Data Processing Agreement

For personal data you submit to WeLead, you act as the data controller (or an equivalent term under your local law) and WeLead acts as the data processor. For the account, billing and usage data we collect about you as a customer, we act as controller, as described in our Privacy Policy.

We process personal data on your behalf for the duration of your subscription and until deletion of the data after termination, in accordance with the retention terms in our Privacy Policy.

Processing consists of storage, retrieval, structuring, transmission and display strictly as needed to provide the features you use: building and publishing websites, storing lead and client records, generating documents such as invoices and contracts, sending email you instruct us to send, and providing support. Processing also includes limited automated operations needed for security, backups and troubleshooting.

Data subjects may include your customers, prospects, clients and website visitors. Categories of data may include identification and contact details (name, business name, email address, telephone number, postal address), website and campaign content, financial records such as invoice amounts and payment status, and any other information you choose to enter. Special categories of data are not required by the service and should not be submitted unless you have a lawful basis and have assessed the risk.

We will:

• process personal data only on your documented instructions, including those in this agreement and your use of the platform's features;
• ensure that personnel authorized to process the data are bound by confidentiality;
• implement appropriate technical and organizational security measures as described in our Security & Data Breach Information;
• assist you in responding to data subject requests and in meeting your obligations regarding security, breach notification, and impact assessments;
• notify you without undue delay after becoming aware of a personal data breach affecting your data;
• delete or return personal data at the end of the provision of services, at your choice, subject to legal retention requirements;
• make available the information needed to demonstrate compliance with these obligations.

You authorize us to engage subprocessors to provide parts of the service. We impose data-protection obligations on each subprocessor equivalent to those in this agreement and remain liable for their performance. The current list is published in our Subprocessor List. We will notify you of any intended addition or replacement, giving you the opportunity to object on reasonable data-protection grounds.

Where personal data is transferred outside the EEA, the UK or Switzerland, we rely on appropriate safeguards — typically the European Commission's Standard Contractual Clauses and, where relevant, the UK Addendum — together with supplementary measures such as encryption in transit and access controls.

We will provide the documentation reasonably necessary to demonstrate compliance, and we support audits by responding to written security and compliance questionnaires. On-site audits are available where required by law, subject to reasonable notice, confidentiality and cost allocation.

The liability provisions of our Terms of Service apply to this DPA. Where this DPA conflicts with the Terms of Service on matters of data protection, this DPA prevails for that processing.

Where the California Consumer Privacy Act or comparable state laws apply, we act as a service provider and will not sell or share personal data, retain it beyond the agreed purpose, or use it for our own commercial purposes. We will assist you in responding to consumer requests as required by those laws.

This DPA is accepted by using the platform for processing personal data, and you may also request a countersigned copy. Send requests to petarbuisness010@gmail.com with your company details and the email address on your account; we aim to respond within 10 business days.