[et_pb_section fb_built=”1″ _builder_version=”4.16″ _module_preset=”default” locked=”off” global_colors_info=”{}”][et_pb_row _builder_version=”4.16″ _module_preset=”default” custom_padding=”0px||||false|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text admin_label=”Data Compliance Heading” _builder_version=”4.16″ _module_preset=”default” custom_margin=”||1em||false|false” global_colors_info=”{}”]<\/p>\n
[\/et_pb_text][et_pb_text admin_label=”Data Compliance” _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”||7px|||” inline_fonts=”Trebuchet” global_colors_info=”{}”]<\/p>\n
This FAQ has been created to support customer due diligence and make privacy, security and operational reviews easier. It provides a clear overview of Lead Forensics\u2019 approach and should be read alongside the applicable customer agreement, Data Processing Agreement, Privacy Notice, Technical and Organisational Measures, and any other agreed contractual documents.<\/p>\n
This document is provided for general information only. If anything in this FAQ differs from the signed agreement or Data Processing Agreement, the signed agreement and Data Processing Agreement will take priority.<\/p>\n
This FAQ helps customers and prospects understand how Lead Forensics handles privacy, security, and due diligence. It is intended to support procurement, privacy, legal, IT, risk and security reviews.<\/span><\/p>\n When Lead Forensics processes customer personal data through the SaaS platform, we act as a data processor. The customer acts as the data controller and decides how the service is used, including the lawful basis and any use of platform outputs.<\/span><\/p>\n Lead Forensics processes customer personal data in line with the customer\u2019s documented instructions and the applicable customer agreement and Data Processing Agreement.<\/span><\/p>\n Processing is governed by the customer agreement, Data Processing Agreement, platform configuration, support requests and other documented customer instructions. These documents cover key areas such as security commitments, sub-processors, international transfers, assistance obligations, deletion or return of data and assurance rights.<\/span><\/p>\n Customer-facing privacy and security materials are reviewed at least annually and whenever there are significant changes to services, systems, sub-processors, legal requirements or security controls.<\/span><\/p>\n When the Lead Forensics tracking code is deployed on a customer website, the service receives the IP address and standard technical request data generated by visits to that website.<\/span><\/p>\n Lead Forensics uses this data to identify business-level website visits by matching IP addresses against its proprietary business database. If a business match cannot be made with sufficient confidence, the data is handled in line with the applicable agreement, Data Processing Agreement and retention practices.<\/span><\/p>\n A search is carried out within a B2B database owned by Lead Forensics. If the IP address can be matched, the relevant business is shown in the customer portal.<\/span><\/p>\n If the IP address is not already in the database, Lead Forensics may attempt to identify the business. We do not collect or share consumer details such as home addresses, and sole traders are excluded.<\/span><\/p>\n IP addresses that cannot be matched are securely held during the validation process and then purged.<\/span><\/p>\n The customer portal may display firmographic information about the matched business, such as the business name, address, and phone number. This is business-level information and does not identify an individual website visitor.<\/span><\/p>\n Visitors may access customer websites from mobile devices, including smartphones and tablets. Lead Forensics cannot restrict this, but the matching process is designed to identify businesses, not individuals. The information presented is business-level insight.<\/span><\/p>\n Lead Forensics offers an optional Contact Data feature that can provide B2B contact information for individuals employed by matched businesses. This may include name, job title, LinkedIn profile, phone number and email address.<\/span><\/p>\n These contacts are not the individuals who visited the customer\u2019s website, as Lead Forensics does not identify individual website visitors.<\/span><\/p>\n Contact data is provided by approved third-party suppliers, which act as independent data controllers. Each contact record can be traced back to its original source to support transparency.