Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

The responsible entity is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

Supervisory authority: Office of the Commissioner for Personal Data Protection (Cyprus)

This Privacy Policy applies to all Leadmatix websites and services. We act in different roles:

The following overview summarizes the types of data processed and the purposes of their processing:

Categories of personal data

• Account and contract data (e.g. names, email, company data)
• Communication data (e.g. inquiries, support tickets)
• Payment and billing data (via Stripe, we do not store card details)
• Content and analytics data (URLs, page content, comments)
• Usage, device, and telemetry data (IP, browser, session data)
• Marketing communication (optional)

Categories of data subjects

• Business and contractual partners
• Prospects
• Communication partners
• Customers (B2B)
• Users (e.g. website visitors, users of online services)

Purposes of processing

• Provision of our online offering and user-friendliness
• Contact requests and communication
• Security measures
• Reach measurement and analysis
• Contractual services and customer service
• Administration and response to inquiries

Below you will find an overview of the legal bases under the GDPR on which we process personal data:

• Consent (Art. 6 (1) (a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of contract and pre-contractual inquiries (Art. 6 (1) (b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps prior to entering into a contract.
• Legal obligation (Art. 6 (1) (c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 (1) (f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Leadmatix uses AI technologies to improve our services. The following principles apply:

• No training of public models: Customer-specific content is not used to train public AI models.
• Pseudonymization: For internal quality purposes, data is only used in pseudonymized or aggregated form.
• No automated individual decisions: No decisions with legal consequences under Art. 22 GDPR are made without human review.
• Subprocessors: AI providers are contractually bound and subject to the EU Standard Contractual Clauses.

In accordance with statutory requirements and taking into account the state of the art, we implement appropriate technical and organizational measures in line with Art. 32 GDPR:

• Role-based access controls
• Encryption (SSL/TLS for data transmission)
• Least-privilege principle
• Secure secret management
• Network segmentation
• Logging and monitoring
• Regular backups
• Vendor assessments

SSL/TLS encryption: This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the change from "http://" to "https://" in the browser address bar and the lock icon in your browser line.

In the course of our processing of personal data, data is transferred to the following categories of recipients:

• Hosting, cloud, and CDN providers
• Email services
• Stripe (independent controller for payment data)
• AI and technology providers
• Support and success tools
• Consulting and tax advisors

If we process data in a third country (i.e., outside the European Union (EU) or European Economic Area (EEA)), this is only done in compliance with statutory requirements.

We use EU Standard Contractual Clauses (SCC) and additional security measures for third-country transfers. Transfer Impact Assessments are carried out where required.

The data we process is deleted in accordance with statutory requirements as soon as the consents permitting processing are withdrawn or other authorizations cease to apply.

Retention periods

• Contract data: Contract term plus statutory retention obligations
• Analytics/content: Until deleted by the user or account termination
• Logs/telemetry: 90–365 days
• 10 years: Commercial and tax retention obligation (§ 257 HGB, § 147 AO)
• 6 years: Commercial letters and business documents (§ 257 HGB)
• 3 years: Standard limitation period for civil claims

As a data subject, you have various rights under the GDPR:

• Right of access (Art. 15 GDPR): You have the right to obtain information about the data stored concerning you.
• Right to rectification (Art. 16 GDPR): You have the right to have inaccurate data corrected.
• Right to erasure (Art. 17 GDPR): You have the right to have your data erased.
• Right to restriction (Art. 18 GDPR): You have the right to restrict processing.
• Right to data portability (Art. 20 GDPR): You have the right to receive your data in a machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object to processing.
• Right to withdraw consent (Art. 7 (3) GDPR): You have the right to withdraw consent at any time.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work, or place of the alleged infringement. You may also contact the Cypriot supervisory authority or any other EU supervisory authority.

Cookies are small text files that are stored on your device.

Strictly necessary cookies

These cookies are strictly necessary for the operation of the site and are set without consent. For example, they enable security-related functionality such as session management.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest) and § 25 TDDDG

Non-essential cookies

All other cookies (analytics, marketing) require your consent under Art. 6 (1) (a) GDPR and § 25 TDDDG. Section 12 explains which services these are. You can withdraw your consent at any time via the “Cookie settings” link in the footer.

Affiliate tracking cookies

As part of our partner program we set two functional first-party cookies that are used to attribute referrals to our affiliate partners.

• lm_ref — Stores the referral token of the affiliate whose link you used to reach the site. Lifetime: 90 days. HTTPOnly, SameSite=Lax. Evaluated exclusively server-side to correctly attribute the commission on a later registration.
• lm_recruiter_ref — Stores the recruitment token if you reached the partner program via a sub-affiliate link. Lifetime: 180 days. HTTPOnly, SameSite=Lax. Only evaluated when you enroll as an affiliate yourself in order to establish the tier-2 relationship.

