Data management, GDPR, ePrivacy and
security with Leadoo

The General Data Protection Regulation sets guidelines for how personal data needs to be managed. When you collect personal data on your website, you are a Controller of that data and need to inform the people you collect personal data on, why and how you’re going to use it, as well as which sub-processors you are using to store the data. As a controller you are obliged to ensure that you manage the personal data and don’t give it to third parties you haven’t informed the user about. The user also has the right to ask you about what info you have about them and ask you to delete their data. Most commonly you have to tell your users if you store their data in a CRM (like Salesforce or Pipedrive), process their data in an invoicing system or just store it in Google Spreadsheets or Excel files. All of these have to be listed on your website for your users to approve before you collect their data.

Personal data is any data that can be used to identify a person. Most commonly this is the name, email address and phone number but it can also be the IP address of the person visiting your site.

The best way to document this on your website is to document how you take care of security, storing of data and what 3rd party sub processors you use and for what purpose. In Leadoo’s case we have done it like this: https://leadoo.com/data-protection-and-gdpr/ which you can feel free to copy. After this you have to ask people for permission to store the data. This can in Leadoo’s case be done through a question within a bot or a separate popup.

You also need to ensure that you have a Data Processing Agreement (DPA) with all your sub processors. This document is proof that you have agreed with your sub processors about how you communicate about data and that you have the right to ask them to remove data about your customers if your customers ask you to. In Leadoo’s case our DPA is part of the standard contract, found here: https://leadoo.com/data-processing-agreement-customer/

At Leadoo we have ensured that we minimize the risk of data leakage. We have for instance enabled it for our customers to flag if they use a service or not. E.g. if they don’t use email automation, data will not go to Sendgrid and if they don’t use Smart Company profiles data doesn’t go to Clearbit, and when it does only the IP address is transferred. We have also ensured we have Standard Contractual Clauses (SCCs) with all our sub processors. For the parts where we do use non-EU based companies or services, we have documented it, created internal review processes and ensured by automatic data erasure and security measures the impact is as small as possible. We also encrypt all data in rest and in transfer and access our own production environment only over VPN. This is naturally sound advice for any company, regardless of regulation.

Data retention, clearing possibly personal data points, happens in a nightly fashion for all data that has been collected by Leadoo in a nightly fashion. By default we delete >5 year data. Customers can set this to any custom amount of days, e.g. clear personal data if it is older than 15 days.