Glossary
Data processor
Under GDPR, whoever processes personal data on a controller’s instructions. LeadShake is the processor for the leads you capture: it stores, emails and exports them for you, and does nothing else with them.
Article 4(8) defines the processor as whoever processes personal data on behalf of the controller. The defining feature is the absence of its own purpose: a processor acts on instructions and gains nothing from the data beyond being paid to handle it.
For the contacts captured on your page, that is LeadShake. It stores them, sends the connection and follow up emails you configured, produces your XLSX export, and stops there. It does not resell them, does not enrich them, and does not use them to train anything.
What article 28 requires of the arrangement
A written agreement, which the terms of service and the privacy policy provide together. Processing only on documented instructions. Confidentiality and appropriate security. Disclosure of any subprocessor, which here means Stripe for payments and the hosting operated inside the European Union. Assistance when a person exercises their rights. And deletion at the end of the relationship, which for LeadShake is immediate and unconditional: deleting your account erases the leads with it.
The distinction has a practical edge
A processor cannot decide to do something new with your contacts, because deciding is what a controller does. If LeadShake started matching your leads against bought databases, it would stop being a processor for that operation and become a controller of it, with its own obligations to the people concerned.
That is the line, and it is worth understanding before comparing tools: a vendor that advertises enrichment is telling you it processes for purposes of its own.
Questions
Yes, for the contacts you capture. It stores them, emails them and exports them on your instructions, and does nothing with them for its own purposes.
Related terms
- Data controller
- Under GDPR, whoever decides why and how personal data is processed. When someone fills in your card page, you are the controller of that contact, because it is collected for your purposes.
- Lead capture
- Collecting the contact details of someone you met, with their agreement, so you can follow up. It is the reverse of a business card: instead of giving your details away, you record theirs.