GDPR & Data Protection

LeaCall provides a comprehensive Data Processing Agreement (DPA) that governs how we process personal data on your behalf. Our DPA includes:

• Description of processing activities and categories of data
• Our obligations as a Data Processor under Article 28 GDPR
• Sub-processor list and notification procedures
• Standard Contractual Clauses (SCCs) for international transfers
• Technical and organizational security measures
• Data subject rights assistance procedures
• Data breach notification commitments
• Audit rights and compliance verification

To request our DPA, please contact clients@leacall.com

With dedicated hosting, your data never leaves your chosen jurisdiction. All call data, recordings, transcripts, and lead information are stored exclusively in your designated region.

LeaCall processes personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our Services
• Legitimate Interests (Art. 6(1)(f)): Platform security, fraud prevention, and service improvement
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws and regulations
• Consent (Art. 6(1)(a)): Where specifically required, such as for marketing communications

Under GDPR, individuals have the following rights regarding their personal data:

For LeaCall Customers: Exercise your rights by contacting support@leacall.com

For End Users (Leads/Contacts): If you received a call through LeaCall and wish to exercise your rights, please contact the company that called you directly. They are the Data Controller responsible for your data. You may also contact LeaCall at support@leacall.com, and we will assist in directing your request appropriately.

When personal data is transferred outside the European Economic Area (EEA), LeaCall ensures adequate protection through:

• Adequacy Decisions: Transfers to countries with EU adequacy decisions (e.g., UK, Canada, Japan)
• Standard Contractual Clauses: EU-approved SCCs for transfers to other countries
• EU-U.S. Data Privacy Framework: For U.S. sub-processors that are certified
• Supplementary Measures: Additional technical and organizational safeguards where required

Enterprise customers can eliminate international transfers entirely by choosing EU-only data residency.

LeaCall implements comprehensive security measures in accordance with Article 32 GDPR:

Technical Measures

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• End-to-end encryption for call recordings
• Multi-factor authentication (MFA)
• Role-based access control (RBAC)
• Regular vulnerability scanning and penetration testing
• Intrusion detection and prevention systems
• Automated backup and disaster recovery

Organizational Measures

• SOC 2 Type II certification
• Employee security awareness training
• Background checks for personnel with data access
• Incident response procedures
• Business continuity planning
• Regular security audits by independent third parties
• Data minimization and purpose limitation practices

Our SOC 2 certification covers:

• Security: Protection against unauthorized access
• Availability: System availability as per service commitments
• Processing Integrity: Complete, valid, accurate, and timely processing
• Confidentiality: Protection of confidential information
• Privacy: Collection, use, retention, and disposal of personal information

Enterprise customers may request our SOC 2 report under NDA by contacting clients@leacall.com

In the event of a personal data breach, LeaCall will:

• Notify affected customers within 72 hours of becoming aware of a breach affecting their data
• Provide detailed information about the nature of the breach, data affected, and remedial measures
• Assist customers in fulfilling their own notification obligations to supervisory authorities and data subjects
• Document all breaches and response actions
• Implement measures to prevent recurrence

LeaCall engages carefully vetted sub-processors to deliver our Services. All sub-processors are bound by data processing agreements with equivalent protections to those we provide to you.

We maintain an updated list of sub-processors and will notify customers of any changes, providing an opportunity to object to new sub-processors in accordance with our DPA.

To request our current sub-processor list, contact support@leacall.com

We retain personal data only for as long as necessary for the purposes outlined in our Privacy Policy. Upon account termination or deletion request:

• Customer data is made available for export for 30 days
• All personal data is securely deleted within 90 days
• Backup copies are purged according to our backup retention schedule
• Certain data may be retained longer if required by law

Enterprise customers can configure custom retention policies and immediate deletion capabilities.

Right to Suspend or Terminate: LeaCall reserves the right to immediately suspend or terminate any account found to be in violation of our Terms of Service, applicable laws, or engaged in harmful activities including but not limited to fraud, harassment, or illegal calling practices.

If you are located in the European Economic Area and believe we have not addressed your data protection concerns adequately, you have the right to lodge a complaint with your local Data Protection Authority (DPA).

LeaCall's lead supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL) in France.