1. Purpose and Formation of this Agreement
This Data Processing Agreement ("DPA") sets out the parties' data protection obligations arising from the use of the LeadHook24 Software-as-a-Service platform. Pursuant to Art. 28 GDPR, it automatically becomes part of the usage agreement (Terms of Service) between the Client and Steffen Schirmer (LeadHook24) upon the Client's acceptance of the Terms — no separate signature is required.
With respect to the lead data collected through LeadHook24, the Client acts as the Controller within the meaning of the GDPR. LeadHook24 processes such data solely on the Client's behalf as Processor.
2. Subject Matter, Duration, Nature and Purpose of Processing
- Subject matter: Automated capture, pre-qualification, categorization, and response to inquiries (leads) submitted through the Client's connected forms or interfaces.
- Duration: For the term of the underlying usage agreement; ends automatically upon its termination, subject to statutory retention obligations under the Privacy Policy.
- Nature of processing: Collection, storage, categorization, automated (AI-assisted) response generation, and display within the Client dashboard.
- Purpose: Supporting the Client in responding quickly to and qualifying inbound business inquiries.
3. Categories of Data Subjects and Data Types
- Data subjects: Prospective customers/end users of the Client ("leads") who submit an inquiry through the Client's contact form or interface.
- Data types: Master and contact data (in particular name, email address and phone number), content and free-text messages submitted by the inquirer, details of property preferences and other inquiry content, and technical data and metadata arising from the transmission of the inquiry (e.g., timestamp and IP address).
4. Obligations of the Processor
LeadHook24 undertakes to:
- process personal data only on documented instructions from the Client (the Client's dashboard configuration constitutes such instructions),
- ensure that persons authorized to process personal data are bound by confidentiality,
- implement appropriate technical and organizational measures pursuant to Art. 32 GDPR, in particular encryption of data transmission (TLS/SSL),
- taking into account the nature of the processing and the information available to LeadHook24, reasonably assist the Client in complying with its data protection obligations under Art. 32 to 36 GDPR, in particular regarding the security of processing, the notification of personal data breaches, informing data subjects, and, where applicable, data protection impact assessments and prior consultations,
- upon termination of the usage agreement, delete or return all personal data at the Client's choice, unless a statutory retention obligation applies (see Privacy Policy, Section 6).
5. Sub-processors
The Client grants general authorization for the use of the following sub-processors, also listed in the Privacy Policy:
- ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (hosting infrastructure, EU)
- Anthropic PBC (Claude API), San Francisco, USA – AI processing; processing and international data transfers take place in accordance with Anthropic's then-current data protection terms and DPA, including the appropriate safeguards provided therein (in particular EU Standard Contractual Clauses).
- OpenAI L.L.C. (OpenAI API), San Francisco, USA, used partially as a fallback service – according to OpenAI's current terms, data from the EEA is processed by OpenAI Ireland Limited; international data transfers take place on the basis of OpenAI's then-current data protection terms and DPA, including appropriate safeguards (in particular EU Standard Contractual Clauses).
The Provider will inform the Client of the planned addition or replacement of sub-processors in a reasonable manner prior to their use. The Client may object on data protection grounds within 14 days of such notice. In the event of a justified objection, the parties will work towards a reasonable alternative solution; if no such solution is possible, the Client may terminate the affected part of the contract with effect from the planned date of use of the new sub-processor.
6. Client Audit Rights
The Client is entitled to satisfy itself, to a reasonable extent, of LeadHook24's compliance with the obligations set out in this Agreement, in particular by requesting information from LeadHook24. On-site audits must be announced in writing with reasonable notice (at least 14 days) and kept to the necessary scope.
7. Liability
The liability provisions of the Terms of Service apply accordingly.