Data Processing Addendum

Roles of the parties

When you run a search, you choose what to look for and where, and we retrieve the matching public business listings and return them to you. For any personal data within those results, you decide why and how it is used. Under data-protection law that makes you the controller and us your processor for that data.

• You are the data controller for the lead data you extract. We process it only on your documented instructions, which are the search parameters you submit.
• We are your processor for that lead data. We are not a joint controller with you, and you are not our processor.
• For your own account, billing, and usage data, we are the controller. That processing is described in our Privacy Policy, not this DPA.

Your instructions and responsibilities

As the controller, you are responsible for the lawfulness of the data you ask us to retrieve and of what you do with it. By submitting a search you instruct us to process the data it returns, and you confirm that:

• You have a lawful basis to collect and use any personal data contained in your results, and your instructions comply with applicable data-protection law.
• You will meet your own transparency duties to the people whose data you obtain, including any obligation to notify them (for example, under Article 14 of the GDPR), and you will honour their requests to access, correct, or delete their data, and to object.
• You will follow applicable anti-spam and electronic-marketing rules (such as CAN-SPAM, CASL, and the EU e-Privacy rules) when you contact anyone on your list.

We are not responsible for determining which laws apply to your business or for your lawful basis. If your instructions would put us in breach of data-protection law, we may decline or suspend the processing and will tell you.

Our obligations as processor

When we process lead data on your behalf, we will:

• Process it only on your documented instructions (your search parameters), unless the law requires otherwise, in which case we will tell you first where we are allowed to.
• Keep it confidential and ensure that anyone we authorise to process it is bound by confidentiality.
• Apply appropriate technical and organisational security measures, described in the Security section of our Privacy Policy.
• Help you, as far as we reasonably can, to respond to requests from individuals and to meet your security, breach-notification, and impact-assessment duties.
• Where an individual asks us directly to remove their personal data from our results, delete it from the systems we control and add it to a suppression list, so that we do not return it in future searches.
• Tell you without undue delay if we become aware of a personal-data breach affecting the lead data we process for you.
• Delete the working copies of your lead data as described in the Retention section of our Privacy Policy. We do not keep a separate resale database of the listings you extract.

Sub-processors

You give us general authorisation to use sub-processors to provide the service, including our hosting provider, our data-extraction provider, our email provider, and our payment provider. Each is engaged under a data-processing agreement with obligations no less protective than this DPA. The current list, what each does, and the safeguards in place are in the Privacy Policy.

If we add or change a sub-processor in a way that materially affects the processing of your lead data, we will update the list and, where required, give you a chance to object. To raise an objection, contact us at privacy@livemapleads.com.

International transfers

We operate from Canada and our providers may process data outside your country, including in the United States. Where data leaves the EEA or the UK, transfers are covered by Standard Contractual Clauses or an equivalent safeguard through the providers listed in our Privacy Policy.

Audits

On reasonable written request, and no more than once a year unless a supervisory authority requires otherwise, we will provide the information reasonably necessary to demonstrate our compliance with this DPA. Where an on-site audit is genuinely required, we will agree the scope, timing, and cost with you in advance so it does not disrupt the service or compromise the confidentiality of other customers.

Duration and deletion

This DPA applies for as long as we process lead data on your behalf. When you delete your account, or when the processing ends, we delete or return the lead data we hold for you, except where the law requires us to keep it, in line with the retention periods in our Privacy Policy.

Liability

The limitations and exclusions of liability in the Terms of Service apply to this DPA. Nothing in this DPA limits any liability that cannot be limited under applicable law.

Contact

Questions about this DPA or about how we process personal data? Contact us at privacy@livemapleads.com.