Data Protection

Last updated: July 2026

Our role

When you deal with us directly, The Leads Online Ltd is the data controller. When our AI systems run on a client's website, that client is the controller of their visitors' data and we act as their data processor, handling data only on their documented instructions under a data processing agreement.

Principles we follow

• Lawfulness & transparency — data is processed on a valid legal basis and explained in plain language.
• Purpose limitation — collected for specified purposes and not reused incompatibly.
• Data minimisation — our agents collect only what an enquiry or booking genuinely needs.
• Accuracy — inaccurate data is corrected or deleted on request.
• Storage limitation — retention periods are defined and enforced.
• Integrity & confidentiality — appropriate technical and organisational security throughout.

Technical measures

• All traffic encrypted in transit (HTTPS/TLS);
• Passwords stored only as strong one-way hashes — never in plain text;
• Strict tenant isolation: every data query is bound to its owning account;
• Public systems identified by unguessable identifiers, with abuse limits;
• Secrets and credentials kept in protected configuration, never in code;
• Reputable UK/EU/US infrastructure providers under data processing terms.

AI-specific commitments

• Our agents answer only from the business's approved content — they are instructed never to invent facts, prices or policies;
• Conversation data is used to operate the service, not to train public AI models;
• A human handover path exists in every deployment, so people can always reach a person;
• Clients can review, export and delete their conversation, lead and booking data.

Data subject requests

Requests to access, correct or erase personal data are honoured within one calendar month. Email support@theleadsonline.com with the subject "Data request".

Breach response

In the unlikely event of a personal data breach, we assess and contain it immediately and, where required, notify the ICO within 72 hours and affected individuals without undue delay.