<\/span><\/p>\n Customers using this feature are responsible for ensuring their use of the contact data complies with applicable data protection, electronic communications and calling rules. Lead Forensics acts as a processor, processing personal data on the customer\u2019s instruction under the Data Processing Agreement or an equivalent.<\/span><\/p>\n It isn\u2019t strictly required, but the Lead Forensics cookie can improve match rate. Details of the cookie are included in the Data Processing Agreement. For general information about cookies, see allaboutcookies.org.<\/span><\/p>\n The types of personal data processed depend on the customer\u2019s configuration, selected services and the applicable Data Processing Agreement. This may include business contact information, platform user data, website visit activity, technical identifiers, support information, employee account access data and CRM or integration data.<\/span><\/p>\n Lead Forensics processes customer personal data to provide, operate, secure and support the SaaS services selected by the customer. This can include secure platform access, lead identification functionality, business data matching or enrichment, customer settings and integrations.<\/span><\/p>\n No. Lead Forensics does not require or process special category personal data under Article 9 of the UK GDPR or EU GDPR to provide its services.<\/span><\/p>\n The customer, as controller, is responsible for identifying and documenting the lawful basis for its use of Lead Forensics and for providing appropriate transparency information to website visitors, prospects, customers, employees or other relevant individuals.<\/span><\/p>\n Lead Forensics does not determine whether legitimate interests or another lawful basis is appropriate for a customer\u2019s use case. Customers should document their own assessment within their privacy compliance framework.<\/span><\/p>\n The customer is responsible for configuring its websites, notices, consent mechanisms, opt-out processes and marketing activities in line with applicable data protection, privacy, marketing and electronic communications laws.<\/span><\/p>\n Lead Forensics supports customers by processing data in accordance with documented instructions and processor obligations.<\/span><\/p>\n Customers are responsible for ensuring their privacy notices accurately explain their own processing activities, including their use of Lead Forensics, the personal data processed, the lawful basis relied upon and any requirements that apply in their jurisdictions.<\/span><\/p>\n Lead Forensics does not provide legal advice or prescribed wording for privacy notices, cookie banners or terms of use. Customers should involve their legal or privacy teams where required.<\/span><\/p>\n Lead Forensics supports customers by processing customer personal data under a GDPR-compliant Data Processing Agreement, applying appropriate technical and organisational measures, managing relevant sub-processors, supporting rights requests where required and deleting or returning personal data in line with the contract.<\/span><\/p>\n For global privacy laws such as the CCPA\/CPRA, Lead Forensics processes customer personal data in accordance with the customer agreement, the Data Processing Agreement, and documented customer instructions. Customers remain responsible for how those laws apply to their own use of the services.<\/span><\/p>\n Lead Forensics maintains technical and organisational measures designed to protect customer personal data against unauthorised access, accidental loss, disclosure, alteration or destruction.<\/span><\/p>\n Controls may include role-based access, least privilege, authentication controls, encryption in transit, appropriate protection of data at rest, secure cloud infrastructure, logging, monitoring, vulnerability management, secure development practices, backup and recovery processes and incident response procedures.<\/span><\/p>\n Lead Forensics publishes Technical and Organisational Measures covering key security, privacy and operational controls used to protect customer personal data when providing the SaaS services. They are available via our Trust Centre.<\/span><\/p>\n Yes. Lead Forensics maintains an Information Security Management System (ISMS) to manage information security risks and protect confidentiality, integrity, and availability of customer data, company systems, and business operations.<\/span><\/p>\n The ISMS provides a structured framework for identifying risks, applying security controls, monitoring effectiveness and driving continual improvement.<\/span><\/p>\n Lead Forensics is certified to ISO\/IEC 27001, the internationally recognised standard for information security management systems. Lead Forensics is not currently SOC 2 certified.