Privacy notice

1. Controller and contact

Leadlund, a Finnish private trader based in Vantaa (Business ID 3627560-4), is controller for accounts, service operation, security and its own business relationships. Registered details are available from YTJ. Privacy requests: privacy@leadlund.com.

2. Customer campaign roles

The customer chooses recipients, purpose, content and lawful basis and is controller for its campaigns. Leadlund acts as processor under the DPA. Leadlund may independently control collection from public business sources for its searchable service.

3. Data and sources

• Account, organization, authentication and service-preference data.
• Encrypted email credentials and sender configuration.
• Public company and professional contact data from registries, company websites and public job listings.
• Campaign content, recipients, delivery, reply, bounce, unsubscribe and engagement events.
• IP, request, security, diagnostic and usage logs.

4. Purposes and legal bases

We provide and secure the service under the customer agreement and legitimate interests; build proportionate B2B search from public professional information under legitimate interests; enforce suppression and legal duties; and handle support and accounting. We do not sell personal data or use prospect data for consumer advertising.

5. Providers and transfers

Providers include Clerk, Supabase, Inngest, AWS, Vercel, customer-selected email providers, Google Cloud Translation for optional translation of registry text, Sentry for error monitoring, and residential network proxy providers used to reach some public registries. The primary database is in Frankfurt and the worker in Stockholm, but some providers process data outside the EEA. Applicable adequacy decisions, the EU–US Data Privacy Framework or Standard Contractual Clauses are used where required.

6. Retention and tracking

Saved leads that have not been found again, clicked or used in a campaign for 12 months are deleted, and recipient data and engagement events from a campaign are deleted 12 months after the campaign was created once it is no longer sending. Other account and customer records remain while active or until deleted, subject to backups and legal duties. Credentials remain until disconnected; suppression and objection records are kept to preserve opt-outs. AWS worker logs are retained for 14 days.

Leadlund uses functional authentication and locale storage, not advertising cookies. Campaign emails contain click tracking unless the sender turns it off; open tracking is off by default and is added only when the sender turns it on for a campaign.

7. Your rights

You may have rights to access, correct, delete, restrict or port data and to object to legitimate-interest processing. Contact privacy@leadlund.com or complain to the Finnish Data Protection Ombudsman or your local authority. If you object to Leadlund, we record it so that no workspace saves or emails you again. For a customer campaign, contact the identified sender first; Leadlund assists the customer and honors unsubscribe requests.

8. Changes

Material changes will be communicated where appropriate. The date and version above identify the current notice.