Data Processing Terms

You are the controller of personal data in your leads. [Company legal name, to be added] is your processor and processes it only to provide Kestrel and on your documented instructions.

Business contact details and, sometimes, names and job titles of people at those businesses, plus notes and drafts you add. We do not intend to process sensitive personal data; please do not add it.

• Process data only on your instructions and keep it confidential.
• Make sure our people who access it are bound by confidentiality.
• Use appropriate technical and organisational security measures.
• Use sub-processors only under written terms with equal protection, and tell you before adding new ones.
• Help you answer requests from individuals exercising their rights.
• Tell you without undue delay after becoming aware of a personal data breach.
• Delete or return data when your account ends, unless the law requires us to keep it.
• Make available the information needed to show we meet these terms.

The current list is on our Sub-processors page.

Transfers outside the UK or European Economic Area use recognised safeguards, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

For a signed copy of these terms or privacy questions, contact [Privacy email, to be added].