<\/span><\/p>\n Access is limited to authorised personnel who need it for legitimate business purposes such as service delivery, support, security, maintenance, troubleshooting or compliance. Access is role-based, reviewed periodically and removed when personnel change roles or leave.<\/span><\/p>\n Yes. Employees, contractors and authorised third parties who process customer personal data are subject to appropriate confidentiality obligations and must only access customer data where required for their role and in line with Lead Forensics policies.<\/span><\/p>\n Yes. Lead Forensics can support Single Sign-On for customers using an identity provider. When enabled, users are redirected to the customer\u2019s identity provider for authentication, including any MFA controls the customer has enabled.<\/span><\/p>\n Customers interested in SSO should speak with their Lead Forensics Sales or Customer Success representative to discuss availability, configuration and any applicable commercial terms.<\/span><\/p>\n Yes. Lead Forensics conducts security testing and vulnerability management activities appropriate to the SaaS service. Summaries of relevant assurance materials may be made available through the Trust Centre or under NDA, subject to security and confidentiality considerations.<\/span><\/p>\n Lead Forensics reviews and manages third-party libraries, components and suppliers based on risk. Controls may include dependency monitoring, vulnerability review, patching, supplier assessment, contractual safeguards and review of critical security updates.<\/span><\/p>\n Lead Forensics maintains procedures to identify, escalate, assess, investigate, contain, remediate and document security incidents.<\/span><\/p>\n If Lead Forensics becomes aware of a personal data breach affecting customer personal data processed as a processor, it will notify affected customers without undue delay, in accordance with contractual and legal requirements.<\/span><\/p>\n Lead Forensics will take reasonable steps to investigate and mitigate the effects of confirmed breaches. Where available, notifications may include the nature and timing of the incident, the affected data, affected individuals, likely consequences, remediation steps, recommended customer actions, and an appropriate contact point.<\/span><\/p>\n Yes. Backup data may be retained for resilience, recovery, security and business continuity purposes. Backup data is subject to appropriate access controls and security measures and is overwritten or deleted through standard backup cycles.<\/span><\/p>\n Lead Forensics maintains appropriate resilience, business continuity and recovery processes for the SaaS service. Availability controls may include resilient infrastructure, monitoring, alerting, backup and recovery procedures, supplier governance, incident response, capacity planning and operational support.<\/span><\/p>\n Yes. Lead Forensics may use sub-processors to support the services, including hosting, storage, authentication and B2B contact data services. The current sub-processor list is available in the Data Processing Agreement between the parties. Applicable sub-processors may vary depending on services, region and contractual terms.<\/span><\/p>\n Before engaging relevant sub-processors, Lead Forensics assesses privacy, security, operational and compliance risks. This may include reviewing security controls, data protection terms, confidentiality obligations, international transfer mechanisms, certifications, resilience and suitability.<\/span><\/p>\n Where required by contract, Lead Forensics will notify customers of material sub-processor changes and provide an opportunity to object on reasonable grounds of data protection. Customers can subscribe to DPA and sub-processor update notifications at leadforensics.com\/dpa-update-notification\/.<\/span><\/p>\n Lead Forensics may process customer personal data in countries where its systems, or approved sub-processors, operate. Where restricted international transfers occur, Lead Forensics uses appropriate safeguards required by applicable data protection laws, such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum or other approved transfer mechanisms.<\/span><\/p>\n Lead Forensics retains customer personal data only for as long as necessary to provide the services, comply with customer instructions, meet contractual obligations, protect platform security, maintain backups, resolve disputes or satisfy legal requirements. Specific periods may vary by data type, product configuration and contract terms.