Privacy Policy

Non-binding convenience translation: The German version is authoritative. This English translation is provided for information only; the German version prevails in any discrepancy.

Controller within the meaning of the GDPR: Workbase Platforms Sp. z o.o. Franz-Joseph-Str. 11 Munich, Germany Email: legal@leadbase.io Represented by Managing Director: Nils Kröger VAT identification number: PL8992989402 Statistical identification number: 52819974800000 Commercial register entry: 0001096902 D-U-N-S number: 664903637 Data Protection Officer: For questions about data protection, exercising your rights, or complaints, you can contact our Data Protection Officer at: Email: privacy@leadbase.io Post: Data Protection Officer, Franz-Joseph-Str. 11, 80801 Munich, Germany EU establishment: As a Polish company offering services in the EU, we have an EU establishment in Germany at Franz-Joseph-Str. 11, Munich, Germany.

Scope and Fundamental Principles of Data Processing

This Privacy Policy explains how personal data is processed when you use our B2B data-enrichment platform, “Leadbase.” It applies to all services, APIs, integrations, and related services. Our data protection principles:

Lawfulness: Processing only on the basis of a valid legal ground
Purpose limitation: Data is processed only for specified, explicit purposes
Data minimization: Only necessary data is collected and processed
Accuracy: Appropriate measures ensure data accuracy
Storage limitation: Data is deleted once retention periods expire
Integrity and confidentiality: Technical and organizational safeguards
Accountability: Demonstrable compliance with all data protection principles

Categories of Personal Data and Data Sources

We process different categories of personal data obtained from a range of sources:

Customer Data (Provided by You)

Account data: Name, email address, phone number, and company information
Contract data: Billing information, payment data, and billing address
Technical data: IP address, browser information, and device identifiers
Usage data: Login times, feature usage, API calls, and search history
Communications data: Support requests, email correspondence, and chat messages
Upload data: Lists and contact data that you upload for enrichment

Lead Data (for Enrichment Services)

Business contacts: Names, positions, email addresses, and phone numbers
Company data: Company names, addresses, industries, employee counts, and revenue
Social-media profiles: LinkedIn, XING, and other professional networks
Website data: Company URLs, technology stack, and online presence

Automatically Collected Data

Log data: Server logs, error logs, and performance metrics
Analytics data: Page views, clickstreams, dwell time, and conversion events
Security data: Failed login attempts and suspicious activities
Cookie data: Preferences, session management, and tracking parameters

We process your personal data exclusively on the following legal bases under Article 6 GDPR:

Marketing communications and newsletters
Non-essential cookies and tracking
Beta-feature testing and product feedback
Additional analytics and personalization

Account creation and management
Service provision and lead enrichment
API access and technical integration support
Customer support and technical assistance
Billing and payment processing

IT security and fraud prevention
Service improvement and quality assurance
Internal analytics and business intelligence
Legal compliance and audit purposes
Direct marketing in existing business relationships

Tax-law retention obligations (10 years)
Commercial-law documentation obligations
Anti-money-laundering compliance (KYC/AML)
Official information requests supported by a legal basis

Detailed Purposes of Data Processing

Service Provision and Operation

Authentication and account management
Lead data enrichment and handoff through APIs or CSV export
API provision and rate limiting
Webhook processing and real-time updates
Data exports and reporting functions
Usage tracking for billing purposes

Technical Operation and Maintenance

System monitoring and performance optimization
Error diagnosis and technical debugging
Security monitoring and incident response
Software updates and feature rollouts
Backup and disaster recovery

Compliance and Legal Requirements

GDPR compliance and data-subject rights
Audit trails and compliance reporting
Tax and commercial-law documentation
Anti-spam and anti-fraud measures
Enforcement in the event of contractual breaches

Business Intelligence and Product Development

Aggregated analytics and usage statistics
A/B testing and feature evaluation
Product improvement and roadmap planning
Market research and competitive intelligence
Customer success and churn prevention

Disclosures to Third Parties and International Transfers

Service	Role in the current product
Cloudflare	Application and background processing, data transmission, file storage, AI gateway and transactional email
PlanetScale	Customer and workspace database
OpenAI	AI assistance and research; task instructions and necessary context are sent for model processing
Stripe	Subscriptions, payments, invoices and the payment portal
Treg and task-specific data providers	Routing research and data requests; search queries and necessary identifiers may be forwarded to the executing provider depending on the selected tool

Contact lookups can involve AI Ark, Apollo, Enrich.so, LeadMagic and Prospeo, depending on the tool selected and the providers needed to fulfil the request. Each recipient’s data-protection role follows the specific processing: data suppliers and payment services may act in roles other than processor. Contact privacy@leadbase.io for details about recipients, subprocessors and the relevant contractual documentation.

