Data processing agreement
Last updated 12 October 2026
Scope
This agreement forms part of the Terms of service. It applies when HMH LABZ LLP processes personal data on behalf of a customer through Leadzura: card photos, contact details of people the customer meets, notes and related records. The customer is the controller (data fiduciary) and we are the processor.
Instructions
We process customer personal data only to provide and support the service and as the customer instructs through its use of the product. We will tell the customer if we believe an instruction breaks data protection law.
Confidentiality
Everyone at Leadzura who can access customer personal data is bound by confidentiality, and access is limited to what their work requires.
Security
Tenant isolation enforced in the database (row-level security), encryption in transit and at rest, short-lived file links, access logging, and audited support access visible to the customer.
Sub-processors
Amazon Web Services (hosting, file storage and email delivery, US East region), Cloudflare (network security), Anthropic (reading card photos, no training on customer data), Cashfree Payments and Stripe (payments), and Expo (push notifications). We impose data protection terms on each one, remain responsible for them, and give customers at least 14 days’ notice by email before adding or replacing one, so they can object.
International transfers
Where a sub-processor handles data outside the customer’s country, we rely on contractual safeguards such as standard contractual clauses where the law requires them, and on transfers permitted under the law that applies to the customer.
Assistance and breaches
We help customers answer data subject requests (export and deletion tools are self-service) and with security and impact assessments where reasonable. We notify customers without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting their data, with the information they need to meet their own obligations.
Deletion and return
Customers can export all data at any time. When a company is deleted, its data is removed after 30 days, except records we must keep by law (tax invoices, security audit logs).
Audits
On reasonable request we provide the information needed to show compliance with this agreement. Write to [email protected].