- Processor
- Leadvera Ltd (trading as Leadvera)
- Registered office
- London, United Kingdom
- Governing law
- England and Wales
- Privacy contact
- privacy@unisticgroup.com
1. Agreement status and roles
This agreement is between the customer (the controller) and Leadvera Ltd (trading as Leadvera), with its registered office in London, United Kingdom (the processor). It supplements the terms of service, and it is governed by the law of England and Wales.
The customer decides the purposes and means of processing its CRM records; Leadvera Ltd processes them only to provide the service on the customer’s documented instructions. For its own account administration, billing and security, Leadvera Ltd acts as controller under the privacy notice.
2. Processing schedule
The processing covered by this agreement:
| Schedule item | Details |
|---|---|
| Subject matter | Providing the Leadvera CRM service to the customer |
| Duration | The subscription term, plus the return or deletion period at its end |
| Purpose and operations | Storing, organising, displaying, routing and sending the customer’s CRM records |
| Data subjects | The customer’s enquirers, customers, business contacts and authorised users |
| Data categories | Contact details, enquiries, communications, notes, documents and sales records |
| Special-category data | Not processed unless agreed in writing |
3. Documented instructions and confidentiality
Leadvera Ltd processes customer data only on the customer’s documented instructions, including the workspace configuration, unless the law requires otherwise, and tells the customer if it believes an instruction is unlawful.
People authorised to access customer data are bound by confidentiality duties and have access only as their role requires.
4. Security measures
Leadvera Ltd keeps technical and organisational measures appropriate to the processing in place, and the Trust centre describes them.
In place today: hosting on Cloudflare with records and files encrypted at rest by the platform; salted password hashing; HttpOnly session cookies; role-based access checked on the server for every request; separation of each customer’s workspace data; CSRF protection and rate limits; and an audit trail that cannot be edited or deleted. No independent certification is claimed.
5. Subprocessors
The customer authorises the subprocessors in the register. Leadvera Ltd gives at least 30 days’ notice of a new subprocessor, during which the customer may object, and passes on data protection obligations equivalent to this agreement.
The subprocessor register lists each provider, its function and when it is used.
6. Assistance and rights requests
Leadvera Ltd helps the customer answer rights requests, carry out impact assessments and respond to regulators, and provides the information needed to demonstrate compliance. Write to privacy@unisticgroup.com.
The customer remains the point of decision for requests about its CRM data unless the law or contract assigns a different responsibility. Requests that reach Leadvera about a customer’s records are passed to that customer.
7. Personal data incidents
Leadvera Ltd notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data, with the information available, and helps the customer meet its own notification duties.
A breach notice goes to the workspace owner by email; a status-page update never replaces it.
8. Transfers and assurance
Where customer data is transferred outside the United Kingdom or the European Economic Area, Leadvera Ltd uses the appropriate safeguards, such as standard contractual clauses or the UK International Data Transfer Addendum.
Leadvera Ltd answers reasonable information requests and audit questions about this processing. No independent certification or third-party audit is claimed.
9. Return, deletion and precedence
At the end of the service the customer can export its records; Leadvera Ltd then deletes customer data, unless the law requires it to be kept, and confirms deletion on request.
If this agreement and the terms of service differ on data protection, this agreement takes precedence.