Your private customer data stays separate from our public lead data offering and is not offered for sale as public lead data. To complete your tasks, we share necessary inputs with the infrastructure, AI and data providers involved. Share only the context the task requires. Depending on the service and agreed processing, data may be stored or processed in the EU or other countries. The safeguards for international transfers are described below.

International Data Transfers

Some of our processors have locations outside the EU. The following safeguards apply to those transfers:

USA: EU-U.S. Data Privacy Framework for appropriately certified recipients under an applicable adequacy decision; otherwise appropriate safeguards under GDPR Chapter V
Other third countries: EU Standard Contractual Clauses (SCCs) under Article 46 GDPR
Additional safeguards: Encryption, pseudonymization, and data minimization
Regular assessment: Continuous monitoring of the level of data protection

Disclosure to Public Authorities

Personal data is disclosed to law-enforcement authorities or other public bodies only where there is a corresponding legal basis, such as a court order or official directive.

Retention Periods and Deletion Policy

We process customer data to provide your selected services for the agreed purposes. After a paid subscription ends, your account and workspace remain available with any remaining free credits. You can request account or data deletion separately through privacy@leadbase.io.

For data return or deletion, contact privacy@leadbase.io. We confirm your authority and the requested scope, arrange the return or justified deletion, and explain the outcome and any required retention. When Leadbase acts as processor, we follow your choice and documented instructions under GDPR Article 28(3)(g), subject to statutory storage requirements. Support assists with your contractual return and transition rights.

You can restore archived Sheets within 30 days; after that, they become eligible for permanent cleanup. Account data, billing records, backups, cache and research evidence follow the retention and cleanup rules for their respective category and purpose. Financial records and necessary evidence are retained for the applicable statutory periods. Your statutory deletion rights and our deletion obligations remain unaffected.

As a data subject, you have the following rights, which you may exercise at any time by contacting privacy@leadbase.io:

Confirmation of whether we process data concerning you
Information about categories, purposes, recipients, and retention periods
Information about your rights and complaint options
A copy of the processed data (first copy free of charge)
Processing time: Without undue delay, generally within one month of receipt under GDPR Article 12(3); permitted extensions and reasons are communicated within that month

Correction of inaccurate personal data
Completion of incomplete data
Automatic forwarding of corrections to recipients
Processing time: Without undue delay within the statutory period, generally within one month of receipt

Right to Erasure / “Right to Be Forgotten” (Article 17 GDPR):

Erasure when the purpose of processing no longer applies
Withdrawal of consent where there is no other legal basis
Objection to processing where there are no overriding interests
Exceptions: Statutory retention obligations remain unaffected
Technically secure deletion with confirmation

Blocking while the accuracy of data is disputed
Restriction in the event of unlawful processing
Retention for legal claims despite an obligation to erase
Marking and isolation of the affected data

Export in a structured, machine-readable format (JSON, CSV)
Applies only to data processed on the basis of consent or a contract
Direct transfer to another controller where possible
Free provision through secure download links

Objection to processing based on legitimate interests
Absolute right to object to direct marketing
Objection to profiling and automated decision-making
Assessment of overriding legitimate grounds

Withdrawal is possible at any time without stating reasons
Simple withdrawal methods such as unsubscribe links and account settings
The lawfulness of processing carried out before withdrawal remains unaffected
Information about withdrawal options whenever consent is requested

Procedure for exercising your rights: Requests may be submitted informally by email to privacy@leadbase.io. Where there are reasonable doubts about your identity, we may request necessary additional information. An ID document is not a general prerequisite; send one only if specifically requested and redact unnecessary details. We acknowledge receipt within 48 hours and process requests within the statutory time limits.

Comprehensive Technical and Organizational Measures (TOMs)

We have implemented extensive technical and organizational measures to ensure the security and protection of personal data:

Technical Security Measures

Encryption: TLS 1.3 for data in transit and AES-256 for data at rest
Authentication: Multi-factor authentication for all administrator accounts
Access control: Role-based authorization under the least-privilege principle
Network security: Firewalls, VPN access, and intrusion-detection systems
Monitoring: 24/7 Security Operations Center (SOC) with real-time alerts
Backup: Encrypted, geographically distributed backups with regular testing
Endpoint protection: Anti-malware, device management, and remote wipe

Organizational Safeguards

Employee training: Regular GDPR and security-awareness training
Access management: Documented authorization concepts and regular reviews
Confidentiality commitments: For all employees and service providers
Incident response: Documented processes for data breaches and security incidents
Compliance management: Regular internal and external audits
Data governance: Clear responsibilities and approval processes

Physical Security

High-security data centers with biometric access controls
24/7 physical monitoring and security personnel
Climate control, fire protection, and uninterruptible power supply
Clean-desk policy and secure storage of physical documents

Data Protection by Design (Privacy by Design)

Data minimization incorporated into system design
Privacy-friendly settings by default
Pseudonymization and anonymization where possible
Regular Privacy Impact Assessments (PIAs)

Cookies and Tracking Technologies

Manage optional cookie categories through the preferences in the footer. The Cookie Policy lists the storage used, its purpose and retention. Necessary sign-in and security storage supports the functions you request; optional analytics and marketing categories are managed separately.

