Privacy Policy

2.1 Roles: Data Fiduciary, Data Processor, and Business

The Business using LeadBee to collect reviews and customer data is generally the Data Fiduciary in relation to that customer data, and determines the purpose of collection (e.g., reviews, offers). LeadBee acts as the Data Processor / significant technology service provider that processes such data on the Business’s instructions. For platform-level data (e.g., Business account details, billing information, aggregated usage analytics), LeadBee acts as the Data Fiduciary.

2.2 Information We Collect

(a) From Businesses (LeadBee customers)

• Business name, contact person, email, phone number
• Billing and payment details (processed via a payment gateway; card data is not stored by LeadBee)
• Account credentials and usage logs

(b) From End Customers (via QR scans, review forms, campaigns)

• Name
• Email address
• Mobile number
• Reviews, ratings, and feedback text
• Device and IP information
• Usage analytics (scan location/time, interaction pattern within the LeadBee flow)

2.3 Purpose of Processing

• To deliver, operate, and personalize the Services for Businesses
• To generate analytics and insights for the Business regarding customer engagement
• To provide customer support to Businesses and, where relevant, end customers
• To detect, investigate, and prevent fraud, abuse, and fake reviews
• To improve, secure, and develop the platform
• To comply with legal obligations and respond to lawful requests from authorities

2.4 Legal Basis and Consent

Where personal data of end customers is collected through LeadBee’s QR/review tools, the Business is responsible for presenting clear notice and obtaining valid, free, specific, informed, and unambiguous consent from the customer before or at the point of collection, as required under the DPDP Act. LeadBee provides consent-capture mechanisms within its tools to support Businesses in meeting this obligation, but the Business remains the party legally responsible for lawful collection vis-à-vis its own customers.

2.5 Data Sharing and Disclosure

LeadBee does not sell personal data. Information may be shared only with:

• Trusted service providers (cloud hosting, analytics, payment processing, messaging/SMS/WhatsApp providers) under contractual confidentiality and data protection obligations
• Law enforcement or regulatory authorities where required by law, court order, or valid legal process
• A successor entity in the event of a merger, acquisition, or asset sale, subject to equivalent privacy protections

2.6 Data Storage and Retention

Personal data is retained only for as long as necessary to fulfil the purposes described in this Policy, to comply with legal, accounting, or reporting obligations, or as instructed by the Business, after which it is securely deleted or anonymized. Businesses may request deletion of end-customer data collected through their account, subject to any legal retention requirements.

2.7 Data Security

LeadBee implements reasonable technical and organizational safeguards, including:

• Encryption of data in transit (TLS) and at rest
• Secure cloud infrastructure with access controls
• Role-based access restricting internal data access to authorized personnel
• Continuous monitoring and periodic security reviews
• Regular backups and disaster recovery procedures

2.8 User Rights

Subject to applicable law, individuals may exercise the following rights regarding their personal data:

• Right to access a summary of personal data processed and the processing activities undertaken
• Right to correction and updating of inaccurate or incomplete personal data
• Right to erasure of personal data that is no longer necessary for the purpose it was collected
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Right to grievance redressal as described in Section 6

Requests may be sent to privacy@leadbee.com. LeadBee (or the relevant Business, as applicable) will respond within the timelines prescribed under the DPDP Act.

2.9 Children’s Data

The Services are not directed to individuals under 18 years of age, and LeadBee does not knowingly process personal data of children without verifiable parental consent, where applicable.

2.10 Cross-Border Data Transfer

Personal data may be processed on servers located within or outside India, subject to any restrictions notified by the Central Government under the DPDP Act. Where data is transferred outside India, LeadBee takes reasonable steps to ensure an equivalent level of protection.

2.11 Cookies and Tracking Technologies

LeadBee’s website and dashboard may use cookies and similar technologies to remember preferences, maintain sessions, and understand usage patterns. Users can control cookie preferences through their browser settings; disabling cookies may affect certain functionality.

2.12 DPDP Act Compliance Statement

LeadBee supports Businesses in complying with the Digital Personal Data Protection Act, 2023 by providing consent-capture tools, data minimization by design, and mechanisms for data access, correction, and deletion. Businesses using LeadBee remain independently responsible for ensuring their own collection and use of customer data complies with the DPDP Act and any sector-specific regulations applicable to them.

2.13 Changes to this Policy

LeadBee may update this Privacy Policy periodically. Material changes will be communicated via email or in-platform notice. The “Effective Date” above reflects the latest revision.