<\/span><\/p>\n When the customer agreement ends, Lead Forensics will delete or return customer personal data in line with the applicable Data Processing Agreement and customer agreement, unless continued retention is required by law or permitted by the contract.<\/span><\/p>\n Customers may have access to platform functionality for exporting relevant data, depending on configuration and contracted services. Where export is not self-service, customers may submit authorised support or privacy requests in line with contractual terms.<\/span><\/p>\n Where Lead Forensics acts as a processor, service provider or contractor, the customer is responsible for responding to data subject rights requests, consumer privacy requests and similar requests relating to customer-controlled personal data.<\/span><\/p>\n Lead Forensics provides reasonable assistance where required by law and contract, including for requests such as access, correction, deletion, restriction, portability, objection, suppression or opt-out. If Lead Forensics receives a rights request directly relating to customer-controlled personal data, it will generally refer the requester to the relevant customer or handle the request in accordance with the agreement, the Data Processing Agreement, and applicable law.<\/span><\/p>\n Customers and prospects can request access to supporting documentation through the Lead Forensics Trust Centre. Additional materials may be made available under an NDA where appropriate, subject to review and approval.<\/span><\/p>\n The Lead Forensics ISO 27001 certificate is available via the Trust Centre.<\/span><\/p>\n Customer audit and information rights are handled in accordance with the applicable customer agreement and Data Processing Agreement.<\/span><\/p>\n1.2 What role does Lead Forensics play?<\/span><\/h2>\n
1.3 What documents govern the processing?<\/span><\/h2>\n
1.4 How often are privacy and security materials reviewed?<\/span><\/h2>\n
2. How the Lead Forensics platform works<\/span><\/h1>\n
2.1 What does the tracking code do?<\/span><\/h2>\n
2.2 How is an IP address matched to a business?<\/span><\/h2>\n
2.3 What business information may be shown?<\/span><\/h2>\n
2.4 Can visits from mobile devices be identified?<\/span><\/h2>\n
2.5 What is the optional Contact Data feature?<\/span><\/h2>\n
2.6 Is the Lead Forensics cookie required?<\/span><\/h2>\n
3. Data roles, responsibilities and privacy choices<\/span><\/h1>\n
3.1 What personal data may be processed?<\/span><\/h2>\n
3.2 What is the purpose of processing?<\/span><\/h2>\n
3.3 Does Lead Forensics require special category or sensitive personal data?<\/span><\/h2>\n
3.4 Who decides the lawful basis?<\/span><\/h2>\n
3.5 Who is responsible for cookies, tracking and marketing rules?<\/span><\/h2>\n
3.6 Do customers need to update their privacy notices?<\/span><\/h2>\n
3.7 How does Lead Forensics support privacy law compliance?<\/span><\/h2>\n
4. Security, access and confidentiality<\/span><\/h1>\n
4.1 What security measures protect customer data?<\/span><\/h2>\n
4.2 Where can customers view the Technical and Organisational Measures?<\/span><\/h2>\n
4.3 Does Lead Forensics have an ISMS?<\/span><\/h2>\n
4.4 Is Lead Forensics certified to SOC 2 or ISO\/IEC 27001?<\/span><\/h2>\n
4.5 Who can access customer personal data?<\/span><\/h2>\n
4.6 Are personnel subject to confidentiality obligations?<\/span><\/h2>\n
4.7 Is single sign-on available?<\/span><\/h2>\n
5. Testing, incidents and service resilience<\/span><\/h1>\n
5.1 Does Lead Forensics perform security testing?<\/span><\/h2>\n
5.2 How are third-party software and dependencies managed?<\/span><\/h2>\n
5.3 How are security incidents handled?<\/span><\/h2>\n
5.4 How are personal data breaches handled?<\/span><\/h2>\n
5.5 Does Lead Forensics maintain backups and recovery processes?<\/span><\/h2>\n
6. Data operations: sub-processors, transfers, retention and rights requests<\/span><\/h1>\n
6.1 Does Lead Forensics use sub-processors?<\/span><\/h2>\n
6.2 How are sub-processors assessed and updated?<\/span><\/h2>\n
6.3 Does Lead Forensics transfer personal data internationally?<\/span><\/h2>\n
6.4 How long is customer personal data retained?<\/span><\/h2>\n
6.5 What happens when a contract ends?<\/span><\/h2>\n
6.6 Can customers export data?<\/span><\/h2>\n
6.7 How does Lead Forensics support rights requests?<\/span><\/h2>\n
7. Assurance and customer review<\/span><\/h1>\n
7.1 What assurance materials are available?<\/span><\/h2>\n
7.2 Are certifications available?<\/span><\/h2>\n
7.3 Can customers conduct audits?<\/span><\/h2>\n
7.4 Does Lead Forensics complete security questionnaires?<\/span><\/h2>\n