and staff; and any other individual whose Personal Data you choose to place in the workspace. |
| Categories of Personal Data | Business contact details (name, business email address, business phone number, job title, employer, business address, website, public business profile information), correspondence content and metadata, engagement records, notes and commercial status information, and any other data you upload. |
| Special category data | None. The Service is not designed for it and you must not upload it. See section 5 of the Acceptable Use Policy. |
| Frequency | Continuous, for the duration of the Service. |
05Security measures
We implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. Those measures include, at a minimum:
- encryption of data in transit, and encryption at rest for credentials and connection secrets;
- logical separation of each customer workspace, so that one customer cannot access another customer’s data;
- access control on a least-privilege basis, with administrative access restricted to the personnel who need it to operate the Service;
- authentication controls on customer accounts, and protections against unauthorised access attempts;
- layered protections against abuse and misuse of the Service and of shared infrastructure;
- monitoring for availability and integrity, with the ability to restore access to Personal Data after an incident;
- regular backups, with restoration capability;
- change management and review processes before material changes reach production;
- confidentiality obligations and security expectations applied to personnel and contractors.
Why this list is at the level it is
We describe our controls at the level a Controller needs in order to assess them, and no lower. Publishing the specific configuration of a security control would help the people those controls exist to stop. A customer with a documented security review requirement can request further detail under a confidentiality agreement, and we will provide what is reasonable.
You are responsible for your own side of the security boundary: the strength and secrecy of your credentials, who you invite into your workspace, what access you grant them, and the security of the third-party services you connect.
06Sub-processors
- You give us general written authorisation to engage sub-processors to help deliver the Service.
- Each sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA, and is limited to processing Personal Data only as needed to provide its service to us.
- The current list is published at Sub-processors and is kept up to date.
- We will give at least 30 days’ notice before adding or replacing a sub-processor, by updating that page and, on request, by email to the address you nominate for that purpose.
- If you have a reasonable, documented data protection objection to a new sub-processor, tell us within that notice period and we will work in good faith to offer an alternative. If we cannot, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused period, which is your sole remedy.
- We remain fully liable to you for the performance of our sub-processors’ obligations.
07Assistance we provide
Data subject requests
The Service gives you the tools to access, correct, export and delete the Personal Data in your workspace directly, which will normally let you answer a request without involving us. Where you cannot, we will provide reasonable assistance, taking into account the nature of the processing.
If a Data Subject contacts us directly about data in your workspace, we will not respond substantively. We will tell them you are the Controller, and forward the request to you promptly.
Personal data breaches
We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Personal Data we process on your behalf. The notification will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned so far as known, the likely consequences, the measures taken or proposed, and a contact point for further information. We will provide further information as the investigation progresses.
Notifying you is not an admission of fault or liability. Notifying Data Subjects and Supervisory Authorities in your own capacity as Controller is your responsibility, and we will give you the reasonable assistance you need to do it.
Impact assessments
We will provide reasonable assistance with data protection impact assessments and prior consultations with Supervisory Authorities, to the extent they relate to our processing and to information that is not otherwise available to you.
08Retention, return and deletion
- You can export Personal Data from the Service at any time while your account is open, in a structured, commonly used, machine-readable format.
- You can delete Personal Data from your workspace at any time. Deletion through the interface is your instruction to delete.
- On termination, and unless you ask us in writing within 30 days to return it, we will delete or de-identify Personal Data processed on your behalf within 30 days of the end of the account.
- Backups expire on a rolling cycle, and deleted data disappears from them as that cycle completes. Until then it remains inaccessible for ordinary use and subject to this DPA.
- We may retain Personal Data where required by law, and where we do, this DPA continues to apply to it.
09International transfers
We process Personal Data in the Islamic Republic of Pakistan and in the countries where our sub-processors operate. Pakistan is not the subject of an adequacy decision by the European Commission or the United Kingdom.
Where Personal Data is transferred out of the EEA, the United Kingdom or Switzerland, the parties agree that the European Commission Standard Contractual Clauses (Module Two, Controller to Processor) are incorporated into this DPA by reference and apply to that transfer, with:
- Customer as data exporter and Leads Ranger as data importer;
- the optional docking clause applying, Clause 9 Option 2 (general written authorisation, 30 days) applying, Clause 11 optional redress language not applying, Clause 17 Option 1 governed by the law of Ireland, and Clause 18(b) selecting the courts of Ireland;
- Annex I populated by section 4 of this DPA, Annex II by section 5, and Annex III by the Sub-processors page.
For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies, with the tables completed by reference to the same sections. For transfers from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection and the competent authority is the Federal Data Protection and Information Commissioner.
10Audits and evidence of compliance
- On written request, and no more than once in any twelve month period unless required by a Supervisory Authority or following a Personal Data Breach, we will make available the information reasonably necessary to demonstrate compliance with this DPA.
- We will respond to a reasonable, proportionate security questionnaire, subject to a confidentiality agreement.
- An on-site audit may be requested where the information provided is genuinely insufficient, on 30 days’ written notice, during business hours, without unreasonable disruption, subject to confidentiality, at your cost, and by an independent auditor who is not our competitor and who is approved by us acting reasonably.
- Audit rights do not extend to information about other customers, to our commercial or security-sensitive internal detail, or to systems operated by our sub-processors, for which we will provide the assurances available to us.
11Liability, term and governing law
- Each party’s liability under this DPA is subject to the exclusions and limitations of liability in the Terms & Conditions. Where a claim could be brought under both, the total recoverable amount remains subject to a single aggregate cap.
- This DPA takes effect when you accept the Terms and continues until we no longer process Personal Data on your behalf. The obligations that by their nature should survive, including confidentiality, security and deletion, survive termination.
- Except where the Standard Contractual Clauses require otherwise, this DPA is governed by the laws of the Islamic Republic of Pakistan, and the courts of competent jurisdiction in Pakistan have exclusive jurisdiction.
- Questions, countersignature requests and sub-processor objections: support@leadsranger.com with "DPA" in the subject line.