Free100Leads
Data processing
Last updated 19 August 2026
Who is responsible for what
This is the part that gets confused most often, so it comes first. There are two separate pieces of data and they have different owners.
| Data | Controller | Meaning |
|---|---|---|
| The contact database | Free100Leads | We decide what is collected, from where, and how long it is kept. Removal requests come to us. |
| Your copy of a batch | You | From the moment you export a record into your own systems, you decide what happens to it. You answer to the people you contact. |
| Your visit to this site | Free100Leads | The cookie and counters that ration your daily hundred. |
We are not your processor. We do not handle data on your instructions, and you do not tell us what to keep or delete. We are two independent controllers who happen to hold overlapping records.
What that means for you in practice
Once a record is in your CRM, it is on you to:
- Tell people you hold their data, within a month of first contacting them.
- Have a lawful basis of your own, usually legitimate interests for B2B outreach.
- Honour objections, deletions and access requests aimed at your copy.
- Keep it accurate, and stop using it when it stops being relevant.
- Follow the marketing rules described in the terms.
Deleting a person from our database does not delete them from yours. If someone asks you to remove them, that request is yours to action.
Security measures
The technical and organisational measures required by Article 32 are described on the security page rather than repeated here, so that there is one version of them to keep current.
Requesting a signed agreement
If your procurement process needs a countersigned DPA, joint controller arrangement, or a completed vendor security questionnaire, send it through the contact form. Include your entity name and the countries you operate in.
We will also share the legitimate interests assessment behind the database on request. It is the document your data protection officer will actually want.
Audits
We do not hold ISO 27001 or SOC 2 today, and we would rather say so than imply otherwise. Card data is handled entirely by Stripe, who do hold both, so the scope of what we process is narrower than the question usually assumes. For the rest, the architecture on the security page is the assurance, and you are welcome to test it under the rules described there.