Privacy notice

We sell a data service, so we will be direct about our own data handling. This notice explains what happens on this website, what happens with the contact details we deliver to our clients, and what your rights are.

1. Who is responsible

Georgia is not a member of the European Union and is not covered by an EU adequacy decision. Where we process personal data of people in the EU or EEA, we do so on the basis of the appropriate safeguards described in section 7.

2. Cookies and audience measurement

This site uses no cookies, no local storage, no tracking pixels and no advertising tools. That is why you will not see a cookie banner here: there is nothing to consent to.

Umami (cookieless statistics)

We measure the use of this website with Umami, a self-hosted, cookieless statistics tool. Umami processes technical access data (page viewed, referrer, browser type, coarse origin) without cookies, without cross-site tracking and without building user profiles; IP addresses are not stored. The legal basis is our legitimate interest in privacy-preserving audience measurement (Art. 6(1)(f) GDPR). The instance runs on a domain under our control.

Server log files

Our hosting provider automatically records technical data when a page is requested: IP address, date and time, the page requested, referrer, browser and operating system. This is necessary to deliver and secure the website (Art. 6(1)(f) GDPR: our legitimate interest in a functioning, secure site). These logs are deleted or anonymised after a short retention period by the provider and are not merged with other data.

Hosting is provided by Vercel Inc. as a processor on our behalf.

3. Contact form, consultation, email and phone

When you submit the contact form or the consultation, we process the details you enter: your company name, your name, email address and phone number, what you sell, details about your sales (for example target group, deal value, where your company is based, search regions, team size and the roles you are looking for) and your message. We use them for one purpose: to answer you and, if it fits, to prepare a possible engagement. The form is processed by a server function of our hosting provider Vercel in Frankfurt, Germany. Your enquiry is stored in a database of our provider Turso in the EU. Your enquiry also reaches our mailbox by email, and you receive an automatic confirmation email from the same mailbox. Our mailboxes are hosted by Serverprofis GmbH in Germany. In addition, a push notification via ntfy tells us about new enquiries; it names only the company and what it sells, without any contact details.

• Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in responding to business enquiries).
• Providing the data: voluntary. Without contact details we cannot reply.
• Retention: we keep enquiries for up to 24 months so we can follow up on conversations, then delete them. If you tell us you are not interested, we delete your enquiry within 30 days, apart from what we must keep for tax or accounting purposes.
• Recipients: our own team and the processors named in section 8, who act only on our instructions. We do not sell enquiry data and do not pass it to third parties for their own purposes.

The same applies if you contact us by email or phone instead.

4. Booking a demo call

If you book a demo call on our booking page (vegaleads.ai/book), we process your name, your email address, the time you choose, where your company is based and the time zone derived from it, and, if you used our consultation before, your company and your request. We use these details to arrange and hold the call and to remind you on the morning of the appointment.

• Booking page: the booking is processed by a server function of our hosting provider Vercel in Frankfurt, Germany, and stored in our database at Turso in the EU so that it appears as an enquiry in our cockpit.
• Google Calendar and Google Meet: we add the appointment to our Google Calendar. Google creates the video call link and sends the invitation to your email address. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework. Google's privacy notices also apply to the video call. You can switch your camera and microphone on or off at any time.
• Reminder and notification: we send the reminder on the morning of the appointment from our mailbox at Serverprofis GmbH in Germany. A push notification via ntfy tells us about the booking; it names only the time and the company, without contact details.
• Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, at your request).
• Retention: as with enquiries, up to 24 months. If you cancel and are no longer interested, we delete your details within 30 days, apart from what we must keep by law.

5. The lead data we deliver to clients

This is the part that matters most in our line of work, so we set it out plainly.

What we collect

For our clients we research publicly accessible business information: company websites, legal and imprint pages, and public business directories. This can include the company name, address, business phone number, business email address, website, and the publicly named managing director or owner. Where such details identify a person, they are personal data and this section applies.

Why we may do this

We process this data as a processor on behalf of our client, who is the controller and decides how the contact details are used. The processing rests on the client's legitimate interest in direct business-to-business communication (Art. 6(1)(f) GDPR), balanced against the interests of the people concerned. We do not collect special categories of data, we do not scrape private social media profiles, and we do not buy address lists.

Information and objection

Where personal data is not collected from the person directly, Art. 14 GDPR requires that they be informed. Our clients are contractually responsible for meeting that obligation in their outreach, and for handling objections. If you believe your data has been processed by us on behalf of a client and you want it removed, write to contact@vegaleads.ai and we will suppress the record on our side and pass the request to the client without delay.

Separation between clients

Each client has their own separate database. Lead data is never pooled, never resold, and never shared between clients.

6. When you are our client

To run your cockpit we process your account data (name, business email, hashed password), your configuration, and the data you enter about your own leads. The cockpit and your lead database run on servers in Germany, and access is protected with two-factor authentication. We act as your processor for that data and sign a data processing agreement with you before delivery starts. You can export your data at any time. If our agreement ends, you receive a full export and we delete your database within 30 days, or immediately on request.

Passwords are stored only as a cryptographic hash. We cannot read them.

7. International transfers

We are established in Georgia, and some of our processors are established in the United States. Where personal data from the EU or EEA is transferred to us or to those processors, the transfer is based on the European Commission's Standard Contractual Clauses together with additional technical measures, in particular encryption in transit and separation of client databases. You can request a copy of the relevant safeguards from us.

8. Processors we use

• Serverprofis GmbH (Germany): operation of client cockpits, lead databases and our mailboxes
• Vercel Inc. (USA): hosting of this website, the contact form function (region Frankfurt) and log files
• Turso (USA, database in the EU): storage of contact enquiries
• ntfy (ntfy.sh): push notification about new enquiries, without contact details
• Firecrawl: retrieval of publicly accessible website content
• Email providers: communication

Each of these acts on our documented instructions under a data processing agreement. For bookings we also use Google Calendar and Google Meet by Google Ireland Limited (section 4).

9. Your rights

You have the right to request access to your personal data, to have inaccurate data corrected, to have data erased, to have processing restricted, to receive your data in a portable format, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time with effect for the future.

To exercise any of these, write to contact@vegaleads.ai. We answer within 30 days.

You also have the right to lodge a complaint with a data protection supervisory authority, in the EU normally the authority of your habitual residence or place of work.

10. Security

Traffic is encrypted in transit (TLS). Access to client cockpits requires authentication, sessions expire, and each client's data lives in its own database rather than in a shared table. Passwords are hashed. Access to production data is limited to the people who need it to run the service.

11. Changes

We update this notice when our processing changes. The date at the top always shows the current version.