Privacy Policy - Leadinka

1. Data controller

Offcon s.r.o., Company ID: 23028050, with registered office at Jičínská 1748/5, Vinohrady, 130 00 Praha 3, registered in the Commercial Register maintained by the Municipal Court in Prague, file no. C 420223

Privacy contact: admin@leadinka.cz

This policy describes processing when you use leadinka.cz and the Leadinka CRM service. Processing of customers' leads is also governed by the Data Processing Agreement (DPA).

2. Data we process

Website visitors

Technical data (IP address, browser type, pages visited), cookies as described in our Cookie Policy, and contact form data if submitted (name, email, message).

CRM users (customers)

Registration and billing details, login email, account settings, access logs, and support communication.

Customers' leads

Name, email, phone, form content, marketing identifiers (e.g. GCLID, FBCLID), and data from integrations (Google Ads, Meta Lead Ads, web forms, phone leads). The customer is the controller; Leadinka acts as processor under the DPA.

3. Purposes and legal bases

Operating the website and CRM, contract performance (GDPR Art. 6(1)(b)).
Payments and invoicing, legal obligations (GDPR Art. 6(1)(c)).
Website analytics and marketing based on consent (GDPR Art. 6(1)(a)).
Facebook / Meta and Google integrations under contract and customer instructions.
Legitimate interest in security and abuse prevention (GDPR Art. 6(1)(f)).

4. Facebook / Meta and Google integrations

When you connect Meta or Google, Leadinka may receive lead form and ad platform data. We store OAuth tokens securely and use them only to sync leads and conversions on your instruction. You can disconnect access at any time in the app settings.

See Meta (Facebook) Data Deletion for how to request deletion of data received from Meta.

4.1 Google user data

If you connect Google Ads, Leadinka accesses Google user data through OAuth 2.0 (scopes: https://www.googleapis.com/auth/adwords, https://www.googleapis.com/auth/datamanager). This may include your Google account identifier, OAuth access and refresh tokens, the list of Google Ads accounts you can access, the customer ID you select, conversion action metadata, and offline conversion upload data (for example GCLID, conversion time, value, and currency) sent to your own Google Ads account via the Google Ads API and Data Manager API.

We use Google user data only to provide the Google Ads Offline Conversions module: listing accounts you authorize, creating or verifying offline conversion actions, and uploading conversions from CRM at your instruction. We do not use Google user data for unrelated advertising management, and we do not use it to access accounts you have not authorized.

4.2 Sharing, transfer, and disclosure of Google user data

We do not sell, rent, or license Google user data to third parties. We do not share Google user data with other Leadinka customers.

We transfer or disclose Google user data only in these cases:

Google LLC (Google Ads API and Data Manager API) — to perform actions in the Google Ads account you connected (for example list accessible customers, create conversion actions) and to upload offline click conversions via Data Manager API. Data is sent to Google as part of normal API operation for your account.
Infrastructure sub-processors — such as our hosting provider, which may store encrypted OAuth tokens and process API traffic solely to operate Leadinka on our behalf, under contractual confidentiality and security obligations.
Legal requirements — when disclosure is required by applicable law, regulation, legal process, or enforceable governmental request.

OAuth tokens and Google Ads configuration are stored per customer project (tenant) and are not shared across unrelated accounts. You can revoke Leadinka’s access at any time in the app (disconnect Google Ads) or in your Google Account permissions.

4.3 Meta (Facebook) user data

Leadinka does not use Facebook Login for CRM sign-in. Meta OAuth is used only when you voluntarily connect your Facebook page or ad account to a project in CRM.

If you connect Meta, Leadinka may access Meta user and platform data through the Facebook Login / Graph API, including permissions such as lead retrieval, page and business management, and ads read/management. This may include OAuth access tokens and page access tokens, Facebook Page IDs, Business Manager identifiers, ad account IDs, Lead Ads form IDs, lead form submissions (name, email, phone, answers, campaign metadata), Pixel ID you enter in settings, and Conversions API (CAPI) event data (for example event name, event time, value, currency, FBCLID, and hashed contact identifiers) sent to your own Meta Pixel / ad account.

We use Meta user data only to provide the Facebook Lead Ads and offline conversions modules: importing leads from your Lead Ads forms into CRM, sending conversion events to your Pixel via CAPI when leads move through CRM stages, and managing the connection you authorized. We do not use Meta user data for unrelated advertising management or to access assets you have not authorized.

4.4 Sharing, transfer, and disclosure of Meta (Facebook) user data

We do not sell, rent, or license Meta user data to third parties. We do not share Meta user data with other Leadinka customers.

We transfer or disclose Meta user data only in these cases:

Meta Platforms, Inc. (Facebook / Instagram — Graph API and Conversions API) — to retrieve Lead Ads you authorized, manage the connection to your Page or ad account, and send conversion events to your Pixel. Data is sent to Meta as part of normal API operation for your account.
Infrastructure sub-processors — such as our hosting provider, which may store encrypted access tokens and process API traffic solely to operate Leadinka on our behalf, under contractual confidentiality and security obligations.
Legal requirements — when disclosure is required by applicable law, regulation, legal process, or enforceable governmental request.

Meta tokens and configuration are stored per customer project (tenant) and are not shared across unrelated accounts. You can revoke Leadinka’s access at any time in the app (disconnect Facebook Lead Ads) or in your Meta Business Integrations settings. To request deletion of data received from Meta, see Meta (Facebook) Data Deletion.

5. Retention

CRM user data is kept for the contract term and statutory retention periods. Customer leads are retained while the account is active; after termination, export is available, then deletion per the DPA. Website logs and cookies follow the Cookie Policy.

6. Recipients and transfers

Sub-processors (hosting, email, payment gateway, ad APIs) may process data in the EU or under adequate safeguards. The sub-processor list for leads is in the DPA. We do not sell data to third parties for their marketing.

For Google user data, see Section 4.2. For Meta (Facebook) user data, see Section 4.4.

7. Your rights

You have the right to access, rectify, erase, restrict processing, data portability, object, and withdraw consent. Contact admin@leadinka.cz. You may lodge a complaint with your supervisory authority.

CRM users manage their leads in the app; as controller, the customer handles requests from their lead data subjects.

8. Security

We use encrypted connections (TLS), access controls, backups, and regular updates. Only authorized personnel and systems can access personal data.