Data Processing Agreement (DPA)
Effective from 6. 11. 2026 · Version 1.1
1. Contracting parties
Controller: The customer of the Leadinka service (the company that registered and uses the CRM).
Processor: Offcon s.r.o., Company ID: 23028050, with registered office at Jičínská 1748/5, Vinohrady, 130 00 Praha 3, registered in the Commercial Register maintained by the Municipal Court in Prague, file no. C 420223.
2. Subject of processing
The Processor processes the Controller's leads' personal data (name, email, phone, marketing data) for the purpose of operating the CRM and optimizing marketing campaigns.
3. Processing period
Data is processed for the duration of the contractual relationship and 30 days after its termination for data export purposes. It is then permanently deleted.
4. Sub-processors
We use the following sub-processors to operate the service. The current list is always available in the application:
- Cloud hosting – service infrastructure in the EU region
- Transactional email – delivery of system messages from the application
- Advertising integrations – Google Ads API, Meta Conversions API (only on the customer's instruction)
5. Security measures
The Processor implements technical and organizational measures: transmission encryption (TLS 1.2+), database encryption at rest, regular backups, access control, access logging, and regular security audits.
6. Data subject rights
The Processor provides the Controller with tools to export, correct, or delete individual leads' data upon a data subject's request. Response time: no later than 30 days.
7. Incident notification
In the event of a security incident involving personal data, the Processor shall inform the Controller without undue delay, no later than 72 hours from discovery.
8. Contact
Data Protection Officer / DPO: admin@leadinka.cz.