GDPR & Data Protection

The controller responsible for this website and for LeadJourney as a service is:

Full company details are on our imprint page.

GDPR distinguishes who decides why data is processed (the controller) from who processes it on someone else’s instructions (the processor). LeadJourney acts in both roles, depending on the situation:

• We are the controller when you visit our website, fill in a form, talk to our team, or hold a LeadJourney subscription. We decide how that data is handled, as described on this page.
• We are your processor when you use LeadJourney to track your own visitors, leads, and customers. There, you are the controller: you decide what is collected and why, and we process it only on your documented instructions, under our Data Processing Agreement.

As a controller, we process the following categories of personal data. For each we state the purpose and the legal basis under Article 6 GDPR.

Website use and analytics

Pages viewed, device and browser type, approximate (city-level) location, referring source, and similar usage data. Purpose: to operate, secure, and improve the site and measure our marketing. Legal basis: your consent for non-essential analytics and marketing (Art. 6(1)(a)); our legitimate interest for strictly necessary operation (Art. 6(1)(f)).

Forms, demo requests, and contact

Name, email, phone, company, your message, and the marketing attribution parameters tied to your visit. Purpose: to respond to your enquiry, arrange demos, and send information you ask for. Legal basis: steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in answering you (Art. 6(1)(f)).

Account and billing

Account holder name, email, company, and billing details (payments handled by Stripe). Purpose: to provide the service and invoice you. Legal basis: performance of our contract (Art. 6(1)(b)); compliance with legal and tax obligations (Art. 6(1)(c)).

Support and live chat

Messages and contact details you send us through chat or email. Purpose: to provide support. Legal basis: our contract with you and our legitimate interest in helping customers.

Marketing emails

Your email address. Purpose: product updates and relevant content. Legal basis: your consent; you can unsubscribe from any email at any time.

When you run LeadJourney, the platform ingests data such as ad clicks, tracking parameters, conversion events, and the contact details your own leads submit through your forms. You decide what is collected and for what purpose. We process this data only to provide the tracking, attribution, and reporting features you have set up.

We do not sell this data, we do not use it for our own marketing, and we do not share it except with the sub-processors listed below. You can export or delete it at any time, and we delete it when your contract ends, subject to any short technical backup window.

All production data is stored and processed on cloud infrastructure located in Frankfurt, Germany (DigitalOcean), within the European Union. We chose EU-based hosting so European customers can keep their core data in the EU by default.

A few of our sub-processors are headquartered outside the EU (for example in the United States) and may process limited personal data there. Where that happens, we rely on the safeguards required by Chapter V GDPR, in particular the European Commission’s Standard Contractual Clauses (SCCs) and, where it applies, the EU-US Data Privacy Framework. The sub-processor list below marks where this is the case.

We work with a small, vetted set of sub-processors. The list below is current as of 30 June 2026 and may change with reasonable notice.

When you connect your own advertising accounts (Meta, Google, LinkedIn, Microsoft) to LeadJourney, data is also exchanged with those platforms under your own agreements with them and on your instruction.

• Website analytics: up to 14 months.
• Leads and demo requests that do not convert: up to 24 months, then deleted or anonymised.
• Customer account data: for the life of your contract, then deleted, except records we must keep for tax and accounting (typically up to 10 years).
• Customer-controlled data (where we act as processor): kept according to your configuration and deleted on your request or at contract end.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (the “right to be forgotten”);
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing done before withdrawal.

To exercise any of these, email [email protected]. We respond within one month. If your data reached us through a LeadJourney customer’s account (where we act as processor), we will forward your request to that customer, who is the controller.

You also have the right to lodge a complaint with a data protection supervisory authority. As a Cyprus-established company, our lead authority is the Office of the Commissioner for Personal Data Protection (Cyprus). You may also contact the authority in your own country.

We protect personal data with encryption in transit (TLS) and at rest, role-based access controls on a least-privilege basis, audited access to production systems, and regular backups. We review these measures regularly and require our sub-processors to maintain comparable standards.

If you process personal data through LeadJourney, we make a Data Processing Agreement available that meets the requirements of Article 28 GDPR. It covers our role as your processor, the sub-processors listed above, the security measures we apply, and how we assist you with data subject requests. To request a DPA, contact us at [email protected].

Our website uses cookies and similar technologies. Our Cookie Policy lists every cookie and tool we use and explains how to manage your preferences.

We may update this page as our service, sub-processors, or the law change. The “last updated” date at the top always reflects the current version. For significant changes affecting customers, we provide reasonable notice.

LeadJourney Ltd., Artemidos 6 str., Apartment 24, Joanna Court, 6030 Larnaca, Cyprus. Email [email protected] for any privacy or data protection question, including requests to our Data Protection Officer.