Automated Decision-Making and Profiling

Leadbase uses limited automated processing, but it does not result in decisions producing legal effects:

Fraud Detection and Security

Automatic detection of suspicious login attempts
Rate limiting in the event of API misuse
Spam filters for support requests
No legally binding decisions: There is always a manual review

Service Optimization

Personalization of the user interface based on usage patterns
Recommendations for relevant features and integrations
Automated data-quality checks and improvements
A/B testing for feature rollouts

Lead Scoring and Data Enrichment

Algorithms for assessing data quality and lead relevance
Automated data validation and duplicate checks
Matching algorithms for researched contact and company data; customers retain control over final decisions at all times

Your rights: You have the right not to be subject to a decision based solely on automated processing (Article 22 GDPR). Because our systems do not make legally significant automated decisions, this right is not applicable at Leadbase. If you have questions, contact privacy@leadbase.io.

Children's Privacy

No services for persons under 16: Leadbase is a B2B platform intended exclusively for business customers and professional users. Our services are not intended for persons under 16, and we do not knowingly collect personal data from children.

Procedure for inadvertently collected data:

Immediate deletion upon learning that a child's data has been collected
Notification of the parents or legal guardians
Review and adjustment of preventive measures
Documentation for compliance purposes

Parental responsibility: If a child has inadvertently created an account, we ask the parent or legal guardian to contact us immediately at privacy@leadbase.io. We will delete the account and all related data without undue delay.

Data Breaches and Incident Response

Data breaches may occur despite comprehensive security measures. We have established detailed processes for handling security incidents:

Incident Response Process

Detection: Automated monitoring systems and manual monitoring
Assessment: Evaluation of severity and affected data
Containment: Immediate containment to limit harm
Investigation: Forensic analysis and root-cause investigation
Remediation: Resolution of vulnerabilities and system hardening
Communication: Notification of all stakeholders in accordance with legal requirements

Supervisory authority: Notification to the competent data protection authority within 72 hours
Data subjects: Notification where there is a high risk to rights and freedoms
Customers: Notification of all affected business customers
Public: Transparent communication in the event of major incidents

Preventive Measures

Regular penetration tests and vulnerability scans
Security-awareness training for all employees
Incident-response exercises and tabletop exercises
Continuous improvement of security measures

Reporting security incidents: If you suspect a security incident or potential data breach, contact us immediately at security@leadbase.io. We take every report seriously and investigate each case thoroughly.

Complaint Rights and Supervisory Authorities

You have the right to lodge complaints about the processing of your personal data with the competent supervisory authorities:

Competent Supervisory Authorities

Germany (establishment): Bavarian State Office for Data Protection Supervision, Promenade 18, Ansbach, Email: poststelle@lda.bayern.de, Phone: +49 (0) 981 53-1300
Poland (head office): Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland, Email: kancelaria@uodo.gov.pl, Phone: +48 22 531 03 00

Your Complaint Process

1. Direct contact: First contact privacy@leadbase.io
2. Internal escalation: If dissatisfied, escalate to the Data Protection Officer
3. Supervisory authority: Lodge a complaint with the competent data protection authority
4. Judicial remedy: Bring an action before the ordinary courts

International Complaints

EU citizens may also contact the data protection authority in their country of residence. It will cooperate with the lead supervisory authority through the one-stop-shop procedure.

Changes to This Privacy Policy

Amendment Procedure

This Privacy Policy may be amended due to legal changes, new services, or improved data-protection practices:

Material changes: Email notice 30 days before they take effect
Minor changes: Website update with a notice
Emergency updates: Immediate adjustment where required by law
Version control: All changes recorded with a date and change log

Right to Object to Changes

You may object to continued data processing in the event of material changes. In that case, we may terminate your account in compliance with the applicable notice periods. Your data will then be removed in accordance with the deletion provisions.

Archiving Earlier Versions

We archive earlier versions of this Privacy Policy for 10 years for compliance documentation. Upon request, we can tell you which version was effective at a particular time.

Contact and Further Information

Privacy Contact

For all privacy-related inquiries, complaints, or exercises of your data-subject rights:

Email: privacy@leadbase.io (response within 48 hours)
Post: Data Protection Officer, Franz-Joseph-Str. 11, 80801 Munich
Encryption: PGP key available on request

Additional Privacy Resources

Cookie Policy: Detailed information about all cookies used
Processor List: Complete list of all processors
DPA templates: Sample data processing agreements for enterprise customers
Privacy Portal: Self-service portal for common privacy requests

Industry-Specific Compliance

For customers in regulated sectors (financial services, healthcare, and the public sector), we provide additional compliance documentation. Contact our compliance team at compliance@leadbase.io.