Data Processing Agreement

Last updated: 22 October 2026

The short version

• Your customer list belongs to you. We only use it to run the review requests, reactivation campaigns and enquiry handling you've signed up for.

• We keep it secure, we don't sell it or share it, and we only use trusted software providers to run the service.

• If there's ever a problem with your data, we'll tell you quickly.

• When you leave, we send your data back on request and delete our copy within 30 days.

• You're responsible for making sure you're allowed to contact the customers on your list. We'll help you get that right.

1. Parties

This agreement is between the business named on the sign-up form ("you", the controller) and Galactic Digital Agency Ltd, trading as Local Lead Engine, a company registered in England and Wales (company number 06105982) ("we", the processor). It forms part of the Founding Trial Terms and any later service agreement between us, and applies for as long as we process personal data for you.

Words like "personal data", "controller", "processor" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018.

2. What we process and why

• Subject matter: providing the Local Lead Engine service to you.

• Purpose: sending review requests and marketing messages on your behalf, capturing and responding to enquiries (calls, texts, website chat and forms), managing bookings, and reporting on results.

• Duration: the length of the service, plus up to 30 days afterwards to return or delete data.

• People the data is about: your past, current and potential customers, and people who contact your business.

• Types of data: names, phone numbers, email addresses, postal addresses, job history and dates, enquiry and booking details, messages and call records, and review responses.

• Special category data: none. Please don't include health or other sensitive information in the customer list you send us.

3. Our commitments

We will:

1. Only process your personal data on your documented instructions, which are set out in this agreement and the service you've signed up for, unless the law requires otherwise. If we think an instruction breaks data protection law, we'll tell you.

2. Make sure anyone who handles your data is bound by confidentiality.

3. Keep your data secure, with measures that suit the risk, including access controls, two-factor authentication on our accounts, and using reputable providers with their own security certifications.

4. Only use the sub-processors listed in section 5, and tell you before adding or replacing one, so you have the chance to object. Each sub-processor is bound by data protection terms that protect your data at least as well as this agreement.

5. Help you respond to requests from your customers, such as requests to see, correct or delete their data, or to stop receiving messages.

6. Help you meet your own obligations on security, breach notification and, where needed, data protection impact assessments.

7. Tell you without undue delay if there's a personal data breach affecting your data, with the information you need to report it if required.

8. At the end of the service, return your data to you on request and delete our copies within 30 days, unless the law requires us to keep them.

9. Give you the information you reasonably need to show that we're meeting these commitments, and allow for and contribute to reasonable audits, with reasonable notice.

4. Your commitments

You will:

1. Make sure you have a lawful basis to give us the data and for us to process it on your behalf.

2. Make sure the messages we send for you comply with the Privacy and Electronic Communications Regulations (PECR). For marketing messages to individuals, this usually means relying on the "soft opt-in": the customer's details were collected while you quoted for or did work for them, the message is about your own similar services, they were given a simple way to opt out when their details were collected, and every message gives them a way to opt out.

3. Tell us honestly, on the intake form, whether customers were given a way to opt out, so we can exclude anyone who can't be sent marketing messages.

4. Remove anyone who has asked not to be contacted before sending us your list, and tell us if anyone asks you directly.

5. Keep your own privacy notice up to date so your customers know their data may be used for review requests and service updates.

5. Sub-processors

• HighLevel, Inc. (LeadConnector): CRM, automations, website chat, forms, bookings and messaging platform, including its own phone and AI providers. Data may be processed in the United States.

• Twilio, via HighLevel's LC Phone service: phone numbers, calls and text messages. Data may be processed in the United States.

• Google (Google Workspace): email. Data may be processed in various locations, including the United States.

6. Transfers outside the UK

Some of our sub-processors are based in the United States. We only use providers that transfer data under a safeguard recognised by UK law, such as the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or International Data Transfer Addendum.

7. Liability

Each party's liability under this agreement is subject to the limits in the Founding Trial Terms, except where the law doesn't allow liability to be limited.

8. Law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

9. Contact

For anything about your data: John Gingell, [email protected]