Privacy Policy

1. Data Controller

Responsible party according to GDPR (EU 2016/679) and Spanish data protection legislation (LOPD-GDD) is:

2. Purpose and Scope

LeadHook24 is a B2B SaaS platform designed for automated qualification, sorting, and fast response generation for inbound customer leads on behalf of real estate agencies and service companies.

3. Data Categories

• Customer Account Data: Name, company name, address, email address, phone number, tax ID (NIF/CIF), billing details, and login timestamps.
• Lead & Inquiry Data: Names, email addresses, phone numbers, and inquiry texts submitted through connected forms.
• Configuration & Performance Data: Business hours, vacation settings, custom business rules, and response stats.

4. Legal Basis for Processing

• Art. 6(1)(b) GDPR (Contract Performance): Account management, SaaS services, and subscription processing.
• Art. 6(1)(c) GDPR (Legal Obligations): Tax and commercial record-keeping under Spanish law.
• Art. 6(1)(f) GDPR (Legitimate Interest): System stability, fraud prevention, and platform security.

5. Data Processing Agreement (DPA / Art. 28 GDPR)

When processing inquiry data on behalf of business clients, LeadHook24 acts as a Data Processor under Article 28 GDPR.

6. Data Retention

Personal data is retained only as long as necessary for contractual purposes or statutory retention periods.

• Invoices and accounting records are retained for 6 years under the Spanish commercial retention obligation (Art. 30 Código de Comercio) — regardless of whether the underlying customer contract has since ended.
• Lead data (end-customer inquiries) can be deleted by the Client from the dashboard at any time. Any remaining lead data is automatically and permanently deleted 14 days after the end of the relevant customer contract.

7. Technical Sub-processors & API Processing

We utilize specialized infrastructure and interface providers:

• Hosting & Infrastructure: ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Data centers located within the European Union with modern security and encryption standards.
• Automated Natural Language Processing (APIs): Inquiries are processed via encrypted (TLS/SSL) enterprise API connections by:
  • Anthropic PBC (Claude API), San Francisco, USA — primary AI service.
  • OpenAI L.L.C. (OpenAI API), San Francisco, USA — used partially as a fallback service; according to OpenAI's current terms, EEA data is processed by OpenAI Ireland Limited.
  Note: Data transmitted via enterprise APIs is not used to train public machine learning models. Transfers to third countries are governed by EU Standard Contractual Clauses (SCCs).
• Payment Processing: Managed by certified, PCI-DSS-compliant payment gateways. LeadHook24 does not store full credit card data.

8. Your Rights (GDPR / ARCO Rights)

You hold rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21). Contact: info@leadhook24.com.

Supervisory authority: Agencia Española de Protección de Datos (AEPD), www.aepd.es.

9. Data Security

All platform connections are secured by TLS/SSL (256-bit) encryption.