Data processing agreement

1.1. This data processing agreement is an agreement between LeadBot B.V., registered with the Dutch Chamber of Commerce (KvK) under number 89992229 (‘LeadBot’), as processor, and every customer that uses the Service (‘Customer’), as controller.

1.2. This data processing agreement forms part of the terms and conditions and of every agreement between LeadBot and Customer about the Service. It applies from the moment Customer first uses the Service. If Customer uses the Service through a LeadBot partner, this data processing agreement applies directly between LeadBot and Customer.

1.3. This data processing agreement covers the personal data that LeadBot processes on behalf of Customer, as described in Annex 1. It does not cover data for which LeadBot is the controller itself, such as account data of Customer and its users, and company contacts. Our privacy policy applies to that data.

1.4. If this data processing agreement conflicts with the terms and conditions, this data processing agreement prevails as far as the processing of personal data is concerned.

Terms such as ‘personal data’, ‘processing’, ‘data subject’, ‘controller’, ‘processor’ and ‘personal data breach’ (data breach) have the meaning given in the General Data Protection Regulation (‘GDPR’). In addition:

• Service: the LeadBot software that Customer uses, such as the widget, chats, forms, the inbox and integrations.
• Sub-processor: another party LeadBot engages that processes Customer's personal data.
• Personal Data: the personal data LeadBot processes on behalf of Customer, as described in Annex 1.

3.1. LeadBot processes the Personal Data only to provide the Service to Customer and only on Customer's documented instructions. LeadBot does not use the Personal Data for its own purposes and does not sell it.

3.2. Customer gives its instructions by setting up and using the Service, for example by turning features on or off, connecting integrations or deleting data, and through this data processing agreement. Customer gives other instructions by email.

3.3. LeadBot may only process Personal Data outside these instructions if the law requires it. LeadBot will then inform Customer in advance, unless the law prohibits this.

3.4. If LeadBot believes an instruction infringes the GDPR or other data protection law, LeadBot informs Customer immediately. LeadBot may suspend carrying out that instruction until Customer has confirmed or changed it.

4.1. Customer is the controller for the Personal Data. Customer warrants that it (a) has a valid legal basis for the processing by LeadBot, (b) has obtained the consent the law requires for storing and reading data in visitors' browsers (Article 11.7a of the Dutch Telecommunications Act), for example for visitor analytics and company recognition, and (c) informs its visitors sufficiently about the processing by LeadBot in its own privacy policy.

4.2. Customer ensures the Service is not used to process special categories of personal data (such as health data) or data relating to criminal offences, unless Customer has its own legal basis for it and has informed LeadBot in advance.

4.3. If Customer connects the Service to third-party services, such as Shopify, Google Ads, Zapier, an AI assistant through MCP or its own webhook, Customer is responsible for its agreements with those third parties. Those services are not Sub-processors of LeadBot.

5.1. LeadBot keeps the Personal Data confidential. Only LeadBot staff who need access for their work get access. They are bound by confidentiality.

5.2. LeadBot does not share Personal Data with third parties, except with Sub-processors under section 7, on Customer's instructions, or when the law requires it.

6.1. LeadBot takes appropriate technical and organisational measures to protect the Personal Data against loss and unlawful processing, taking into account the state of the art, the costs and the risks (Article 32 GDPR). Annex 3 describes the measures.

6.2. LeadBot may change the measures, as long as the level of security does not decrease.

7.1. Customer gives LeadBot general authorisation to engage Sub-processors. The Sub-processors LeadBot currently uses are listed in Annex 2.

7.2. LeadBot informs Customer at least one month before a new Sub-processor or the replacement of a Sub-processor takes effect, by email or on this page. Customer may object, with reasons, within that month. If Customer does not object within that period, Customer consents to the change. If Customer does object, the parties will look for a reasonable alternative together; any extra costs of that alternative are for Customer. If the parties cannot resolve it together, Customer may terminate the agreement as of the date the change takes effect.

7.3. LeadBot imposes on every Sub-processor, in writing, at least the same obligations as set out in this data processing agreement. LeadBot remains responsible to Customer for its Sub-processors.

8.1. Some Sub-processors are based outside the European Economic Area (EEA), mainly in the United States. Annex 2 shows which ones.

8.2. LeadBot only transfers Personal Data outside the EEA when there is a valid basis under Chapter V of the GDPR, such as an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified companies) or the standard contractual clauses of the European Commission.