Legal basis: Art. 6 (1) (b) GDPR (performance of affiliate-program contract) and Art. 6 (1) (f) GDPR (legitimate interest in correct commission accounting).

This section explains which analytics and marketing services we use, which data they process and how you can manage your consent.

Cookie banner and consent management

On your first visit we use our own cookie banner (no external consent tool) to ask whether you consent to the “Analytics” and “Marketing” categories. Without your consent only strictly necessary cookies are set. If we change the description of the categories materially, we ask again.

Data processed: Your choice (analytics yes/no, marketing yes/no), version of the consent texts, time, type of decision (banner or settings), language, a random identifier from your browser’s local storage, a truncated IP address (IPv4 without the last octet, IPv6 truncated to /48), the browser identifier (user agent) and, for signed-in users, the user ID. We also store your choice in the cookie lm_consent on leadmatix.io and all subdomains and in your browser’s local storage.

Purpose: Storing your decision and demonstrating consent (log consent_log, Art. 7 (1) GDPR).

Legal basis: Art. 6 (1) (c) GDPR (legal obligation to demonstrate consent) and § 25 (2) no. 2 TDDDG (strictly necessary to store your choice).

Withdrawal: You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page. On withdrawal we delete the affected cookies (_fbp, _fbc, lm_attr, ph_*) in your browser.

Product analytics with PostHog (EU)

We use PostHog to understand which pages and features are used and to find errors. The data is stored on servers in the EU (Frankfurt). With your consent to the “Analytics” category, PostHog sets cookies or local storage entries (ph_*), recognises your browser across visits and uses session recordings (input in form fields is masked) and short surveys. Without consent only reach measurement runs, without cookies and without storing anything on your device, without recognition across sessions and without these additional features. Regardless of consent, we record where on a page people click and how far they scroll (heatmaps) to improve the usability of our pages (legitimate interest under Art. 6(1)(f) GDPR). Only positions are recorded, no content and no input, and nothing is stored on your device. We remove secrets in addresses (e.g. password links) before sending.

Provider: PostHog Inc., 2261 Market St., San Francisco, CA 94114, USA, with data storage in the EU (processing on our behalf under Art. 28 GDPR).

Data processed: Pages visited and referrer, clicks and interactions including click and scroll positions (heatmaps), device and browser information, approximate location (country/city derived from the IP address), with consent a pseudonymous identifier, session recordings and survey answers; for signed-in users the user ID and email address.

Legal basis: With consent Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. We base cookieless measurement without consent on Art. 6 (1) (f) GDPR (legitimate interest in data-minimising reach measurement and error analysis).

Third-country transfer: Data is stored in the EU. Access by the US provider (e.g. for support) cannot be ruled out; it is safeguarded by the EU Standard Contractual Clauses.

Storage duration: Cookies ph_* up to 12 months; event data and session recordings according to the retention periods of our PostHog project.

Meta Pixel and Meta Conversions API

We run ads on Facebook and Instagram. To measure whether these ads lead to sign-ups and purchases, and to optimise them, we use the Meta Pixel and the Meta Conversions API with your consent to the “Marketing” category. The Meta Pixel loads a script from Meta, sets the cookies _fbp and _fbc and sends page views and events (e.g. viewing a lesson, signing up) directly from your browser to Meta. Via the Conversions API we additionally report sign-ups and purchases from our server to Meta so that Meta can merge both reports. The pixel does not run on pages whose address contains a secret (e.g. password links).

Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. We are jointly responsible with Meta for collecting and transmitting data via the pixel (Art. 26 GDPR); Meta alone is responsible for further processing.

Data processed: Pixel: address visited and referrer, events, IP address, browser and device information, cookie identifiers _fbp/_fbc. Conversions API: event (sign-up, purchase) with time, value and currency, hashed email address, hashed first name, pseudonymous user ID, IP address, browser identifier (user agent), click ID (fbclid or _fbc) and _fbp.

Purpose: Measuring the success of and optimising our ads on Facebook and Instagram, building audiences for ads.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). Without consent the pixel is not loaded and no data is sent to Meta via the Conversions API.

Third-country transfer: Meta may transfer data to Meta Platforms Inc. in the USA. Meta is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission); the EU Standard Contractual Clauses apply in addition.

Storage duration: Cookies _fbp and _fbc 90 days. Meta deletes the data stored with Meta according to its own retention periods (see Meta’s privacy policy).

Withdrawal: Via “Cookie settings” in the footer. After that the pixel no longer loads, we delete _fbp, _fbc and lm_attr in your browser, and reports not yet sent are no longer sent to Meta.

