Your account data
Quicklead is the controller. We decide what we need to run your account, bill you and support you, and we answer for it.
GDPR Center
GDPR at Quicklead, in detail
Our records of processing, the lawful basis for each activity, the DPIA on our AI features, where data goes and what we have not finished yet.
Records of processing: published AI DPIA: published EU/UK representative: in progress SCCs + UK Addendum
Last reviewed September 2026
Roles
Who is the controller for what
This is the first question any reviewer should ask, because it decides who owes the obligation. Quicklead does not have a single answer, and pretending otherwise would be misleading.
Your prospect data
You are the controller, Quicklead is your processor. We act only on your documented instructions under the DPA. You decide the lawful basis for your outreach.
The Email Finder database
Quicklead is the controller. This is our own dataset, so the lawful basis, the transparency notice and the removal route are our responsibility, not yours.
Article 30
Records of processing activities
The published summary of our ROPA. The full record, including the internal system inventory, is available to customers and prospective customers on request.
| Activity | Personal data | Purpose | Lawful basis | Our role | Retention |
|---|---|---|---|---|---|
| Customer account & billing | Name, work email, company, role, billing details, login and session records | Provide the service, invoice, support | Contract, Art. 6(1)(b) | Quicklead is controller | Life of account + 3 months idle, then deletion; invoices kept 8 years for tax |
| Prospect data in a customer workspace | LinkedIn profile fields, campaign membership, messages sent, replies received, notes, pipeline stage | Run the customer’s outreach campaigns on their instruction | Determined by the customer | Quicklead is processor | Deleted on customer instruction, or within 30 days of account closure |
| Email Finder database | LinkedIn profile URL, work email, in some records a business phone number and company domain | Supply business contact details for B2B prospecting | Legitimate interests, Art. 6(1)(f) | Quicklead is controller | Reviewed every 12 months; removed on request and added to a permanent suppression list |
| AI personalisation & ICP scoring | Prospect name, headline, company, role, summary; the customer’s ICP description | Draft an opening message and score a lead against the customer’s ICP | Determined by the customer; Quicklead processes on instruction | Quicklead is processor | Prompt sent at generation time, not retained by Quicklead beyond the generated output |
| Reply sentiment & intent classification | Text of the reply or LinkedIn post, author occupation | Route replies in the inbox and flag buying intent | Determined by the customer; Quicklead processes on instruction | Quicklead is processor | Classification stored with the message; deleted with the workspace |
| LinkedIn session operation | LinkedIn credentials or session token, session IP, activity log | Operate the customer’s own LinkedIn account safely on their instruction | Contract, Art. 6(1)(b) | Quicklead is processor | Encrypted at rest; destroyed when the account is disconnected |
| Website visitors | IP-derived country, pages viewed, consented analytics identifiers, form submissions | Run and measure quicklead.io, respond to enquiries | Consent for analytics and marketing; legitimate interests for security | Quicklead is controller | Per the Cookie Policy; analytics 14 months |
| Support conversations | Name, email, chat and ticket history | Answer support requests | Contract and legitimate interests | Quicklead is controller | 24 months from last contact |
Article 35
DPIA: AI personalisation and ICP scoring
A data protection impact assessment covering the features that profile a prospect. Summary below; the full assessment is available on request.
What the AI actually does
AI Messages sends the prospect’s name, headline, company, role and summary to the model and returns a draft opening message.
AI ICP Scoring sends the prospect’s profile fields and the customer’s ICP description and returns a score from 0 to 100, a band and a one-line reason.
Reply sentiment sends the text of an inbound reply to OpenAI (GPT-4) and returns a positive or negative classification, so the inbox can route it.
Post intent sends the text of a public LinkedIn post or comment, with the author’s headline, to OpenRouter and returns an intent label that flags buying signals.
Assessment findings
Article 22 is not engaged. No output produces a legal or similarly significant effect. A message is a draft a human sends, edits or discards; a score reorders a list.
Profiling does occur and is documented. The risk assessed is an inaccurate or unfair inference about a person’s professional role.
Mitigation: prompts carry only professional fields, the model is instructed never to invent facts, and every output is reviewable and editable before it reaches the prospect.
No special category data is sent to any model, and no training on customer or prospect data.
Residual risk: low, and accepted. The assessment is reviewed whenever a model or provider changes.
Which models, and where Two providers, four uses. OpenAI handles message personalisation (GPT-3.5-turbo) and reply sentiment (GPT-4). OpenRouter handles ICP scoring and post intent, both on Llama 3.3 70B. Both are listed with their locations on the sub-processor page, and no other AI provider receives personal data.
Article 6(1)(f)
Legitimate Interests Assessment: Email Finder
Where Quicklead is the controller of contact data it did not collect from the individual, a documented LIA is required. This is the summary of ours.
