Data Processing Agreement (DPA)
Version of 13 November 2026.
This Data Processing Agreement ("DPA") forms part of the VisitLead terms and conditions. It is entered into between the Customer, as controller, and Quantum Liquid LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States of America ("VisitLead"), as processor. It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR), Article 9 of the Swiss Federal Act on Data Protection (Swiss FADP, revFADP) and, for visitors located in the United States, the requirements of a "service provider" contract under the CCPA. It applies as soon as the Customer installs the VisitLead tag on a website or imports contacts, without a separate signature.
1. Subject matter and duration
VisitLead processes personal data on behalf of the Customer in order to provide it with the Service described in the terms and conditions, for the entire duration of use of the Service and until the data is deleted as provided for in Article 10.
2. Description of the processing
| Nature and purpose | Measuring visits to the Customer's website, recognising the organisation that owns the network of a visit, recognising the return of the Customer's known contacts, sending the signals (digest, alerts, Slack, webhooks) |
|---|---|
| Data subjects | Visitors to the Customer's websites; the Customer's known contacts (customers, prospects, newsletter subscribers, people met); members of the Customer's team |
| Categories of data | Page views (address, title, date), referring website (domain), screen size, language, country, device type; organisation recognised by its network; daily fingerprint; random identifier of the _vl cookie where permitted; for known contacts: email address, name, company, job title, link token, visits |
| Data never processed | Stored IP address (it is only used in memory, during the request); form content other than the email address and the name; passwords; special categories of data |
| Location | European Union (Frankfurt), subject to Article 7 |
3. Instructions
VisitLead processes the data only on documented instructions from the Customer: this DPA, the terms and conditions and the settings the Customer chooses in the application (websites, key pages, Swiss mode, integrations). VisitLead informs the Customer if an instruction appears to it to infringe applicable law. VisitLead does not use the Customer's visitor data for its own purposes, does not sell it, does not share it within the meaning of the CCPA, and does not combine it with the data of other Customers. Only the cache of organisation networks, which contains no data about people, is shared by all Customers.
4. Confidentiality
The persons authorised to process the data are bound by confidentiality and only access it to provide the Service, maintain it or respond to a request from the Customer.
5. Security
VisitLead implements technical and organisational measures appropriate to the risk, in particular:
- a visitor's IP address is never written to the database or to a log;
- keyed fingerprints (HMAC) instead of values for searched email addresses, excluded team IP addresses and cookie identifiers;
- daily fingerprint whose secret is deleted after 48 hours at the latest;
- encryption in transit (TLS) and at rest; separation of data by Customer workspace;
- sign-in through the Lead account, sessions limited to 12 hours, restricted administrator access;
- automatic deletion of visits after 12 months.
6. Sub-processors
The Customer gives general authorisation for the use of the following sub-processors:
| Sub-processor | Service | Place of processing |
|---|---|---|
| Vercel Inc. | Hosting of the application, the tag and the collector | European Union (Frankfurt) |
| Neon (Databricks, Inc.) | PostgreSQL database | European Union (AWS eu-central-1, Frankfurt) |
| Resend | Sending of emails (digest, alerts) | European Union and United States |
| Stripe Payments Europe | Subscription payments (Customer account data only) | Ireland and United States |
| Anthropic | AI Assistant | United States |
VisitLead imposes on each sub-processor data protection obligations at least equivalent to those of this DPA. VisitLead announces any addition or replacement on this page and by email to the Customer's administrators at least 30 days in advance. The Customer may object on reasonable grounds relating to data protection; failing agreement, it may terminate the Service free of charge. To identify the network of a visit, the IP address is transmitted to the public internet registries.
7. Transfers outside Switzerland and the EU/EEA
The data is hosted in the European Union. As Quantum Liquid LLC is established in the United States, access from the United States (support, maintenance) and the use of Resend, Stripe and Anthropic may constitute a transfer. These transfers rely on the European Commission's Standard Contractual Clauses (Decision 2021/914, Module 2 or 3 as applicable), with the addendum for Switzerland, or on the Data Privacy Framework where the recipient is certified under it. These clauses are incorporated into this DPA by reference.
8. Data subject rights
VisitLead helps the Customer respond to requests from data subjects: the application makes it possible to find, export, correct and delete a contact and their visits, and to flag an opt-out. A request received directly by VisitLead is forwarded to the Customer without undue delay. The global opt-out of the /optout page of visitlead.io applies to all Customers: the Customer agrees that the opted-out address is flagged in its workspace and refused in its future imports.
9. Data breaches
VisitLead notifies the Customer of any data breach affecting its data without undue delay, and no later than 48 hours after becoming aware of it, with the information available to enable it to inform the supervisory authority and the data subjects.
10. End of processing
At the end of the Service, or at the Customer's request, VisitLead deletes the personal data processed for the Customer within 30 days, including backup copies at the end of their rotation cycle, unless there is a legal obligation to retain it. The Customer may export its data before the end.
11. Audit
VisitLead makes available to the Customer the information necessary to demonstrate compliance with this DPA. An on-site audit may be agreed no more than once a year, with 30 days' notice, at the Customer's expense, without access to the data of other Customers.
12. Assistance
VisitLead assists the Customer, to the extent of the information available to it, with its data protection impact assessments and prior consultations. The application provides a legitimate interest assessment template and template texts for the Customer's privacy notice.
13. Order of precedence
In the event of a conflict, this DPA prevails over the terms and conditions for all matters relating to data protection. The governing law and jurisdiction are those of the terms and conditions, subject to the mandatory rules of the GDPR and the Standard Contractual Clauses.