Data Processing Agreement

Parties to this Agreement

Data Controller — the business subscribing to the LeadZilla services ("Controller", "you", "your").

Data Processor — LeadZilla Ltd ("Processor", "we", "us")

Footprints Accountancy, 24 Napier Court, Barlborough, Chesterfield, United Kingdom, S43 4PZ

ICO Registration Number: ZC128057

Contact: support@leadzilla.media

This Agreement forms part of the terms between the Controller and the Processor and takes effect on the date the Controller accepts it during onboarding.

1. Definitions

1.1 "Personal Data", "Data Subject", "Processing", "Controller", and "Processor" have the meanings given in UK GDPR.

1.2 "Services" means the LeadZilla CRM platform and integration services operated by the Processor, including:

• Synchronisation of data between ServiceM8 and LeadZilla
• CRM functionality and data storage
• Automation workflows (including SMS, email, and pipeline actions)
• System configuration, support, and operational functionality

1.3 "Controller Data" means any personal data belonging to the Controller's customers that is processed through the Services.

2. Subject matter and duration

2.1 The Processor processes Controller Data solely to provide the Services described in this Agreement.

2.2 This Agreement remains in force for as long as the Processor processes Controller Data on behalf of the Controller and terminates automatically when the Controller's account is closed or the underlying terms end.

3. Nature and purpose of processing

3.1 The Processor processes Controller Data only for the following purposes:

• Syncing contact records between ServiceM8 and LeadZilla
• Syncing job data (status, category, value, address, references)
• Syncing opportunities and CRM records
• Operating automation workflows (SMS, email, pipeline actions)
• Detecting and resolving duplicate or mismatched records
• Storing system logs and webhook job history for operational purposes

3.2 The Processor does not sell, rent, or otherwise use Controller Data for its own commercial purposes.

3.3 The Processor does not process Controller Data for marketing, profiling, or any purpose outside of delivering the Services.

4. Categories of personal data

• Full name
• Email address
• Phone number
• Business address
• Job site address
• Job details (status, category, value, reference number)
• System identifiers (e.g. ServiceM8 client UUID, LeadZilla opportunity ID)

5. Categories of data subjects

The Controller's customers (individuals or businesses receiving services from the Controller).

6. Obligations of the Controller

6.1 The Controller confirms that:

• They have a lawful basis under UK GDPR to share the personal data described in this Agreement
• They have provided appropriate privacy notices to their customers
• They will notify the Processor of any data inaccuracies or data subject requests
• They will not instruct the Processor to process data in a way that would breach UK GDPR

7. Obligations of the Processor

7.1 The Processor agrees to:

• Process Controller Data only on documented instructions from the Controller, including any configuration, workflows, or automation rules created, approved, or enabled within the Services
• Ensure all personnel with access to Controller Data are subject to confidentiality obligations
• Limit access to personal data to authorised personnel on a need-to-know basis
• Implement appropriate technical and organisational security measures as described in Clause 8
• Use only approved sub-processors listed in Schedule 1
• Notify the Controller of any intended changes to sub-processors and provide a reasonable opportunity to object; where no reasonable alternative is available, the Processor may terminate the Services
• Assist the Controller in responding to data subject requests where technically feasible
• Notify the Controller without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach
• Delete or return Controller Data upon termination of the Services, unless retention is required by law
• Provide information reasonably necessary to demonstrate compliance

8. Security measures

The Processor maintains appropriate technical and organisational measures, including but not limited to:

• Encryption of data in transit using TLS
• Secure storage of credentials and API keys as encrypted environment secrets
• Access controls with authentication and role-based permissions
• Restricted access to authorised personnel only
• Rate limiting on webhook endpoints
• No storage of sensitive personal data in logs
• Automated pruning of webhook job records after 90 days
• Regular updates and security patching

9. Data retention

9.1 Webhook job records are retained for up to 90 days and then automatically deleted.

9.2 Data stored within the LeadZilla CRM is retained in line with the Controller's use of the Services.

9.3 Upon account termination, Controller Data will be deleted within 30 days unless retention is required by law.

10. International data transfers

10.1 Controller Data may be transferred outside the UK to approved sub-processors listed in Schedule 1.

10.2 Such transfers are carried out using appropriate safeguards, including Standard Contractual Clauses (SCCs) and recognised adequacy frameworks where applicable.

10.3 No other international transfers will be made without prior authorisation.

11. Sub-processors

11.1 The Controller provides general authorisation for the use of sub-processors listed in Schedule 1.

11.2 The Processor will notify the Controller of any changes and provide reasonable notice.

12. Audit rights

12.1 The Controller may request confirmation of compliance.

12.2 Where an audit is required, scope and cost will be agreed in advance.

13. Liability

13.1 Liability under this Agreement is limited to direct losses arising from a proven breach of UK GDPR by the Processor.

13.2 Nothing in this Agreement excludes liability for fraud, gross negligence, or any other liability that cannot be excluded under English law.

14. Governing law

This Agreement is governed by the laws of England and Wales.

15. Acceptance

15.1 This Agreement is concluded electronically. The Controller accepts this Agreement by ticking the acceptance box presented during account onboarding, which constitutes the Controller's electronic signature for the purposes of the Electronic Communications Act 2000.

15.2 The Processor maintains a record of acceptance including the Controller's account identifier, the date and time of acceptance, the IP address from which acceptance was given, and the version of this Agreement accepted.

15.3 The version of this Agreement in force at the time of acceptance governs the relationship until superseded by a new version notified to the Controller.

Signed on behalf of LeadZilla Ltd

Name: Jamie Cureton

Title: Director

(signature on file)

Schedule 1 — Sub-processors

Schedule 2 — Processing summary

• Subject matter: CRM and field service data synchronisation
• Duration: For the term of the subscription
• Nature: Automated transfer, storage, and updating of records
• Purpose: Customer and job management via LeadZilla
• Personal data: See Clause 4
• Data subjects: See Clause 5