Privacy Policy

The GDPR distinguishes between the entity that decides why and how personal data is processed (the controller) and the entity that processes data on another party’s instructions (the processor). LeadJourney acts in both roles depending on the context:

• We are the controller when you visit our website, fill in a form, sign up for an account, or hold a LeadJourney subscription. We decide how that data is handled, as described in this policy.
• We are your processor when you use LeadJourney to track your own visitors, leads, and customers. In that case, you (the customer) are the controller: you decide what is collected and why, and we process it only on your documented instructions under our Data Processing Agreement (DPA).

If you are an end-user of a LeadJourney customer and have questions about how your data is handled within that customer’s service, please review that customer’s own privacy policy or contact them directly.

The controller responsible for this website and the LeadJourney platform is:

• Read this policy and our other legal documents available at leadjourney.io/legal.
• If you are a customer, review the Data Processing Agreement (DPA) available on request at [email protected].
• When submitting data to the LeadJourney platform, ensure that any personal data has been obtained legally, such as through consent or another valid legal basis under GDPR.
• Do not submit special categories of personal data (Art. 9 GDPR) or data relating to minors under the age of 16 through the platform.
• You have the right to refuse our request for information, although this may limit the services we can provide.

4.1 Website visitors. When you visit our website, we automatically collect standard browser data. This may include your IP address, browser type, device type, pages visited, time of visit, URL clickstreams, and referring source.

4.2 Personal information. We collect personal information when you interact with our services, for example when you sign up for an account, request a demo, contact support, or subscribe to our newsletter. This may include:

• Name, email address, phone number, and company name
• Billing and payment information (processed by Stripe)
• Messages and enquiry content you send to us
• Marketing attribution parameters tied to your visit (UTM parameters, click IDs)

4.3 Platform & business data. We collect business data generated through your use of the LeadJourney platform, including account configuration, usage analytics, integration settings, and activity logs.

4.4 Advertising & retargeting data. When you visit our website, advertising pixels and tags from the platforms listed in Section 8 may collect data about your visit for the purposes of measuring ad performance, retargeting, and conversion optimisation. This data may include your IP address, browser identifiers, cookie IDs, pages visited, and actions taken on our website (e.g. clicking a button or completing a form).

This processing is based on your consent (Art. 6(1)(a) GDPR), which you can grant or withdraw at any time via the cookie consent banner on our website. Withdrawing consent does not affect the lawfulness of processing prior to withdrawal.

4.5 Customer end user data. Our customers may integrate LeadJourney into their websites, landing pages, or other digital properties to track their own visitors, leads, and customers ("Customer End User Data"). Our customers, not LeadJourney, decide what data is collected and for what purpose. We process this data only according to the customer’s instructions and solely to provide the tracking, attribution, and reporting features they have configured. We do not sell this data, use it for our own marketing, or share it except with the sub-processors listed in Section 8.

• Directly from you: when you fill in a form, sign up for an account, book a demo, contact support, or subscribe to communications.
• Automatically: when you visit our website, based on your consent settings. See our Cookie Policy for details.
• Via advertising pixels: when you interact with our ads on Meta, Google, LinkedIn, Microsoft, X (Twitter), or Reddit, those platforms may share event data with us under your consent and their respective data policies.
• From your use of the platform: usage data, integration activity, and configuration data generated as you use the service.
• From third-party sources: we may receive limited business contact information from trusted data providers who have obtained appropriate legal bases for sharing it.

We use your personal data for the following purposes, each with a legal basis under Art. 6 GDPR:

We may use anonymised or aggregated data to improve our services and produce usage reports or benchmarks. Customer data submitted to the platform is never used to train models or improve services for other customers.

• Website analytics: up to 14 months.
• Advertising pixel data: governed by the respective ad platform’s data retention policies. Conversion data we receive from these platforms is retained for up to 24 months.
• Leads and demo requests that do not convert: up to 24 months, then deleted or anonymised.
• Customer account data: for the duration of the contract, then deleted, except records required for tax and accounting purposes (typically up to 10 years under applicable law).
• Customer End User Data (processor role): kept according to the customer’s configuration and deleted upon request or at contract end, within 60 days.

If you request deletion of your personal data, or if your data is no longer necessary for the purpose it was collected, we will erase it from our systems within a reasonable timeframe.

LeadJourney works with a carefully selected set of third-party providers to deliver our services and run our marketing. The table below lists all providers who may process personal data on our behalf:

These providers may only access personal data to the extent necessary to perform their specific function on our behalf. We do not sell personal data to third parties. Advertising pixels are only activated based on your cookie consent.

When you connect your own advertising accounts (Meta, Google, LinkedIn, Microsoft) to LeadJourney, data is also exchanged with those platforms under your own agreements and on your instruction.

All production data is hosted within the European Economic Area (EEA) on DigitalOcean infrastructure in Frankfurt, Germany. No personal data is transferred outside the EEA by default.

Some sub-processors listed in Section 8 are headquartered outside the EEA (e.g. in the United States). Where personal data is transferred to such providers, we ensure an adequate level of protection through Standard Contractual Clauses (SCCs) as adopted by the European Commission pursuant to Art. 46 GDPR, or another applicable lawful transfer mechanism.

• AES-256 encryption of data at rest; TLS 1.2+ encryption of all data in transit
• Role-based access controls on a least-privilege basis
• Two-factor authentication (2FA) for platform access
• Audited access to production systems
• Regular backups and infrastructure redundancy
• Signed webhooks with HMAC to prevent unauthorised data injection
• Regular review of security measures and requirements imposed on sub-processors

While we apply industry-standard protections, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute data security.

• Right of access (Art. 15): Receive confirmation of whether we process your data and obtain a copy.
• Right to rectification (Art. 16): Have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17): Request deletion of your data where no overriding legal basis exists.
• Right to restriction (Art. 18): Request that we limit processing in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time (including via the cookie banner for advertising pixels) without affecting prior processing.

To exercise any of these rights, email [email protected]. We will respond within one calendar month. See our Data Subject Rights Policy for full details of our process.

If your data reached us through a LeadJourney customer’s account (where we act as processor), we will forward your request to the relevant customer, who is the controller.

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with a supervisory authority. As a Cyprus-registered company, our lead supervisory authority is:

You may also contact the supervisory authority in your country of residence.

Our website uses cookies and similar technologies. Our Cookie Policy lists every cookie and tool we use and explains how to manage your preferences. You can adjust your cookie settings at any time via the consent banner on our website. Advertising pixels (Section 8) are only activated after you grant consent. Refusing certain cookies may limit some features of the service.

If you process personal data through the LeadJourney platform, we make a Data Processing Agreement (DPA) available that meets the requirements of Art. 28 GDPR. It covers our role as your processor, the sub-processors listed in Section 8, the security measures we apply, and how we assist you with data subject requests. To request a DPA, contact us at [email protected].

This policy covers only LeadJourney’s own collection and handling of personal data. We only work with partners and sub-processors whose privacy and security standards align with ours, but we cannot accept responsibility for their independent privacy practices.

Our website may contain links to external sites not operated by us. We have no control over the content or policies of those sites and cannot accept responsibility for their privacy practices.

We may update this policy to reflect changes in our practices, sub-processors, or applicable law. The "last updated" date at the top always reflects the current version. For significant changes affecting customers or their data subjects, we will provide reasonable prior notice.

LeadJourney Ltd. · HE485008 · Artemidos 6, 6030 Larnaca, Cyprus · [email protected] · Version 1.1