Google tag and Google Ads conversion measurement

We run ads on Google (Search, YouTube, partner sites). To measure whether these ads lead to sign-ups and purchases, and to optimise them, we use the Google tag (gtag.js) for Google Ads with your consent to the “Marketing” category. The Google tag loads a script from Google, sets the cookies _gcl_au and _gcl_aw (for ads on iOS possibly _gcl_gb), creates the entry _gcl_ls in your browser’s local storage and sends page views and events such as sign-ups directly from your browser to Google. If you reach us via a Google ad, the address also contains a click ID (gclid, gbraid or wbraid). With this click ID and your hashed email address we additionally report sign-ups, later steps and purchases from our server to Google (Google Data Manager API) so that Google can merge both reports. We use Google’s Consent Mode in basic mode: without consent the Google tag is not loaded at all. The Google tag does not run on pages whose address contains a secret (e.g. password links).

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processed: Google tag: address visited and referrer, events, IP address, browser and device information, identifiers from the _gcl_* cookies and local storage. Server-side report: click ID (gclid, gbraid or wbraid), hashed email address, type of conversion (e.g. sign-up, purchase), time, value and currency and an internal event ID.

Purpose: Measuring the success of and optimising our Google ads, building audiences for ads (remarketing).

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). Without consent the Google tag is not loaded and we report nothing to Google.

Third-country transfer: Google may transfer data to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses apply in addition.

Storage duration: Cookies _gcl_au, _gcl_aw and _gcl_gb and the storage entry _gcl_ls 90 days. Google deletes the data stored with Google according to its own retention periods (see Google’s privacy policy).

Withdrawal: Via “Cookie settings” in the footer. After that the Google tag no longer loads, we delete the _gcl_* cookies and storage entries in your browser, and reports not yet sent are no longer sent to Google.

Campaign attribution

So that we know which campaign brought you to us, we read campaign parameters from the address when you visit (UTM parameters, click IDs such as fbclid and gclid, landing page, referrer) and store them with your account when you register. Without consent to the “Marketing” category this information stays only in your browser’s session storage and in our system (first party) and is never transmitted to ad platforms. With consent we additionally store it in the cookie lm_attr on leadmatix.io and all subdomains so that attribution also works if you register later or on app.leadmatix.io.

Legal basis: For internal attribution without a cookie Art. 6 (1) (f) GDPR (legitimate interest in evaluating our campaigns); for the cookie lm_attr Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent).

Storage durations at a glance

• lm_consent: Cookie with your choice, 12 months. After that we ask again.
• lm_attr: Cookie with campaign parameters (only with marketing consent), 90 days; deleted on withdrawal.
• _fbp, _fbc: Meta Pixel cookies (only with marketing consent), 90 days; deleted on withdrawal.
• _gcl_au, _gcl_aw, _gcl_gb, _gcl_ls: Google tag cookies and local storage entry (only with marketing consent), 90 days; deleted on withdrawal.
• Conversion queue: We delete the IP address and browser identifier temporarily stored for the Conversions API after 30 days. The remaining conversion details stay stored with your account until it is deleted.
• consent_log: Log of your consent decisions, as long as we must be able to demonstrate consent, generally until the standard limitation period of 3 years has expired.

When you register for a customer account, the data you provide is stored and used for performance of the contract and customer support.

Legal basis: Art. 6 (1) (b) GDPR (performance of contract) and Art. 6 (1) (c) GDPR (legal obligation)

Electronic invoices are created and sent via Stripe Invoicing.

For German business customers we provide EN 16931 compliant e-invoices (Factur-X/ZUGFeRD) upon request.

Leadmatix is directed exclusively at businesses (B2B). We do not knowingly process personal data of minors. If we become aware that data of minors has been collected without parental consent, such data will be deleted without delay.

When using our SaaS platform Leadmatix for WhatsApp Business communication, the following data is processed:

Processed data

• Contact data of your end customers (name, phone number)
• Communication content (messages via WhatsApp)
• Platform usage data
• Log data for support and troubleshooting

Data processing on behalf

Where we process personal data on your behalf, we conclude a data processing agreement with you in accordance with Art. 28 GDPR. In this case, you act as the controller and we act as the processor.

WhatsApp Business API

WhatsApp communication is handled via the official WhatsApp Business API from Meta. Meta processes data in accordance with its own privacy policy. We recommend that you inform your end customers about the use of WhatsApp for business communication.

Sharing and invitation function

When you send invitations to team members or external users, you as the customer determine the recipients and are responsible for the appropriate legal basis. We process the email addresses for sending and access management. Invitations are logged.