This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", "Controller") and GBA Solutions ("LeadLog", "Processor") for the use of the LeadLog service.
This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person processed through the Service.
- "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
- "Data Subject" means the individual to whom Personal Data relates.
- "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
- "Service" means the LeadLog application and related services.
2. Scope and Purpose
2.1 Subject Matter
The Processor processes Personal Data on behalf of the Controller to provide the LeadLog lead capture and management service.
2.2 Nature and Purpose
Processing includes:
- Storage of lead contact information in the database
- Processing of voice recordings for AI transcription
- Processing of business card images for AI data extraction
- Synchronisation across devices and team members
- Export of lead data to requested formats
2.3 Categories of Personal Data
- Contact information: names, email addresses, phone numbers
- Professional information: company names, job titles
- Voice recordings (processed for transcription)
- Business card images (processed for data extraction)
- Notes and user-entered information
2.4 Categories of Data Subjects
- Business contacts captured by the Controller at events
- Individuals whose information appears on business cards
2.5 Duration
Processing continues for the duration of the service agreement and for 90 days following termination, unless earlier deletion is requested.
3. Obligations of the Processor
3.1 Processing Instructions
The Processor shall:
- Process Personal Data only on documented instructions from the Controller
- Not process Personal Data for any purpose other than providing the Service
- Inform the Controller if an instruction infringes GDPR or other data protection law
3.2 Confidentiality
The Processor ensures that persons authorised to process Personal Data:
- Have committed to confidentiality or are under statutory obligation of confidentiality
- Process Personal Data only as necessary to provide the Service
3.3 Security (Article 32 GDPR)
The Processor implements appropriate technical and organisational measures, including:
- Encryption of data in transit (TLS 1.2+)
- Encryption of data at rest (Google Cloud default encryption - AES-256)
- Access controls and authentication via Firebase Auth
- Role-based access within workspaces
- Secure API key management (encrypted secrets)
- Regular security updates and monitoring
- Cloud infrastructure security (Google Cloud Platform)
3.4 Sub-processors
The Controller provides general authorisation for the Processor to engage sub-processors listed at leadlog.app/subprocessors.
The Processor shall:
- Maintain an up-to-date list of sub-processors
- Notify the Controller of any intended changes to sub-processors
- Give the Controller opportunity to object to new sub-processors
- Ensure sub-processors are bound by equivalent data protection obligations
3.5 Data Subject Rights
The Processor assists the Controller in responding to requests from Data Subjects exercising their rights under GDPR (access, rectification, erasure, restriction, portability, objection).
Assistance includes:
- Providing data export functionality (Excel format)
- Enabling deletion of individual leads and associated files
- Providing account deletion upon request
3.6 Security Incidents
The Processor shall:
- Notify the Controller without undue delay (and within 48 hours where feasible) upon becoming aware of a Personal Data breach
- Provide information necessary for the Controller to fulfill breach notification obligations
- Assist in investigating and mitigating the breach
3.7 Data Protection Impact Assessments
The Processor assists the Controller with data protection impact assessments and prior consultations with supervisory authorities where required.
3.8 Deletion and Return
Upon termination of the Service or upon request:
- The Controller may export all Personal Data using the Service's export feature
- The Processor deletes Personal Data within 90 days of termination unless retention is required by law
- Individual leads and associated files are deleted immediately upon request
3.9 Audit Rights
The Processor makes available to the Controller information necessary to demonstrate compliance with this DPA and allows for audits and inspections.
The Controller may:
- Request documentation of security measures
- Request confirmation of sub-processor compliance
- Conduct or commission audits with reasonable notice
4. Obligations of the Controller
The Controller shall:
- Ensure a valid legal basis exists for processing Personal Data
- Provide clear instructions to the Processor
- Ensure Data Subjects are informed about processing
- Respond to Data Subject requests
- Notify relevant supervisory authorities of data breaches where required
5. International Data Transfers
5.1 Transfer Mechanisms
Personal Data may be transferred outside the EEA to:
- United States (OpenAI): OpenAI is certified under the EU-US Data Privacy Framework. Voice recordings and business card images are sent to OpenAI for AI processing.
5.2 Safeguards
For transfers to countries without an adequacy decision, the Processor relies on:
- EU-US Data Privacy Framework certification (where applicable)
- Standard Contractual Clauses (SCCs) as adopted by the European Commission
5.3 Transfer Impact Assessment
The Processor has assessed that:
- OpenAI processes data transiently for AI inference
- OpenAI's API data is not used for model training (per their API data usage policy)
- Supplementary measures (encryption in transit, access controls) are in place
6. Technical and Organizational Measures (TOMs)
The Processor implements the following measures:
6.1 Access Control
- Authentication via Firebase Auth (Google OAuth, email/password)
- Role-based access control (workspace owner, member)
- API authentication for all backend requests
6.2 Encryption
- TLS 1.2+ for all data in transit
- AES-256 encryption at rest (Google Cloud default)
- Encrypted storage of API secrets
6.3 Data Integrity
- Firestore security rules enforce data validation
- Audit logging of administrative actions
- Automatic backups via Google Cloud
6.4 Availability
- Google Cloud Platform infrastructure (99.95% SLA)
- Automatic scaling and redundancy
- europe-west1 (Belgium) deployment region
6.5 Data Minimisation
- Only data necessary for the Service is collected
- Voice recordings and images are deleted when leads are deleted
- No unnecessary data retention
7. Liability
Each party is liable for damages caused by processing that infringes GDPR, in accordance with Article 82 GDPR. Liability limitations in the Terms of Service apply to the extent permitted by law.
8. Term and Termination
This DPA remains in effect for the duration of the service agreement. Obligations regarding data deletion, confidentiality, and cooperation with audits survive termination.
9. Governing Law
This DPA is governed by the laws of Ireland. For disputes related to GDPR, the courts of Ireland have jurisdiction, without prejudice to the rights of Data Subjects to lodge complaints with supervisory authorities.
10. Contact
For questions about this DPA or to exercise rights under it:
- Processor Contact: GBA Solutions
- Email: hello@leadlog.app
- Address: Naas, Co. Kildare, Ireland
11. Acceptance
By using the LeadLog Service, the Customer accepts this DPA. For customers requiring a signed copy, please contact us at hello@leadlog.app.