Data Subject Rights

This policy outlines the processes by which LeadJourney Ltd. handles requests from individuals exercising their rights under the EU General Data Protection Regulation (GDPR), including the right to access personal data we hold, the right to rectification, and the right to erasure. It applies both to visitors and users of our website and platform, and to end-users of our customers whose data is processed by LeadJourney as a data processor.

This policy applies to all personal data controlled or processed by LeadJourney Ltd. All data subject requests must be submitted in writing to [email protected].

Requests are reviewed and handled by the Director (Jonas Strambach) or a designated responsible agent. We will respond to all valid requests within one (1) calendar month of receipt, as required by Art. 12 GDPR. Where requests are complex or numerous, we may extend this period by a further two months with notice.

You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data together with supplementary information. The process is as follows:

1. The request is submitted in writing to [email protected].
2. The request is reviewed by the Director and logged in the Data Subject Request Register.
3. The validity and identity of the requester is verified. If the request cannot be fulfilled (e.g. identity cannot be verified, or no data is held), the requester is informed in writing with reasons.
4. A responsible agent is assigned to search all relevant systems for personal data relating to the requester.
5. A complete summary of the data held is compiled and sent securely to the requester.
6. The outcome and all actions taken are logged in the Data Subject Request Register.

You have the right to have inaccurate personal data corrected and incomplete data completed. The process is as follows:

1. The request is submitted in writing to [email protected], stating clearly which data is inaccurate and what the correct information is.
2. The request is reviewed by the Director and logged in the Data Subject Request Register.
3. The validity of the request is assessed. If the request cannot be fulfilled, the requester is informed in writing with reasons.
4. A responsible agent searches the relevant systems and identifies all affected data entries.
5. The required corrections are made. Documentation (e.g. screenshots or audit logs) confirming the rectification is collected.
6. Confirmation of the rectification, together with supporting documentation, is sent to the requester.
7. All actions taken are logged in the Data Subject Request Register.

You have the right to request the deletion of your personal data where, for example, it is no longer necessary for the purpose it was collected, or you withdraw consent. The process is as follows:

1. The request is submitted in writing to [email protected].
2. The request is reviewed by the Director and logged in the Data Subject Request Register.
3. The validity of the request is assessed and legal grounds for retention (e.g. tax obligations, legal claims) are checked. If the request cannot be fulfilled in full, the requester is informed in writing with reasons.
4. A responsible agent identifies all personal data relating to the requester across all relevant systems, including sub-processors where applicable.
5. The required deletions are carried out. Documentation (e.g. screenshots or audit logs) confirming deletion is collected.
6. Confirmation of erasure, together with supporting documentation, is sent to the requester.
7. All actions taken are logged in the Data Subject Request Register.

In addition to the rights above, you may also exercise the following rights under the GDPR by contacting us at [email protected]:

• Right to restriction (Art. 18 GDPR): You may request that we restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested.
• Right to data portability (Art. 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests or for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Where LeadJourney acts as a data processor on behalf of one of our customers (the data controller), we may hold personal data about you as an end-user of that customer's service. In this case, the customer is responsible for handling your data subject request. If you contact us directly, we will forward your request to the relevant customer without undue delay and inform you accordingly.

If you believe your data protection rights have not been respected, you have the right to lodge a complaint with a supervisory authority. As a Cyprus-registered company, our lead supervisory authority is:

You may also contact the supervisory authority in your own country of residence.

We reserve the right to update this policy at any time to reflect changes in our practices or applicable law. The "last updated" date at the top of this document reflects the current version. Material changes affecting your rights will be communicated with reasonable notice.

LeadJourney Ltd. · HE485008 · Artemidos 6, 6030 Larnaca, Cyprus · [email protected] · Version 1.0