Legal
Data Processing Addendum
Applies when LeadForge processes personal data on a business client's documented instructions.
Version: 2026-09-02
1. Parties and scope
This addendum forms part of the LeadForge Terms of Service whenever Rafael Canevaro trading as LeadForge ("LeadForge") processes personal data for a business client as its processor. The client is the controller unless the law provides otherwise.
2. Processing details
The subject matter is the website, hosting/management, support, integrations and related digital services requested by the client. Processing lasts for the service and any limited retention period required for secure deletion, backup, legal or business-record purposes. The nature may include collecting, hosting, organising, viewing, transmitting, backing up, securing and deleting data. Data may include names, contact details, enquiries, booking/account information, website submissions and technical identifiers relating to the client's customers, staff or other users.
3. Documented instructions
LeadForge processes client personal data only on documented instructions, including instructions inherent in the agreed service, unless UK law requires otherwise. If legally permitted, LeadForge will tell the client before processing required by law.
4. Confidentiality and security
People authorised to process client data are subject to appropriate confidentiality duties. LeadForge will maintain technical and organisational measures appropriate to the risk, including access controls, authentication, restricted secrets/credentials, database controls and reasonable security monitoring.
5. Subprocessors
The client gives general authorisation for LeadForge to use subprocessors needed to provide the service. Current categories/providers may include Supabase for database/authentication/backend infrastructure; Lovable and associated hosting infrastructure; Cloudflare for domain/DNS/network security; Google Workspace/Gmail where the client/service uses authorised email features; and a payment processor if payment functionality is enabled. LeadForge will take reasonable steps to ensure required processor protections apply and will provide reasonable notice of a material new subprocessor where practicable.
6. International transfers
Where processing involves a restricted transfer of UK personal data, LeadForge will use an applicable adequacy regulation or another lawful transfer mechanism and appropriate safeguards available to it and the relevant provider.
7. Assistance
Taking account of the nature of processing and information available, LeadForge will reasonably assist the client with data-subject requests, security obligations, personal-data breach response, DPIAs and regulator consultations where those duties relate to the processing performed by LeadForge. The client remains responsible for deciding how to respond as controller.
8. Security incidents
LeadForge will notify the client without undue delay after becoming aware of a personal-data breach affecting client data where LeadForge is acting as processor, and will provide information reasonably available to help the client meet its legal duties.
9. Return and deletion
At the end of the relevant service, LeadForge will delete or return processor data as reasonably applicable to the service and the client's instructions, unless law requires retention. Secure backups and records that cannot immediately be isolated may remain for a limited period subject to continued protection.
10. Information and audit
LeadForge will make information reasonably necessary to demonstrate compliance with applicable processor obligations available to the client. Any audit must be proportionate, protect other customers/security/confidential information, avoid unnecessary disruption and normally use existing security documentation before intrusive inspection.
11. Controller responsibilities
The client is responsible for having a lawful basis, giving required privacy information, issuing lawful instructions, configuring its website/service appropriately, and ensuring the personal data it asks LeadForge to process is collected and used lawfully.
12. Priority and contact
If this addendum conflicts with general terms on processor obligations, this addendum controls for that subject. Privacy questions can be sent to rafael@leadforgewebsites.co.uk.