Privacy Policy

1. Information We Collect

• Account Data: Name, email address, and billing details (processed securely by Gumroad).
• Usage Data: IP address, browser type, device info, and interaction logs.
• Communication Data: Records of support tickets and email correspondence.

2. Legal Basis for Processing

Under GDPR Article 6, we process data based on:

• Contractual Necessity: To provide the services you purchased.
• Legitimate Interests: To improve security, prevent fraud, and enhance our platform (subject to a balancing test against your rights).
• Legal Obligation: To comply with tax and financial regulations.
• Consent: For marketing communications (where applicable).

3. Cookies & Tracking Technologies

We use cookies to enhance functionality. We will implement a granular cookie consent mechanism in the future.

• Essential: Required for login and security.
• Functional: Remember your preferences.
• Analytics: Anonymous usage data.

4. Third-Party Service Providers

We share data only with trusted partners essential for our service:

• Gumroad: Payment processing (Privacy Policy).
• Email Providers: Delivery of daily data feeds.
• Analytics Providers: Aggregated traffic analysis.

5. International Data Transfers

Your data may be processed in countries outside your residence, including India and the US. We rely on Standard Contractual Clauses (SCCs) and adequacy decisions to ensure your data remains protected in compliance with GDPR.

6. Data Security Measures

We implement robust technical and organizational measures to protect your data, including:

• Encryption: TLS/SSL for data in transit.
• Access Controls: Strict role-based access for employees.
• Audits: Regular security reviews of our infrastructure.

7. Data Retention Periods

• Active Accounts: Retained for the duration of your subscription.
• Financial Records: Retained for 7 years to comply with tax laws.
• Marketing Data: Retained until you opt-out.

8. Your Data Protection Rights

Under GDPR and CCPA, you have the right to:

• Access: Request a copy of your data (available in CSV/JSON format).
• Rectification: Correct inaccurate information.
• Erasure: Request deletion ("Right to be Forgotten").
• Restriction: Limit how we process your data.
• Object: Object to processing based on legitimate interests.
• Portability: Receive your data in a machine-readable format.

To exercise these rights, contact us at support@globalleadrefinery.com. We respond within 30 days.

9. CCPA Notice

Do Not Sell My Personal Information: We do not sell your personal information. California residents may request disclosure of data categories and specific pieces of information collected.

10. B2B Lead Data We Provide

The data in our reports is strictly B2B commercial information aggregated from public registries. We do not knowingly collect private consumer data.

11. Children's Privacy

Our services are strictly B2B and not intended for individuals under 18. We do not knowingly collect data from children under 13 in compliance with COPPA.

12. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR.

13. Automated Decision-Making & AI

We use automated algorithms to filter and verify business leads. This does not produce legal effects concerning you or similarly significantly affect you.

14. Data Minimization

We only collect and process data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

15. Sensitive Data We Don't Collect

We explicitly do NOT collect: biometric data, health data, political opinions, religious beliefs, or financial credit scores.

16. Marketing Communications

You can opt-out of marketing emails at any time by clicking the "unsubscribe" link in the email footer.

17. Changes to This Policy

We may update this policy. For material changes, we will provide 30 days' notice.

18. Contact & Complaints

EU/UK Residents: You have the right to lodge a complaint with your local data protection authority:

• UK Information Commissioner's Office (ICO)
• European Data Protection Board (EDPB)