Purpose test
The interest is supplying accurate business contact details so B2B sellers can reach a decision-maker in their professional capacity. This is a recognised legitimate interest, and recital 47 expressly contemplates direct marketing as one.
Necessity test
The purpose cannot be met without the contact detail itself. We hold professional identifiers only, no special category data, and no personal address. Records are limited to business contact fields.
Balancing test
The data concerns people acting in a business role, in a context where professional contact is expected. Against that we set the fact that the data was not collected from them, and we mitigate with a published Article 14 notice, a one-click removal route, a permanent suppression list, and no use of the data for anything beyond business contact.
Outcome and the honest caveat The assessment concludes that legitimate interests is available for business contact data used for B2B outreach. It also records that this basis depends on the data staying professional in nature and on the removal route working in practice, and that an objection under Article 21 must be honoured immediately and permanently. Anyone can exercise that right at prospect-privacy.
Chapter V
International transfers
Where data actually sits
Quicklead Technology Private Limited is established in India. Primary application hosting, including the managed database, is on DigitalOcean in the United States. Neither is covered by an EU adequacy decision for our purposes, so we do not rely on one.
We say this plainly because a vendor review will find it anyway, and a trust page that implies an EU footprint is worse than no trust page.
What the transfer relies on
EU Standard Contractual Clauses (2021/914), module two and module three as applicable
UK International Data Transfer Addendum for UK exports
A transfer impact assessment covering the receiving jurisdictions
Encryption in transit and at rest, and access limited to named administrators
EU data residency can be scoped for enterprise agreements, before signature rather than after
Chapter III
Your rights, and how long we take
Email [email protected]. We acknowledge within two business days and respond within one month, free of charge.
Access
A copy of the personal data we hold about you, with the purposes and recipients.
Rectification
Correction of anything inaccurate. Profile data sourced from LinkedIn can be stale; tell us and we fix it.
Erasure
Deletion. For the Email Finder database we also add you to a permanent suppression list so the record cannot return.
Objection
An absolute right to object to direct marketing, and a right to object to legitimate-interests processing.
Portability
Your data in a structured, machine-readable format.
Restriction
Processing paused while a complaint or accuracy dispute is resolved.
If a Quicklead customer contacted you They are the controller of that outreach, not us. Send the request to [email protected] anyway; we forward it to the customer, chase it, and confirm the outcome back to you. If you want to be removed from our own Email Finder database, use the removal form.
Status
What is done and what is not
In place
Records of processing activities, published above
DPIA for AI personalisation and ICP scoring
Legitimate Interests Assessment for the Email Finder database
Article 14 notice and self-serve removal for people in that database
Data Processing Agreement, published in full
Application and website sub-processor lists, published, with change notice
Standard Contractual Clauses and the UK Addendum
Data subject request process with a one-month commitment
Consent-first cookie banner with equal accept and reject
Not yet
- EU and UK Article 27 representative appointment, in progress
- Independent penetration test, scheduled, summary to be published
- SOC 2 Type II report, observation period under way
- ISO 27001 certification, not sought and not claimed
- EU data residency as a standard option rather than an enterprise scope
FAQ
GDPR questions
Both, for different data. For the prospect data inside your workspace you are the controller and we are your processor under the DPA. For our own website, your account and the Email Finder database, Quicklead is the controller. The table on this page states which role applies to each processing activity.
Legitimate interests under Article 6(1)(f), for contacting people in a business capacity about matters relevant to their professional role. We have carried out and documented a Legitimate Interests Assessment, summarised on this page, and because the data is not collected from the individual we publish an Article 14 notice with a self-serve removal route.
No decision with a legal or similarly significant effect, so Article 22 is not engaged. The AI drafts an opening message that a human sends, edits or discards, and scores a lead so a human can prioritise a list. Profiling does take place and the DPIA documents it.
Primary application hosting is DigitalOcean in the United States, and Quicklead Technology Private Limited is established in India. We would rather say that plainly than imply an EU footprint we do not have. Transfers rely on Standard Contractual Clauses with the UK Addendum, supported by a transfer impact assessment. EU data residency can be scoped for enterprise agreements.
Not yet. As a company established outside the EU and UK that processes data about people in both, an Article 27 representative is required and the appointment is in progress. This page will name the representative and carry the appointment evidence once it completes.
Email [email protected]. We acknowledge within two business days and respond within one month. If a Quicklead customer contacted you, we forward the request to that customer as controller and confirm the outcome to you.
No. Prospect data is never used to train models, ours or anyone else’s. Prompts are sent to our AI sub-processors to generate a single output and are not contributed to training.
Running a data protection review?
Ask for the full ROPA, the DPIA, the LIA and our completed CAIQ. You will get the documents, and an honest "not yet" wherever that is the answer.
No credit card required · Full product trial · Cancel any time