Data Processing Agreement (DPA)

2.1 Nature and Purpose of Processing

Leadsia deploys on behalf of the Client a conversational AI agent that:

• Receives incoming messages from the Client's prospects and customers via multiple channels (email, web chat, WhatsApp, LinkedIn, Meta Lead Ads).
• Generates automated responses and/or suggestions for the human operator using language models (LLMs).
• Qualifies prospects (scoring) and updates the Client's CRM.
• Sends responses via the configured channels after automatic or human approval depending on the configuration.

2.2 Categories of Processed Data

• Identification Data: first name, last name, email, phone number, company.
• Conversation Data: text or audio messages exchanged between the prospect and the AI agent.
• Technical Data: IP, user-agent, channel identifiers (WhatsApp ID, LinkedIn ID, etc.).
• Business Metadata: lead status, score, interaction history, internal notes.

2.3 Categories of Data Subjects

• Prospects and customers of the Client (individuals contacting or contacted via the connected channels).
• Internal users of the Client (employees with a Leadsia account).

2.4 Duration of Processing

Processing continues for the entire duration of the main service agreement and ceases upon termination. Leadsia undertakes to delete the data within 30 days after termination, unless there is a legal obligation to retain it.

3.1 Compliance with the GDPR

Leadsia undertakes to:

• Process the data only on documented instructions from the Client.
• Guarantee the confidentiality of persons authorized to process the data (confidentiality agreement signed by employees).
• Implement appropriate technical and organizational measures (see Annex 1).
• Assist the Client in responding to data subjects' rights requests (access, rectification, erasure, portability).
• Notify the Client of any personal data breach within 72 hours of becoming aware of it (Art. 33 GDPR).
• Cooperate with the supervisory authority (CNIL/relevant DPA) in case of inquiry.

3.2 Record of Processing Activities

Leadsia maintains a record of processing activities in accordance with Article 30 of the GDPR, available on written request from the Client.

3.3 Audits and Reviews

The Client may, at its own expense and subject to 30 days' notice, conduct a compliance audit (either itself or via an appointed third party, excluding direct competitors of Leadsia), limited to once a year except in the event of a major security incident.

6.1 Main Hosting

Data is hosted on Hetzner Online GmbH servers located exclusively in Germany (EU).

6.2 Occasional Transfers — LLM Calls

Certain requests to LLM models may involve transfers to:

• Moonshot AI (Kimi K2.5) — China. Only anonymized data (identification data replaced by generic identifiers) is transmitted.
• Groq — United States (DPF or standard contractual clauses).

The Client may, upon written request, require an exclusive switch to a European LLM (Mistral, Claude via EU proxy); a tariff amendment may apply.

6.3 Safeguards

For all transfers outside the EU, Leadsia applies:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Systematic anonymization of sensitive identification data before transmission.
• Encryption in transit (TLS 1.3).