Introduction & Scope
OmniLead is a business service. Most of the personal data that flows through it is data about our customers’ own leads and customers, which those customers decide to process. This policy therefore describes two different things: what we do with personal data of our own (visitors, account holders, people who contact us), and what we do with the personal data our customers process through the service.
This policy applies to omnilead.eproz.business, app.omnilead.eproz.business and our APIs. The Effective Date of this policy is 16 August 2026.
Who Is Responsible
EPROZ is the controller for the personal data we process for our own purposes: website visitors, account registration and administration, billing, support requests, security and our own business communications. This policy describes that processing and is the notice we give you about it.
For personal data a customer processes through OmniLead once the application is live, the customer is the controller. They decide whose data goes into the service, why, and for how long. We act as a processor for that data and handle it to provide, secure and support the service on the customer’s instructions. If you are a person whose data a customer has put into OmniLead and you want it accessed, corrected or deleted, contact that customer directly. If you contact us instead, we will pass the request on to them.
These roles depend on the actual circumstances of the processing. Where the facts differ from the description above, the allocation of roles under data-protection law follows the facts.
Information We Collect
Information you give us directly
- Account information: name, email address, phone number, company name and role
- Billing information: billing contact and address, VAT details, subscription and invoice records
- Profile and workspace settings: time zone, language, notification preferences and team-member access
- Configuration and uploaded content: workspace settings and files you upload to operate your account
- Support communications: the messages, tickets and attachments you send us when you ask for help
Data you process through the service
The categories of customer-processed data for OmniLead have not been published yet. A full OmniLead-specific description will replace this section before launch.
Payment information
When you subscribe to a paid plan, payment card details are handled by our payment processor. We do not store full card numbers on our servers; we may store a payment token, the last four digits of the card, the card brand and your billing address.
Information we collect automatically
- Usage data: pages and features used, actions taken in the application, and errors encountered
- Technical data: IP address, browser, device and operating system, and referring URL
- Log and security data: server logs, authentication attempts and security events
How We Use Information
- To provide, operate, maintain and improve the service
- To provide customer support and respond to your requests
- To process billing, manage your subscription and detect fraud
- To secure the service and prevent abuse and security incidents
- To send service emails and, with your separate consent, marketing emails
- To comply with legal obligations and respond to lawful requests
Additional OmniLead-specific uses of personal data will be published with the product legal rewrite.
We do not sell personal data, and we do not share personal data with third-party advertisers for cross-context behavioural advertising.
AI Processing
A full description of any AI processing in OmniLead will be published with the OmniLead legal rewrite.
AI outputs can be inaccurate or incomplete. They are not a substitute for human review where the subject matter matters — see the AI Outputs section of our Terms of Service.
Legal Bases
Where data-protection law such as the GDPR requires a legal basis for the personal data we process as controller, we rely on the following:
- Contract performance: processing necessary to provide the service you signed up for and to administer your account
- Legitimate interests: securing the service, preventing fraud and abuse, improving the product, and establishing or defending legal claims
- Consent: marketing emails and any other processing that requires consent, which you can withdraw at any time
- Legal obligation: tax, accounting and other regulatory requirements that apply to us
Where we act as a processor for a customer, that customer is responsible for having a legal basis for the personal data they put into the service.
You can object to processing based on legitimate interests, or withdraw consent, at any time by contacting us at privacy@eproz.business.
Hosting, Data Sharing & Processors
Where your data is hosted
OmniLead and the data you process through it are hosted on cloud infrastructure in the European Union. Data is encrypted in transit using TLS, and access to production systems is restricted to authorised personnel.
