Data Processing Agreement

1. Parties, Roles and Scope

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Lead Core Terms & Conditions (the “Agreement”) between Liam Lord trading as Lead Core (the “Processor”) and the business customer that has accepted the Agreement (the “Customer” or “Controller”). Lead Core is a sole trader business operating in England. Capitalised terms not defined in this DPA have the meaning given in the Agreement.

Lead Core acts as a Data Processor (or, where the Customer is itself a processor acting for another controller, as a sub-processor) of Customer Personal Data processed through the Platform. The Customer is the Data Controller (or processor for its own controller) and determines the purposes and means of processing Customer Personal Data.

The Customer’s role and Lead Core’s role are determined by the actual purpose and circumstances of each processing activity. Where Lead Core processes personal data for its own purposes (for example account administration, billing and its own B2B marketing), Lead Core is the controller and this DPA does not apply to that processing, which is described in the Privacy Policy.

This DPA applies only to Customer Personal Data in respect of which Lead Core acts as a processor on the Customer’s documented instructions. It does not apply to personal data that the Customer processes independently through third-party services the Customer has separately contracted.

2. Subject Matter, Duration, Nature and Purpose

The subject matter, duration, nature and purpose of processing, the types of Customer Personal Data and the categories of data subjects are set out in Schedule 1 (Processing Details). In summary:

• Subject matter: provision of the Platform and the contracted Services to the Customer.
• Duration: for the term of the Agreement and thereafter until deletion or return of Customer Personal Data in accordance with Section 12.
• Nature and purpose: hosting, storing, transmitting, displaying and processing Customer Personal Data as necessary to provide the CRM, communications, automation, website, AI and related features the Customer has configured.

Lead Core processes Customer Personal Data only as necessary to provide the contracted Services and in accordance with the Customer’s documented instructions, except where otherwise required by UK or EU law to which Lead Core is subject.

3. Documented Instructions

Lead Core processes Customer Personal Data only on the Customer’s documented instructions, which include the configuration choices the Customer makes within the Platform, the accepted order or service agreement, and this DPA. The Agreement (including this DPA) constitutes the Customer’s complete and documented instructions in respect of Customer Personal Data.

Where Lead Core considers that an instruction infringes applicable data protection law, Lead Core will inform the Customer without undue delay. Lead Core is not obliged to carry out instructions that it reasonably believes are unlawful, and the Customer remains responsible for the lawfulness of its instructions.

Where Lead Core is required by UK or EU law to process Customer Personal Data for its own compliance obligations, it will, to the extent permitted by that law, inform the Customer of that legal requirement before processing.

4. Confidentiality

Lead Core ensures that persons authorised to process Customer Personal Data are bound by enforceable confidentiality obligations or are under an appropriate statutory obligation of confidentiality. Authorised personnel process Customer Personal Data only as necessary to provide the contracted Services, subject to appropriate access controls.

5. Security Measures

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, Lead Core implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk.

These measures are described in Schedule 2 (Security Measures) and are kept under review. The Customer is responsible for configuring the Platform securely, managing user access within its account, and safeguarding its own credentials.

The specific measures applied to any particular service depend on the relevant service and the underlying technology supplier arrangements. Lead Core does not warrant any specific security certification unless separately confirmed in writing.

6. Subprocessors

The Customer provides general written authorisation for Lead Core to engage subprocessors to provide the Platform. Lead Core maintains information about the categories of subprocessor it uses, which is set out in Schedule 3 (Subprocessors).

Lead Core remains responsible for the performance of its subprocessors to the same extent as if Lead Core were performing the relevant processing itself, and ensures that subprocessors are bound by written contracts requiring data-protection terms substantially consistent with this DPA and UK GDPR Article 28.

Where Lead Core intends to add or replace a subprocessor, it will give the Customer reasonable prior notice (which may be given through the Platform or by email), giving the Customer the opportunity to object to such changes on reasonable data-protection grounds. The Customer’s right to object on reasonable data-protection grounds is preserved and is not excluded or limited by this Section. The parties will discuss any objection in good faith and seek to resolve it. Where the Customer’s objection is sustained on reasonable data-protection grounds and Lead Core cannot reasonably provide the affected service without the disputed subprocessor, the parties will seek to agree an appropriate alternative arrangement. Discontinuing the affected service is one available outcome but is not the Customer’s sole remedy; the parties may alternatively agree on a different technical or contractual arrangement, or, where agreement cannot reasonably be reached, the Customer may terminate the affected service in accordance with the Agreement without penalty attributable solely to that termination.

