Technical and Organisational Measures (TOMs)

All personal data processed under the DPA is hosted exclusively within the European Economic Area (EEA):

• Cloud infrastructure: DigitalOcean, LLC in Frankfurt, Germany (FRA1 region)
• All production data remains within the EU at all times, with no default transfers to third countries
• Infrastructure is provisioned and managed via infrastructure-as-code (IaC) to ensure consistent, auditable configuration
• DigitalOcean maintains SOC 2 Type II attestation and ISO 27001 certification for its Frankfurt data centres
• Physical access to data centre facilities is controlled by DigitalOcean under industry-standard physical security protocols including biometric access, 24/7 CCTV monitoring, and on-site security personnel

LeadJourney applies encryption at all stages of data processing:

• At rest: All personal data stored in LeadJourney databases and file storage is encrypted using AES-256 bit encryption.
• In transit: All data transmitted between clients and LeadJourney servers, and between internal services, is protected using Transport Layer Security (TLS 1.2 or higher). Unencrypted connections are rejected.
• Webhook payloads: Outbound webhook events are signed using HMAC (Hash-based Message Authentication Code) to ensure authenticity and integrity. Recipients can verify that payloads originate from LeadJourney and have not been tampered with.
• Backup encryption: Database backups are encrypted at rest using AES-256 and stored within the EEA.

Access to personal data is strictly controlled on the basis of the least-privilege and need-to-know principles:

• Role-based access control (RBAC) is implemented across all systems; each employee and service account is granted only the minimum permissions necessary for their role
• Two-factor authentication (2FA) is mandatory for all staff accessing production systems and the LeadJourney application
• Customer data is logically separated at the database level; no customer can access another customer’s data
• Access to production databases and infrastructure requires authentication through a secure, audited access mechanism; direct database access is prohibited for standard operations
• All access attempts, successful and unsuccessful, are logged and retained for audit purposes
• Access rights are reviewed regularly and revoked immediately upon termination of employment or change of role
• Shared or generic accounts are not permitted; each individual has a unique, identifiable account

• LeadJourney’s server-side tracking architecture is designed to minimise the collection of personal data at the point of ingestion; only data explicitly configured by the Controller is collected
• Visitor identifiers (click IDs, session tokens) are hashed and pseudonymised where technically feasible, reducing re-identification risk
• IP addresses are processed server-side and are not stored in plain text in analytics reports
• Personal data is not collected or retained beyond what is necessary for the purposes configured by the Controller

LeadJourney maintains measures to ensure the ongoing availability and resilience of its processing systems:

• Infrastructure is deployed across multiple DigitalOcean availability zones within the Frankfurt region to ensure redundancy
• Automated database backups are performed on a regular schedule and retained within the EEA; backup integrity is tested periodically
• Monitoring and alerting systems operate 24/7; automated alerts are triggered for infrastructure anomalies, error spikes, or availability issues
• Application error monitoring and log management is provided by Better Stack s.r.o. (Czech Republic, EU), which captures real-time error events without storing full personal data payloads
• Recovery procedures are documented and tested to ensure the ability to restore availability and access to personal data in a timely manner following a physical or technical incident
• Business continuity plans are maintained and reviewed annually

• All significant system events, including data access, modifications, deletions, authentication attempts, and administrative actions, are recorded in immutable audit logs
• Logs are retained for a minimum of 90 days and are accessible for security review and incident investigation
• System configurations are managed through version-controlled infrastructure-as-code; deviations from specified configurations are detected automatically
• Automated monitoring scans for anomalous activity, unauthorised access attempts, and service degradation continuously
• Separation of production and test environments is enforced; no real personal data is used in test or development environments without explicit anonymisation

• All employees with access to personal data receive data protection training at onboarding and at regular intervals thereafter
• All employees are bound by contractual confidentiality obligations that survive the termination of their employment
• A documented information security policy is in place; adherence is mandatory and subject to a formal disciplinary procedure
• A designated Data Protection Officer (Jonas Strambach, [email protected]) is responsible for overseeing compliance with data protection obligations
• Internal data processing activities are documented in a Record of Processing Activities (RoPA) maintained pursuant to Art. 30 GDPR
• Vendor assessments are conducted before engaging new sub-processors; sub-processors are required to maintain equivalent security standards

The transfer of personal data to sub-processors is only made where a corresponding Data Processing Agreement (DPA) or equivalent contractual instrument exists, and only for specified purposes. LeadJourney requires all sub-processors to:

• Implement technical and organisational measures equivalent to those described in this document
• Process personal data only on LeadJourney’s documented instructions
• Not engage further sub-processors without prior authorisation

Where personal data is transferred to sub-processors located outside the EEA (e.g. Stripe, Google, Mailtrap, Intercom, X Corp., Reddit), LeadJourney ensures adequate protection through Standard Contractual Clauses (SCCs) as adopted by the European Commission pursuant to Art. 46 GDPR, supplemented by transfer impact assessments where required.

• A documented incident response procedure is in place covering detection, containment, investigation, remediation, and notification
• All employees are required to report suspected security incidents immediately to the Data Protection Officer
• Personal data breaches are assessed without undue delay; where required under Art. 33/34 GDPR, the Controller is notified within 72 hours of the Processor becoming aware of the breach
• All personal data breaches are documented, including the facts, effects, and remedial action taken, regardless of whether notification to a supervisory authority is required

• Upon the Controller’s written request, LeadJourney can export customer data in machine-readable formats (e.g. CSV, JSON) for portability
• Upon termination of the DPA or the Controller’s written request, all personal data is permanently deleted from active databases within 60 days
• Deletion is cascading: records deleted from active databases are removed from backup systems as backups are rotated per the data retention policy
• LeadJourney can provide written confirmation of deletion upon request

• Technical and organisational measures are reviewed at least annually, or following any significant change to infrastructure, processing activities, or applicable law
• Vulnerability scanning and security assessments are conducted on a regular basis
• Third-party penetration testing is performed periodically; findings are remediated according to severity
• The effectiveness of these measures is monitored continuously through automated tooling and periodic manual review

LeadJourney Ltd. · HE485008 · Artemidos 6, 6030 Larnaca, Cyprus · [email protected] · TOMs Version 1.0