1. Our Approach

AiLeadMs is built to help tenants collect and process lead data responsibly. This page explains how we support compliance with the EU General Data Protection Regulation (GDPR) for customers and leads in the European Economic Area, and India's Digital Personal Data Protection Act, 2023 (DPDP Act) for customers and leads in India.

2. Roles: Controller, Fiduciary & Processor

For account, billing, and platform-usage data, AiLeadMs acts as the data controller (GDPR) / data fiduciary (DPDP Act).

For lead and campaign data that a tenant uploads or captures through their own campaigns, the tenant acts as the controller/fiduciary, and AiLeadMs acts as a processor / data processor acting on the tenant's instructions to run campaigns, capture leads, and place IVR calls.

3. Legal Bases for Processing

• Performance of a contract — to provide the Service you've subscribed to.
• Consent — for certain marketing communications, non-essential cookies, and IVR calls placed to leads, where required.
• Legitimate interests — for security, fraud prevention, and service improvement.
• Legal obligation — for tax, accounting, and regulatory compliance.

4. Data Subject / Data Principal Rights

• Right to access the personal data we hold about you.
• Right to correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"), subject to legal retention requirements.
• Right to restrict or object to certain processing.
• Right to data portability, where technically feasible.
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
• Right to nominate another individual to exercise your rights in the event of death or incapacity (DPDP Act).
• Right to lodge a complaint with your local supervisory authority (e.g., a Data Protection Authority in the EU, or the Data Protection Board of India under the DPDP Act).

5. Data Processing Terms for Tenants

Enterprise tenants that need a formal Data Processing Agreement (DPA) covering AiLeadMs' role as processor for their lead and campaign data can request one through our Contact page.

6. Cross-Border Data Transfers

Where personal data is transferred outside of India or the EEA (for example, to an AI or cloud infrastructure sub-processor), we rely on appropriate safeguards such as contractual data-protection clauses, consistent with GDPR and DPDP Act requirements.

7. Breach Notification

In the event of a personal data breach that poses a risk to individuals, we will notify affected tenants and, where legally required, the relevant supervisory authority and affected individuals, without undue delay.

8. Grievance Redressal

Data principals and data subjects can raise a grievance regarding the processing of their personal data via our Contact page. We aim to acknowledge and address grievances within the timelines required by applicable law.

9. Contact Our Data Protection Team

For GDPR, DPDP Act, or general data-protection inquiries, including exercising your rights or requesting a DPA, please use our Contact page.