Glossary
Data enrichment
Completing a contact you collected by matching it against outside databases, often bought from data brokers. Several lead capture tools sell it as a feature. LeadShake does not do it, so a record only ever contains what the person typed.
Enrichment takes the email address someone gave you and returns a fuller profile: company size, revenue band, direct phone line, sometimes a personal address. The extra fields come from databases assembled elsewhere, usually bought from brokers who compiled them from sources the person was never told about.
It is sold as convenience, and on a spreadsheet it looks like value. The legal position is less comfortable.
Article 14 is the part that gets skipped
When personal data is obtained from somewhere other than the person themselves, article 14 of the GDPR requires you to tell them: what you now hold, where it came from, why you have it, and how long you will keep it. The deadline is one month.
That obligation lands on you, not on the vendor, because you are the controller of the enriched record. Most enrichment workflows never send that notice, which leaves the buyer holding an undisclosed processing operation they did not think they had started.
There is a second problem. The person consented on your form to the fields they filled in, and to nothing beyond them. Adding a direct line they chose not to give is not completing their record, it is collecting new data on a basis they were not asked about.
Why LeadShake leaves it alone
A record here contains what the person typed, and nothing appears in it that they did not choose to write. That is a smaller dataset than a competitor's, and it is deliberate: it keeps your capture on the consent you actually collected, and it means the tool has no purpose of its own to declare.
Questions
Not in itself, but it triggers article 14: data obtained from a source other than the person requires telling them within a month what you hold and where it came from. That duty falls on you as controller, and most enrichment workflows never send that notice.
Related terms
- Data controller
- Under GDPR, whoever decides why and how personal data is processed. When someone fills in your card page, you are the controller of that contact, because it is collected for your purposes.
- Lead capture
- Collecting the contact details of someone you met, with their agreement, so you can follow up. It is the reverse of a business card: instead of giving your details away, you record theirs.
- Data processor
- Under GDPR, whoever processes personal data on a controller’s instructions. LeadShake is the processor for the leads you capture: it stores, emails and exports them for you, and does nothing else with them.