LeadOne

Legal

Data Processing Agreement

DPA · Version 1.0 · Effective from 2026-06-10

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

  • Data Controller — the company or organisation ("Client") that engages LeadOne Marketing OÜ for the Review Machine service.
  • Data Processor — LeadOne Marketing OÜ, registered in Estonia (EU), email: info@leadone.online ("LeadOne").

2. Background and purpose

LeadOne provides the Review Machine service, which involves LeadOne sending SMS review requests to the Client's existing customers on the Client's behalf. This DPA governs that processing in accordance with GDPR Article 28.

3. Nature and purpose of processing

PurposeSending SMS review requests to the Client's existing customers
Data typesName and mobile phone number. Where applicable, email address.
Data subjectsThe Client's existing customers
DurationDuring the contract term. Data deleted within 30 days of contract termination.

4. LeadOne's obligations

  • Process personal data solely according to documented instructions from the Client.
  • Ensure that persons authorised to process the data have committed to confidentiality.
  • Implement appropriate technical and organisational security measures per GDPR Article 32.
  • Not engage additional sub-processors without informing the Client in advance.
  • Assist the Client in fulfilling obligations regarding data subject rights.
  • Delete or return all personal data after contract termination.
  • Notify the Client without undue delay of any personal data breach.

5. Sub-processors

Sub-processorPurposeCountrySafeguard
GoHighLevel / LeadConnectorCRM, contact management, automationUSASCCs
Twilio Inc.SMS deliveryUSASCCs
Google LLCGoogle Business ProfileUSASCCs

6. Entering into the agreement

This DPA takes effect when the Client enters into a service agreement with LeadOne Marketing OÜ for the Review Machine. It can also be entered into separately via written confirmation to info@leadone.online.