LeadIQ — Data Processing Agreement (DPA)
Effective date: 2026-05-15 Data Processor: Saabsoft Technologies, Office 86, 4th Floor, Rasis Business Tower, Al Barsha 1, Dubai, UAE Data Controller: The LeadIQ subscriber (the "Customer")
This DPA is automatically incorporated into the LeadIQ Terms of Service for any Customer in a jurisdiction with GDPR-equivalent law (EU/EEA/UK, Switzerland, Brazil LGPD, etc.). For other Customers, it applies on request.
1. Definitions
Terms used here have the meanings given in Regulation (EU) 2016/679 (the GDPR). "Personal Data" specifically refers to data about identified or identifiable natural persons that the Customer puts into their Bitrix24 CRM (the "Leads") and which LeadIQ processes on the Customer's behalf.
2. Roles
- Customer = Controller — decides what Personal Data is collected, why, and how
- Saabsoft = Processor — processes Personal Data only on Customer's documented instructions
3. Subject matter, duration, scope
- Subject matter: lead qualification, scoring, and distribution
- Duration: for the term of the LeadIQ subscription + 90 days retention after cancellation
- Categories of data subjects: real-estate leads, prospects, agents, and other CRM contacts
- Categories of Personal Data:
- Identifiers: name, email, phone
- Communication: WhatsApp/SMS conversation history
- Property preferences: budget, type, location, timeline
- CRM activity: stage transitions, response times
4. Saabsoft's obligations
We will: 1. Process Personal Data only on Customer's documented instructions 2. Ensure persons authorized to process the data are bound by confidentiality 3. Implement appropriate technical and organizational security measures (Annex 1) 4. Engage subprocessors only with Customer's general authorization (current list in Annex 2; we'll notify of changes with 30 days' notice + right to object) 5. Assist Customer in responding to Data-Subject Requests (access, erasure, rectification, portability) 6. Assist Customer with Data Protection Impact Assessments (DPIAs) 7. Notify Customer within 72 hours of becoming aware of a personal-data breach affecting Customer's data 8. Delete or return all Personal Data at the end of the contract (Customer's choice) 9. Make available all information necessary to demonstrate compliance with this DPA 10. Allow audits by Customer or an independent auditor (annual, at Customer's expense, reasonable notice)
5. International transfers
Personal Data may be transferred to United States (AWS us-east-1) and processed by Anthropic for AI inference. We rely on EU Standard Contractual Clauses (SCCs) module 2 (controller-to-processor) for these transfers. SCCs are attached as Annex 3 on request.
6. Subprocessors (Annex 2)
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Amazon Web Services | Compute + storage | us-east-1 (USA) | AWS-customer DPA + SCCs |
| Anthropic | AI inference | USA | Anthropic enterprise DPA + SCCs; data not used for training |
| Stripe | Billing | USA/EU | Stripe DPA + SCCs |
| Twilio | WhatsApp/SMS — uses Customer's OWN Twilio account, not ours | Per Twilio terms | Customer's relationship with Twilio |
Customer authorizes these subprocessors. We'll notify of additions with 30 days' notice.
7. Security measures (Annex 1)
- Access control: IAM-based, principle of least privilege, MFA required for Saabsoft admins
- Encryption: AES-256 at rest, TLS 1.3 in transit, Fernet for sensitive fields
- Network: ECS tasks in private subnets, no public IP, WAF in front of public ALB
- Tenant isolation: per-PostgreSQL-schema isolation, enforced at DB + application middleware
- AI safety: response guard sanitizer redacts any system internals before responses to leads
- Backups: encrypted automated daily, 7-day retention
- Monitoring: CloudWatch + alarms on error rate, unusual data egress
- Incident response: documented playbook, 72-hour breach notification commitment
- Personnel: confidentiality agreements, security training annually
8. Liability
Standard LeadIQ Terms of Service Section 10 applies to this DPA.
9. Order of precedence
If conflict between this DPA and Terms of Service, this DPA wins for matters of Personal Data processing.
To execute: This DPA is automatically agreed to by the Customer's acceptance of the LeadIQ Terms of Service. A signed copy is available on request to legal@saabsoft.com.