Data Processing Agreement (DPA / AVV)

Version 2026-11-13

Template with placeholder company details. Have it reviewed by a lawyer before launch.

This Data Processing Agreement ("DPA") forms part of the agreement between LeadGiva Technologies Pvt. Ltd. ("Processor", "LeadGiva") and the business customer using LeadGiva ("Controller"). It applies where LeadGiva processes personal data on behalf of the Controller under Art. 28 GDPR. It takes effect when the Controller accepts the Terms or requests a signed copy.

Need a signed copy? Email privacy@leadgiva.example with your company name and address.

1. Subject, duration, nature and purpose

Subject: providing the LeadGiva service — business searches, storing search history and results, filtering and exports.
Duration: as long as the Controller's account exists.
Nature and purpose: storing, organising, retrieving, exporting and deleting data, only to provide the service.
Types of data: account users' contact data (name, email, phone); business contact data in search results (business name, address, phone, website, ratings), which may relate to identifiable persons such as sole traders.
Data subjects: the Controller's users; persons connected to listed businesses.

2. Processor obligations

The Processor shall:

process personal data only on the Controller's documented instructions, including regarding transfers to third countries (Art. 28(3)(a));
ensure that persons authorised to process the data are bound by confidentiality (Art. 28(3)(b));
take the security measures described in section 5 (Art. 32);
engage sub-processors only as described in section 4 (Art. 28(2) and (4));
assist the Controller in answering data subject requests (Art. 28(3)(e)) and with security, breach notification, impact assessments and consultations (Art. 32–36);
notify the Controller of a personal data breach without undue delay, and where possible within 48 hours of becoming aware of it;
at the end of the service, delete or return all personal data, at the Controller's choice, unless law requires storage (Art. 28(3)(g));
make available the information needed to demonstrate compliance and allow for audits, including inspections, by the Controller or an auditor it appoints (Art. 28(3)(h)).

3. Controller obligations

The Controller is responsible for the lawfulness of its own processing, in particular for having a legal basis when contacting businesses found with LeadGiva, and for complying with marketing laws (for example rules on cold calls and emails).

4. Sub-processors

The Controller gives general authorisation for the sub-processors below. The Processor informs the Controller of intended changes at least 30 days in advance (by email or on this page); the Controller may object for good reason. The Processor imposes the same data protection obligations on each sub-processor.

Cloud hosting (servers, database, cache)
Maps data and website analytics
Payment processing
Messaging and email delivery (one-time codes, service emails)

The full list with names and locations is available to customers after signing in, or on request at privacy@leadgiva.example.

Transfers outside the EU/EEA are based on EU Standard Contractual Clauses (Art. 46 GDPR) or an adequacy decision.

5. Technical and organisational measures (TOMs)

Encryption: HTTPS/TLS for all traffic; email addresses encrypted in the database; passwords stored only as hashes.
Access control: role-based access (user / admin); each customer sees only its own data (tenant separation).
Authentication: short-lived access tokens with rotating refresh tokens; login rate limiting against brute force.
Availability: managed cloud hosting with provider backups.
Data minimisation: only data needed for the service is stored; payment card data is never stored by LeadGiva.
Deletion: users can delete searches; accounts are deleted on request.

6. Liability and precedence

Liability follows the main agreement and Art. 82 GDPR. If this DPA conflicts with other terms regarding data protection, this DPA prevails.