Skip to content
AI Lead Tracker: see which leads come from ChatGPT, Perplexity and Gemini

Data Processing Addendum

How we process visitor and lead data on your behalf, in line with GDPR Article 28. Part of our terms on every plan.

Last updated October 31, 2026

On this page
  1. 1. Scope
  2. 2. Details of the processing
  3. 3. Our obligations
  4. 4. Subprocessors
  5. 5. International transfers
  6. 6. Your obligations
  7. 7. Contact
All policies

1. Scope

This Data Processing Addendum ("DPA") forms part of the Terms of service between you (the "customer", controller) and HeyLead Attribution ("we", "us") (processor). It applies to personal data about visitors to your websites and people who submit your forms ("Customer Personal Data"). By accepting the Terms you accept this DPA. No signature is needed, but we can provide a signed copy on request.

2. Details of the processing

Subject matterRecording the marketing source of visits and leads on the customer's websites
DurationThe term of the subscription, plus up to 90 days after it ends, then deletion
Data subjectsVisitors to the customer's websites and people who submit its forms
Personal dataVisitor and visit IDs, pages viewed, referrers, UTM tags and click IDs, device type, country, and form answers (such as name, email, phone and message)
Special categoriesNone. The customer must not collect them through tracked forms
PurposeProviding the service to the customer only

3. Our obligations

We will:

  • Process Customer Personal Data only on your documented instructions, which are these terms and how you configure the service, and tell you if we think an instruction breaks the law.
  • Make sure everyone who can access the data is bound by confidentiality.
  • Apply the technical and organisational measures described on our Security page.
  • Help you respond to data subject requests and with security, impact assessments and consultations, taking into account the nature of the processing.
  • Notify you without undue delay after becoming aware of a personal data breach.
  • At the end of the service, delete Customer Personal Data within 90 days (backups within a further 30 days), unless the law requires us to keep it. You can export it before then.
  • Make available the information needed to show we comply with this DPA, and allow reasonable audits, normally by providing documentation and independent reports from our providers.

4. Subprocessors

You authorise us to use the subprocessors listed on our Subprocessors page. We impose data protection terms on each of them that are at least as protective as this DPA and remain responsible for them. We'll update that page at least 30 days before adding or replacing a subprocessor; you may object on reasonable grounds, and if we can't resolve it you may cancel.

5. International transfers

Where Customer Personal Data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), which we and our subprocessors put in place.

6. Your obligations

You are responsible for having a lawful basis to collect Customer Personal Data, for your privacy notice, and for obtaining consent where required (for example by using consent mode).

7. Contact

Email hello@heylead.io. We reply within one business day.