What we store, and who answers for it

The operator of LeadShake is Kern IT, company number BE0845906217, registered at Rue Belliard 2A, 1040 Bruxelles, Belgium. LeadShake is the name of the service Kern IT operates.

For anything in this policy, write to contact@leadshake.io. Service emails are sent from noreply@leadshake.io, an address that does not accept replies.

For your account, we are the controller. Your email address, your name, what you put on your own card and how you use the service: we decide why and how that is processed, and this policy is where we say so.

For the contacts you capture, you are the controller and we are the processor. When someone fills in the form on your card page, they are your prospect, in your register. We store, email and export them on your instructions and for no purpose of our own. We do not resell them, do not enrich them from outside databases, and do not use them to train anything.

That distinction is not a formality. It means the person who fills in your form deals with you about their data, and you deal with us. If they ask you to erase them, you can do it yourself from your dashboard, without going through us.

From you, the account holder. Email address, first and last name, and whatever you choose to add to your profile: phone, job title, company, biography, LinkedIn address, Calendly link, profile picture and company logo. What you put on your card is public by design, since a card is meant to be shown.

From the person who fills in one of your card pages. Only the fields they complete: email, first and last name, company, phone, LinkedIn, job title and a free message. Nothing is inferred, nothing is bought from a data broker. The form carries its own consent checkbox, and nothing is written to your register until it is ticked.

From the visit itself. A timestamp, the IP address, the browser user agent and the referring page. This is kept to count scans and to tell a real visit from a bot, which is the minimum that makes a scan counter mean anything.

From the emails we send on your behalf. Connection and follow-up emails contain an invisible one-pixel image. Loading it records that the message was opened, and clicking a link in it records that too. This is how the open rate in your dashboard is produced. It is stated here rather than buried, because a tracking pixel is a processing operation like any other.

From a purchase. Your billing details and the payment reference. Card numbers never reach our servers: the payment happens on Stripe's own pages.

• Performance of the contract, for everything needed to run the account you opened and the passes you bought
• Legitimate interest, for security, fraud prevention, and the scan counts that make the product work, weighed against the fact that no profile is built and nothing leaves the platform
• Legal obligation, for invoicing and accounting records
• Consent, given at the point of capture by the person filling in a card form, and separately for the NFC waiting list

We do not send marketing email to the contacts you capture. They hear from you, under your name, because they asked to be in touch with you.

The list is short, and it is exhaustive:

• Stripe, for payments and invoices. Stripe is a payment service provider and an independent controller for its own compliance obligations
• The hosting and email infrastructure operated by Kern IT inside the European Union

There is no advertising network, no analytics broker and no data broker in the chain. If that list ever grows, this section changes before the subprocessor is used.

On servers located in the European Union, operated by Kern IT from Belgium. Leads, campaigns and account data never leave that perimeter, and there is no replication to a region outside the EU.

Because both the operator and the infrastructure are inside the Union, no transfer mechanism such as standard contractual clauses is needed for the hosting itself.

• While your account is open, your account data and your leads stay available to you. We do not expire your contacts: a campaign that has run out only stops capturing, and everything already captured stays readable and exportable
• When you delete your account, the erasure is immediate and it is a real delete, not an archive. Your account, your campaigns, your leads, the scan records and the files you uploaded are removed from the database. There is no thirty-day grace period and no hidden copy
• Invoices and accounting records are kept for seven years, as Belgian tax law requires. That obligation survives the deletion of the account, and it is the only thing that does
• An unused credit lapses on the date shown in your dashboard, twelve months after purchase for a three-event pack. Lapsing removes the credit, not the contacts you already captured

Under the GDPR you may ask for access to your data, its correction, its erasure, a restriction on its use, its portability, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time, without affecting what was done before.

Most of this needs no request at all:

• Access and portability: export your leads to XLSX from the dashboard, whenever you like
• Correction: edit your profile and your leads directly
• Erasure: delete your account yourself from the settings page. If you own an organisation with other members, transfer it or empty it first, because their campaigns and their leads hang off it

For anything the interface does not cover, write to contact@leadshake.io. We answer within a month, as the regulation requires, and usually well before.

The public pages of leadshake.io use no advertising cookie and no third-party tracker.

The application uses what it needs to keep you signed in: a session token stored in your browser, valid for seven days. It carries no advertising purpose and is not shared.

The one tracking technique worth naming is the open pixel in the connection and follow-up emails, described in section 3.

If you believe your data is being handled improperly, tell us first: it is usually faster. You may in any case lodge a complaint with the Belgian supervisory authority.

Autorité de protection des données / Gegevensbeschermingsautoriteit Rue de la Presse 35, 1000 Brussels, Belgium +32 2 274 48 00, contact@apd-gba.be www.dataprotectionauthority.be

When this policy changes in a way that affects you, the date at the top changes and account holders are told by email before it takes effect. Older versions are available on request.