Sub-processors
We rely on the following categories of sub-processor to handle personal data on our behalf. We require each of them to process personal data only under appropriate data-protection terms. Which of them apply to you depends on the channels and capabilities you enable.
| Category of sub-processor | Purpose |
|---|---|
| AI service providers | Where enabled, processing that the service uses AI providers to perform, as described when that processing is documented |
| Messaging and communication providers | Sending and receiving service or product communications where those capabilities are enabled |
| Cloud hosting and infrastructure providers | Application hosting, databases, storage and backups |
| Payment processing provider | Subscription billing, invoicing and payment fraud prevention |
| Email delivery provider | Sending account, service and support emails |
The specific providers within each category, and where they process data, can change over time. You can request the current list, and ask to be told about changes, by contacting us at privacy@eproz.business.
Beyond these sub-processors, we do not sell personal data. We may share data with professional advisors under confidentiality obligations, with authorities where the law requires it, and in connection with a merger, acquisition or sale of assets subject to appropriate protections.
International Transfers
Our infrastructure is located in the European Union. Where a sub-processor processes personal data outside the European Economic Area, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism.
You can ask us for information about the safeguards that apply to a given transfer by contacting us at privacy@eproz.business.
Data Retention
We keep personal data only for as long as we need it for the purposes described in this policy, or for as long as the law requires.
- Account data: retained for as long as your account is open, and deleted or anonymised within a reasonable period after you close it
- Customer data in the application: Account data is retained for as long as your account is active, and is deleted from active systems within a reasonable period after your account is closed, unless a longer period is required by law.
- Financial records: retained for the period required by applicable tax and accounting law
- Backups: Backups are kept on a rolling basis and are overwritten in the normal course of operation.
- Server logs and security events: Server logs and security events are retained for a limited period for security, troubleshooting and abuse prevention.
As a customer you control retention of the data you process through the service: you can delete records in the application, and you can export your data before you close your account. You can ask us at privacy@eproz.business for the retention periods that apply to a specific category of data.
Your Rights
Under the GDPR and similar laws you have the following rights over your personal data. Some of them apply only in particular circumstances, and some are subject to exceptions — for example where we have to keep records for tax or legal reasons, or where a request would reveal someone else’s personal data.
- Access: to be told whether we process your personal data and to receive a copy of it
- Rectification: to have inaccurate or incomplete data corrected
- Erasure: to have your data deleted where one of the grounds in the law applies
- Restriction: to have processing limited while a dispute about accuracy or lawfulness is resolved
- Objection: to object to processing based on legitimate interests, and to object to direct marketing at any time
- Portability: where processing is based on consent or a contract and is carried out by automated means, to receive your data in a structured, commonly used, machine-readable format
- Withdrawal of consent: where we rely on consent, to withdraw it at any time, without affecting processing carried out before you withdrew it
- Complaint: to lodge a complaint with your local data-protection supervisory authority
To exercise these rights, contact us at privacy@eproz.business. We will respond within the time limits set by applicable law and may need to verify your identity first. If your data was given to a business that uses OmniLead, that business is the controller and we will forward your request to them.
Children
OmniLead is a business service and is not directed to children. It is not intended for individuals under 18 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us at privacy@eproz.business and we will delete it.
Security
We use technical and organisational measures appropriate to the risk to protect personal data, including:
- Encryption of data in transit using TLS
- Access controls that limit access to production systems and personal data to authorised personnel who need it
- Authentication and access logging on accounts and administrative actions
- Periodic review of our security measures
We do not currently claim any third-party security certification or audit for OmniLead. If that changes, we will say so here rather than implying it.
No system can be completely secure. If we become aware of a personal data breach that is likely to result in a risk to people’s rights, we will notify the relevant supervisory authority and affected users as required by applicable law, and we will inform any customer whose data is affected without undue delay.
Changes to This Policy
We may update this policy from time to time. For material changes we will give reasonable advance notice by email or in-app notice before the changes take effect. For non-material changes we will post the updated policy here with a revised “Last updated” date.
Contact
For privacy questions, or to exercise your rights, contact us at the address below. Please include enough information for us to verify your identity and act on your request.
- EPROZ
- Privacy contact: privacy@eproz.business
You also have the right to lodge a complaint with the data-protection supervisory authority in the country where you live or work.
Privacy and legal requests go to privacy@eproz.business. That address is not a product or sales inbox.