9.1. Customer can handle many data subject requests in the Service, such as viewing or deleting a chat or lead. This does not remove every copy. LeadBot helps with full deletion.

9.2. LeadBot helps Customer within a reasonable time with data subject requests that Customer cannot handle itself.

9.3. If LeadBot receives a request directly from a data subject, LeadBot forwards it to Customer as soon as possible and does not handle it itself, unless Customer asks it to.

10.1. LeadBot informs Customer without undue delay, and where possible within 48 hours after LeadBot discovers it, of a data breach involving the Personal Data.

10.2. LeadBot provides the information Customer needs to assess the breach and report it where required, and adds to it as more becomes known.

10.3. Customer decides whether the breach is reported. LeadBot does not report breaches involving the Personal Data to the supervisory authority or data subjects itself, unless the law requires LeadBot to.

11.1. LeadBot reasonably assists Customer with a data protection impact assessment (DPIA) and any prior consultation of the supervisory authority, as far as they concern the Service.

11.2. On request, LeadBot gives Customer the information needed to demonstrate that LeadBot complies with this data processing agreement.

11.3. If that information is not sufficient, Customer may have an audit carried out once a year by an independent expert bound by confidentiality. Customer announces the audit at least 30 days in advance. The audit disrupts LeadBot's operations as little as possible. Customer bears the costs of the audit.

12.1. This data processing agreement runs for as long as LeadBot processes Personal Data for Customer.

12.2. Until the agreement ends, Customer can delete the Personal Data itself in the Service, or ask LeadBot for an export.

12.3. After the agreement ends, LeadBot deletes the Personal Data within a reasonable period, unless the law requires LeadBot to keep it longer. Backups are deleted in the normal backup cycle. LeadBot confirms the deletion on request.

12.4. During the agreement, the retention periods in Annex 1 apply.

13.1. The parties' liability is governed by the terms and conditions, to the extent the GDPR allows.

13.2. By way of exception to article 13.1, Customer indemnifies LeadBot against claims by third parties, including data subjects, against enforcement action by supervisory authorities, and against all damage and losses resulting from them, to the extent they result from Customer's failure to comply with article 4.1.

14.1. LeadBot may change this data processing agreement when the Service or the law changes. For changes that are unfavourable to Customer, LeadBot informs Customer at least 30 days in advance. Changes never lower the level of protection the GDPR requires.

14.2. Dutch law applies to this data processing agreement. Disputes are submitted to the competent court in the Netherlands.

14.3. Questions about this data processing agreement? Email partners@leadbot.nl.

Data subjects

Visitors to Customer's websites, people who chat or fill in a form through the Service, and customers of Customer's web shop who ask about their order in the AI chat.

Personal data

• Widget: a visitor ID in the browser, IP address, browser and device, page, referring page and country.
• Chats and forms: the content, including what the visitor shares, such as name, email address and phone number.
• Visitor analytics (on by default): pages viewed, origin and ad identifiers.
• Company recognition (on by default while visitor analytics is on): IP address, browser, page and identifiers from marketing cookies already on the website. From forms, only company details and the email domain.
• Shopify: the order or tracking number and email address from the chat, and from Shopify the status, products and tracking link of that order.
• Google Ads: the campaign and keyword for an ad click.

Nature and purpose

Collecting, storing, showing and forwarding this data, so Customer can answer visitors' questions (also with an AI model), receive leads and gain insight into visits to its website, including which companies visit.

Terms for data from Shopify

• LeadBot only searches by the email address the web shop's customer gives, and only shows the order where the order or tracking number also matches.
• Through the integration, LeadBot also has access to name and address, but only uses the address to track a shipment with the carrier.
• LeadBot does not store order data separately. Only the reply stays in the conversation.
• LeadBot uses data from Shopify only for this, and does not sell or share it, except with Sub-processors.

Retention periods

LeadBot uses the following Sub-processors for the Personal Data:

• All connections are encrypted (https).
• Users only see the data of their own organisation.
• Login runs through WorkOS. LeadBot does not store access tokens of connected services itself.
• Only staff who need it for their work have access.
• Important actions in accounts are logged for 24 months.
• System passwords and keys are not in the source code.
• Page views, visitors who did nothing, company visits and the webhook log are deleted automatically after the periods in Annex 1.