This DPA governs the transfer of personal data from LeadDistro ("Controller") to you as a lead buyer ("Processor/Sub-Controller") under UK GDPR and the Data Protection Act 2018.
1. Data you will receive. Lead records include: first name, last name, email, phone, postcode, vertical-specific attributes, and a DYNAMICS-8 behavioural profile. All data subjects have provided explicit, informed consent for the specific purpose stated in the lead record.
2. Permitted use. You may only contact the data subject for the purpose stated in the consent text attached to the lead (e.g. training renewal, insurance renewal, or locum opportunities). You may not use the data for any other purpose, nor share it with third parties without fresh consent.
3. Retention. You must delete lead data upon request from the data subject (Subject Access Request / Right to Erasure). Retention must not exceed 24 months from receipt.
4. Security. You must implement appropriate technical and organisational measures to protect lead data. You must notify LeadDistro within 72 hours of becoming aware of a personal data breach affecting received leads.
5. Sub-processors. You may not onward-transfer lead data to CRM tools or third parties without a lawful basis. Standard CRM tools (Salesforce, HubSpot) are permissible if you have a DPA with those providers.
6. Liability. You are solely responsible for your use of received lead data. LeadDistro's liability is limited to the lead charges paid in the 30 days preceding any claim.
7. Governing law. This DPA is governed by English law. Disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.