Data processing addendum

1. Parties and scope

This addendum is between the business customer that accepts the LeadLegWork Terms (“Customer,” acting as controller or business, where applicable) and Lucas Hull, doing business as LeadLegWork (“Provider,” acting as processor or service provider, where applicable). It applies automatically when Customer accepts the Terms, and covers personal data that Provider processes on Customer’s instructions to provide the LeadLegWork workspace. It does not cover Provider’s own account, billing, security, or legal records, for which Provider decides the purpose.

2. Processing description

Subject matter: prospect research and business website workflow. Duration: while Customer uses the service, plus the backup period in section 6. Nature and purpose: receive, store, organize, display, export, and delete business-contact records and related drafts at Customer’s direction. Data subjects: Customer’s employees and business contacts or prospects. Data types: professional names, business email addresses and phone numbers, business-source notes, qualification and contact history, and user-written drafts. Sensitive personal data and children’s data are not permitted. Customer’s instructions: Customer’s actions in the product and written support requests consistent with the Terms and applicable law.

3. Provider commitments

Provider will process covered data only on Customer’s documented instructions; ensure anyone authorized to access it is bound to confidentiality; keep the safeguards in section 6; help Customer respond to data-subject requests and meet its security obligations as reasonably required; notify Customer of a personal-data breach affecting covered data without undue delay after confirming it; require equivalent protections from the subprocessors in section 4; provide reasonable information about these commitments on request; and, at the end of the service, delete covered data or let Customer export it first, subject to legal retention and the backup period.

4. Subprocessors and location

Covered data is stored and processed in the United States. Current subprocessors: DigitalOcean (application hosting, database, and backups; New York data center); Stripe (subscription billing; receives account billing details, not workspace content); Google (Workspace email for support requests Customer sends, and PageSpeed Insights for page addresses Customer submits). Discovery sources (Overture’s public storage, OpenStreetMap files from Geofabrik, and public city open-data portals) receive only search areas or ZIP codes, never workspace content. Provider will update this list on this page at least 30 days before adding a subprocessor that handles covered data; Customer may object by canceling before the change takes effect.

5. Customer responsibilities

Customer decides the purpose and lawful basis for prospect research and outreach, gives any required notices, checks source and license rights, limits data to what is necessary, keeps suppression and consent records, honors requests, and uses lawful outreach channels. Customer will not instruct Provider to collect or use data in violation of law, a license, or another person’s rights.

6. Security measures

• Encryption in transit: all connections use HTTPS with automatically renewed certificates; plain HTTP redirects to HTTPS.
• Access: the server accepts administrator access only with a security key (no passwords); a firewall allows only web and administrator traffic; the application runs in an isolated, read-only container without administrator rights and listens only behind the HTTPS proxy.
• Accounts: each customer has a separate workspace database; passwords are stored as salted hashes; sessions expire; sign-in attempts are rate-limited.
• Maintenance: operating-system security updates install automatically.
• Backups: the application backs up data daily and keeps the newest 14 copies; the hosting provider keeps weekly server backups for about four weeks. Deleted data leaves the backups as they are replaced.
• Logging: the web server keeps no request logs; system logs record errors and certificate events.
• Incidents: security reports go to support@leadlegwork.com; Provider investigates, contains the issue, and notifies Customer as described in section 3.

7. International transfers and regulated data

The service is offered only for data about people and businesses in the United States. Do not use it for EU, UK, or other international personal data, regulated health information, payment-card data, children’s data, or other regulated categories. No HIPAA business-associate agreement, EU standard contractual clauses, or UK transfer addendum is provided.

8. Contact and term

Privacy and security contact: support@leadlegwork.com. This addendum takes effect when Customer accepts the Terms and continues for as long as Provider processes covered data for Customer. If it conflicts with the Terms about covered data, this addendum controls.