GDPR & Data Protection

The controller responsible for this website and for LeadJourney as a service is:

Company

LeadJourney Ltd.Reg. no. HE485008 (Cyprus)

Registered address

Artemidos 6 str., Office 24Joanna Court6030 LarnacaCyprus

Contact

[email protected]

Data Protection Officer

Jonas Strambach[email protected]

Full company details are on our imprint page.

The GDPR distinguishes who decides why data is processed (the controller) from who processes it on someone else's instructions (the processor). LeadJourney acts in both roles, depending on the situation:

• We are the controller when you visit our website, fill in a form, talk to our team, or hold a LeadJourney subscription. We decide how that data is handled, as described on this page.
• We are your processor when you use LeadJourney to track your own visitors, leads and customers. There you are the controller: you decide what is collected and why, and we process it only on your documented instructions, under our Data Processing Agreement.

As a controller we process the categories below. For each we state the purpose and the legal basis under Art. 6 GDPR.

Website use and analytics

Pages viewed, device and browser type, approximate city level location, referring source and similar usage data. Purpose: to operate, secure and improve the site and measure our marketing. Legal basis: our legitimate interest in operating, securing and improving the site and measuring our marketing (Art. 6(1)(f)).

Forms, demo requests and contact

Name, email, phone, company, your message, and the marketing attribution parameters tied to your visit. Purpose: to respond to your enquiry, arrange demos and send information you ask for. Legal basis: steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in answering you (Art. 6(1)(f)).

Account and billing

Account holder name, email, company and billing details, with payments handled by Stripe. Purpose: to provide the service and invoice you. Legal basis: performance of our contract (Art. 6(1)(b)) and compliance with legal and tax obligations (Art. 6(1)(c)).

Support and live chat

Messages and contact details you send us through chat or email. Purpose: to provide support. Legal basis: our contract with you and our legitimate interest in helping customers.

Marketing emails

Your email address. Purpose: product updates and relevant content. Legal basis: your consent, and you can unsubscribe from any email at any time.

When you run LeadJourney, the platform ingests data such as ad clicks, tracking parameters, conversion events and the contact details your own leads submit through your forms. You decide what is collected and for what purpose. We process that data only to provide the tracking, attribution and reporting features you have set up.

We do not sell this data, we do not use it for our own marketing, and we do not share it except with the sub-processors listed below. You can export or delete it at any time, and we delete it when your contract ends, subject to a short technical backup window.

All production data is stored and processed on cloud infrastructure located in Frankfurt, Germany (DigitalOcean), within the European Union. We chose EU based hosting so European customers keep their core data in the EU by default. The infrastructure detail is on our security page.

A few of our sub-processors are headquartered outside the EU, for example in the United States, and may process limited personal data there. Where that happens we rely on the safeguards required by Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses and, where it applies, the EU-US Data Privacy Framework. The sub-processor list below marks where this is the case.

We work with a small, vetted set of sub-processors. The list below is current as of 13 September 2026 and may change with reasonable notice. The full list, including the providers that handle our own advertising, is in the privacy policy.

When you connect your own advertising accounts (Meta, Google, LinkedIn, Microsoft) to LeadJourney, data is also exchanged with those platforms under your own agreements with them and on your instruction.

• Website analytics: up to 14 months.
• Leads and demo requests that do not convert: up to 24 months, then deleted or anonymised.
• Customer account data: for the life of your contract, then deleted, except records we must keep for tax and accounting, typically up to 10 years.
• Customer controlled data, where we act as processor: kept according to your configuration and deleted on your request or at contract end.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, the right to be forgotten;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing carried out beforehand.

To exercise any of these, email [email protected]. We respond within one month. If your data reached us through a LeadJourney customer's account, where we act as processor, we forward your request to that customer, who is the controller. How a request is handled, step by step, is set out in our data subject rights policy.

You also have the right to lodge a complaint with a data protection supervisory authority. As a Cyprus established company, our lead authority is the Office of the Commissioner for Personal Data Protection (Cyprus). You may also contact the authority in your own country.

We protect personal data with encryption in transit (TLS) and at rest, role based access controls on a least privilege basis, audited access to production systems, and regular backups. We review these measures regularly and require our sub-processors to maintain comparable standards. The full breakdown is on our security page.

If you process personal data through LeadJourney, we make a Data Processing Agreement available that meets the requirements of Art. 28 GDPR. It covers our role as your processor, the sub-processors listed above, the security measures we apply, and how we assist you with data subject requests. To request one, email [email protected].

Our website uses cookies and similar technologies. Our cookie policy lists every cookie and tool we use and explains how to manage your preferences.

We may update this page as our service, our sub-processors or the law change. The date at the top always reflects the current version. For significant changes affecting customers, we give reasonable notice.

LeadJourney Ltd., Artemidos 6 str., Office 24, Joanna Court, 6030 Larnaca, Cyprus. Email [email protected] for any privacy or data protection question, including requests directed to our Data Protection Officer.