Some Platform infrastructure and AI features are provided through an underlying technology supplier. The subprocessor arrangements for those components, including any objection periods that apply under those arrangements, are governed by the relevant supplier relationships. Lead Core will operate any downstream objection process so far as reasonably possible within the constraints of those upstream arrangements.

7. Data Subject Rights Assistance

Taking into account the nature of the processing, Lead Core will assist the Customer, by appropriate technical and organisational measures, in so far as possible, in fulfilling the Customer’s obligations to respond to requests from data subjects exercising their rights under UK GDPR / EU GDPR.

The Customer is responsible for responding to requests from its own data subjects. Lead Core will provide reasonable assistance, including by making available the functionality within the Platform that allows the Customer to access, rectify, restrict, export or delete Customer Personal Data within the Customer’s account.

Lead Core cannot alter or delete Customer Personal Data without the Customer’s documented instruction, except where required by applicable law.

8. Personal Data Breach Assistance and Notification

Lead Core will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe the nature of the breach, the likely consequences, and the measures taken or proposed to address it and mitigate its possible adverse effects.

Lead Core will provide reasonable assistance to the Customer in meeting the Customer’s obligations under UK GDPR Articles 33 and 34 (and equivalent EU provisions), taking into account the nature of the processing and the information available to Lead Core.

The Customer is responsible for assessing whether a breach is notifiable to the relevant supervisory authority or to affected data subjects and for making any such notification. Lead Core’s notification obligations under this Section are subject to the information available to it and any legal restrictions on disclosure.

9. Assistance with Assessments and Compliance

Taking into account the nature of the processing and the information available to Lead Core, Lead Core will provide reasonable assistance to the Customer in fulfilling the Customer’s obligations in relation to data protection impact assessments and prior consultation with supervisory authorities, where required under UK GDPR / EU GDPR.

10. International Transfers

Lead Core does not transfer Customer Personal Data outside the United Kingdom or EEA except through subprocessors and infrastructure providers that may process data in third countries. Where Customer Personal Data is transferred to a third country that is not subject to an adequacy decision, the transfer is made subject to appropriate safeguards in accordance with Chapter V of the UK GDPR / EU GDPR.

Appropriate safeguards may include the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses (or the UK International Data Transfer Agreement), the European Commission Standard Contractual Clauses for EEA-originating data, an applicable UK extension to a recognised adequacy framework where the recipient is in fact certified, or another lawful transfer mechanism recognised under applicable data protection law.

The specific transfer mechanism applicable to a given subprocessor depends on the relevant supplier arrangement and is subject to confirmation. Lead Core does not assert participation in any specific transfer framework on its own behalf. The Customer should review Schedule 3 and request further information where required.

11. Audit and Compliance Information

Lead Core will make available to the Customer information necessary to demonstrate compliance with the obligations laid down in this DPA and UK GDPR Article 28.

On reasonable prior notice, and subject to applicable confidentiality obligations, the Customer may audit Lead Core’s compliance with this DPA, provided that the Customer gives reasonable notice, conducts the audit during business hours, and minimises disruption to Lead Core’s operations. Where the audit would access the premises or systems of a subprocessor, it will be conducted in accordance with the audit rights Lead Core has negotiated with that subprocessor.

Where Lead Core has commissioned a relevant independent audit or certification, Lead Core may, in lieu of an on-site audit and by agreement with the Customer, make a summary or report of that audit or certification available to the Customer subject to confidentiality. The availability of such a report does not replace the Customer’s audit right under this Section and UK GDPR Article 28; it is an alternative the Customer may choose to accept, not a mandatory substitute imposed by Lead Core.

12. Return and Deletion of Personal Data

Upon termination or expiry of the Agreement, and at the Customer’s choice, Lead Core will, subject to the functionality of the Platform and applicable contractual obligations, either return or delete Customer Personal Data, except where retention is required by applicable law.

The Customer should arrange any available export of Customer Personal Data through the export functionality available within the Platform before the effective termination date. The available export formats and the post-termination access period (if any) depend on the relevant service and the underlying platform capabilities. Lead Core does not warrant that any particular post-termination access period will be available.

Lead Core will delete or return Customer Personal Data after the end of the provision of the Services, and delete existing copies unless applicable law requires storage. The specific deletion timeframe depends on the relevant service and underlying platform capabilities.

Telephone numbers, domains and connected third-party assets may have separate ownership, transfer and portability rules. Lead Core does not warrant that all Platform-issued telephone numbers are owned by the Customer or are permanently transferable, or that an entire platform sub-account is portable following termination.

13. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in Section 6 of the Agreement (Disclaimers and Limitation of Liability). Nothing in this DPA or the Agreement limits or excludes either party’s liability to the extent that it cannot be limited or excluded under applicable law.

14. Precedence

In the event of a conflict between this DPA and the rest of the Agreement, this DPA prevails in respect of the processing of Customer Personal Data. In the event of a conflict between this DPA and any separately negotiated data protection terms agreed in writing between the parties, the separately negotiated terms prevail.

This DPA does not vary the commercial terms, fees, liability cap or termination rights set out elsewhere in the Agreement.

15. Duration, Termination and Acceptance

This DPA takes effect when the Customer accepts the Agreement (for example at registration or checkout) and continues for the duration of the Agreement. The obligations in Sections 4, 5, 8, 10, 11 and 12, and any other obligations that by their nature are intended to survive, will survive termination or expiry of the Agreement.

A link to this DPA does not by itself vary an existing customer contract. For existing customers whose contracts were formed before this DPA was made available, Lead Core will provide an appropriate mechanism to incorporate this DPA, including reasonable notice and, where required, obtaining the customer’s agreement. Lead Core will not assert that this DPA is automatically binding on existing customers solely by virtue of publication.

This DPA does not represent that any particular subprocessor contract, international transfer mechanism, security certification or deletion timeframe has been confirmed unless separately verified in writing. Where such details remain to be confirmed, they are identified in the relevant Schedules.

Schedule 1 — Processing Details

The following processing details are indicative and subject to confirmation against the actual service configuration. Where a detail is unverified, it is flagged for confirmation.

• Categories of data subjects: the Customer’s prospects, customers, clients, leads, contacts, end-users, website visitors and any other individuals whose personal data the Customer processes through the Platform.
• Categories of personal data: contact details (name, email, telephone, address), account and profile information, communication records (SMS, MMS, email, voice), website form submissions, booking and calendar data, and AI interaction records.
• Special categories (Art. 9): the Customer must not submit special-category personal data, criminal-offence data or other sensitive information into AI features where prohibited by the applicable provider terms (see Exhibit B). Ordinary storage of customer records in CRM functionality is not prohibited by this DPA where lawful under the Customer’s own lawful basis.
• Nature and purpose: hosting, storage, transmission, processing and display of Customer Personal Data to deliver the contracted Services.
• Duration: for the term of the Agreement and thereafter until deletion or return in accordance with Section 12.

The exact categories of personal data processed for each service tier, and whether any service processes special-category data as part of its ordinary configuration, depend on the relevant service configuration and the features the Customer enables.

Schedule 2 — Security Measures

Lead Core implements technical and organisational measures appropriate to the risk, which may include:

• Encryption of personal data in transit and at rest.
• Access controls and least-privilege administration.
• Network security controls and monitoring.
• Back-up and incident-recovery procedures.
• Confidentiality obligations for authorised personnel.
• Processes for assessing and addressing personal data breaches.

The specific encryption standards, certifications and data-centre locations applicable to each service depend on the underlying supplier arrangements. Lead Core does not assert any specific certification unless separately confirmed in writing.

Schedule 3 — Subprocessors

Lead Core engages subprocessors in the following categories to provide the Platform:

• Cloud hosting and infrastructure providers.
• Telecommunications carriers and messaging providers.
• Payment processing providers.
• AI technology suppliers (for AI features).
• Analytics and operational tooling providers.

The specific named subprocessors, the processing they perform, and the applicable international transfer mechanisms are subject to confirmation against the actual supplier contracts. Lead Core does not assert that any particular provider processes every Customer’s data, nor that any particular transfer safeguard applies, unless confirmed.

Customer-authorised integrations (connected by the Customer within the Platform) are not Lead Core subprocessors for the Customer’s independent use of those services; the Customer is responsible for its own authorisation and instructions in respect of those integrations.

A verified subprocessor register, including named providers, processing descriptions, transfer mechanisms and any applicable objection periods, will be made available on reasonable request and confirmed against the actual supplier arrangements.

Cross-References

This DPA should be read alongside:

• Section 1.5 (Privacy and Data Protection) of the Terms & Conditions.
• Section 5.3 (User Contributions) and Section 5.6 (Usage Data) of the Terms & Conditions.
• Section 12.3 (Conflicting Provisions) and Section 13.4 (Consequences of Termination) of the Terms & Conditions.
• Exhibit B (Artificial Intelligence Acceptable Use Policy) of the Terms & Conditions.
• The Privacy Policy, which describes Lead Core’s processing as controller.