PRIVACY POLICY TRACKLEAD B.V. Version: 1.1  |  Last updated: November 2, 2026 Note: this is an English translation of the Dutch privacy policy. The Dutch version is legally binding in the event of any discrepancy.

1 -- INTRODUCTION AND IDENTITY

TrackLead B.V. (hereinafter: "TrackLead", "we" or "us"), established in Breda, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 42155616 is committed to the protection of personal data.

In this privacy policy, "the Service" refers to: the cloud-based SaaS platform of TrackLead B.V. that enables users to set up, manage and monitor tracking and measurement infrastructure, including all associated functionalities as described in the general terms and conditions.

This privacy policy describes how we process personal data for which TrackLead B.V. acts as data controller. This applies to:

• visitors to our marketing website (tracklead.eu);

• users of the Service (agencies, marketers and other professionals who use the Service), including data from Google accounts they connect to the Service (see section 11).

Important distinction: personal data processed through the Service on behalf of the end customers of our users falls outside the scope of this policy. For those processing activities, TrackLead acts as a data processor on behalf of the user (the data controller). Those processing activities are governed exclusively by the Data Processing Agreement (DPA) which forms part of our general terms and conditions. Both documents are available at tracklead.eu.

TrackLead has not appointed a Data Protection Officer (DPO), as TrackLead is not required to do so under the GDPR. For questions about this policy or about the processing of your personal data, please contact us at:

Email: connect@tracklead.eu

2 -- PERSONAL DATA WE COLLECT

2.1 Visitors to the marketing website

When you visit our website, the following data may be processed:

• IP address and device information (via Google Analytics 4);

• browser type and operating system;

• pages visited and click behaviour;

• referring URL;

• name and email address (via the contact form).

2.2 Users of the platform

When creating an account and using the Service, we process:

• name and email address (for account management and communications);

• company name and job title;

• billing details (company name, address, VAT number), processed via Stripe;

• payment details (processed by Stripe -- we do not store full payment details ourselves);

• usage and login data (for security and product improvement);

• technical configuration data you enter when using the Service;

• data from connected Google accounts: an encrypted OAuth token, the email address of the connected Google account, and the names and IDs of Google Tag Manager containers and Google Analytics properties (see section 11);

• communication and task data recorded in our business system Buddy's Flow (see section 5.3).

3 -- PURPOSES AND LEGAL BASES

3.1 Performance of a contract (Art. 6(1)(b) GDPR)

We process personal data to the extent necessary for the performance of the agreement, including:

• creating and managing your account;

• providing the Service (implementations, monitoring, configurations), including the actions in connected Google accounts that you instruct us to perform;

• invoicing and payment processing;

• technical support and customer service.

3.2 Legitimate interests (Art. 6(1)(f) GDPR)

We process personal data based on legitimate interests for:

• responding to enquiries and requests submitted via the contact form -- someone who reaches out proactively expects a response;

• fraud prevention and security of our platform;

• retaining a deleted account for a short period (90 days), so it can be restored if it was deleted by mistake;

• retaining customer and contract data in Buddy's Flow for up to 2 years after the agreement ends, to settle contractual obligations, complaints and possible disputes.

  
  

3.3 Consent (Art. 6(1)(a) GDPR)

For cookies and similar technologies that are not strictly necessary, including Google Analytics 4, we ask for your consent through our cookie banner (managed by Cookiebot). You may withdraw your consent at any time via the cookie settings on our website. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

3.4 Legal obligation (Art. 6(1)(c) GDPR)

We retain invoicing and payment data in accordance with applicable fiscal and accounting retention obligations (7 years).

3.5 No profiling or automated decision-making

TrackLead does not carry out profiling and does not make decisions about data subjects based solely on automated processing within the meaning of Article 22 GDPR.

4 -- COOKIES AND TRACKING ON THE WEBSITE

Our marketing website uses cookies and similar technologies. We distinguish between:

• Functional cookies: necessary for the website to function. No consent required.

• Analytical cookies (Google Analytics 4): measure website visits and behaviour. Only placed after your consent.

You may adjust your cookie preferences or withdraw your consent at any time via the cookie settings at the bottom of our website. Cookie consent is managed via Cookiebot.

5 -- THIRD PARTIES AND SUB-PROCESSORS

For the delivery of our services and business operations, we use the following external parties that may process personal data on behalf of or together with TrackLead:

5.1 Payments

• Stripe Inc. (US) -- payment and billing data processing. More information: stripe.com/privacy.

5.2 Tracking and measurement infrastructure (Service)

The parties below are used as technical infrastructure for the Service. For these processing activities, TrackLead acts as a data processor on behalf of the user. The user is the data controller for the data of their end customers that flows through this infrastructure. Which parties are used depends on the user's choice.

• Stape, Taggrs.io (EEA) and AdPage (Netherlands, EEA): server-side tracking infrastructure;

• Google Tag Manager (US): tag management;

• Meta Conversions API (US): server-side advertising tracking on behalf of users of the Service;

• CookieScript (Lithuania, EEA) and Consent.Studio: consent management on users' websites.

5.3 Business operations (Buddy's Flow)

For our internal business operations we use Buddy's Flow, an integrated platform for email, CRM, marketing, accounting and tasks/tickets, hosted in Germany (EEA). The following personal data of (prospective) customers, contacts and suppliers may be processed via this system:

• name and contact details (email address, phone number, company name);

• communication history (email and messages);

• CRM data (quotes, contract status, notes);

• financial data (invoices, payments);

• tasks and tickets related to customer projects.

Processing in Buddy's Flow takes place on the basis of the performance of a contract (Art. 6(1)(b) GDPR) or legitimate interests (Art. 6(1)(f) GDPR). A data processing agreement has been concluded with Buddy's Flow. As the servers are located in Germany, no transfer outside the EEA takes place.

5.4 Consent management

• Cookiebot (Usercentrics A/S, Denmark) -- management of cookie consent on the marketing website. More information: cookiebot.com/privacy.

5.5 Website analytics

• Google Analytics 4 (Google Ireland Ltd. / US) -- website analytics based on consent. More information: policies.google.com/privacy.

5.6 Hosting and database

• Hetzner Online GmbH (Germany, EEA): application servers.

• Supabase Inc. (data hosted in Ireland, AWS region eu-west-1): database.

• We have concluded a data processing agreement with both parties.

6 -- INTERNATIONAL DATA TRANSFERS

Some of the parties mentioned above are located outside the European Economic Area (EEA). We ensure that transfers of personal data to third countries take place on the basis of appropriate safeguards in accordance with Chapter V GDPR. The applicable transfer basis per party is set out below:

SCCs = Standard Contractual Clauses as adopted by the European Commission. DPF = EU-US Data Privacy Framework.

7 -- RETENTION PERIODS

We do not retain personal data for longer than necessary for the purposes for which it was collected, unless a statutory retention obligation requires a longer period:

• Account data in the Service (including data from connected Google accounts): for as long as the account exists. After deletion, the data can be restored for 90 days; after that it is permanently deleted.
  Google OAuth tokens: for as long as the connection exists; deleted and revoked immediately when you disconnect.
  Access token from the end-client onboarding flow: deleted as soon as sharing succeeds, never kept longer than 15 minutes.

• Invoice and payment data: 7 years based on fiscal retention obligations.

• Website analytics data (GA4): maximum 14 months.

• Contact form data: maximum 1 year after last contact.

• CRM and communication data (Buddy's Flow): for the duration of the customer relationship, plus a maximum of 2 years after termination based on legitimate interests.

• During monitoring as part of the Service, IP addresses, cookie IDs and events from visitors to our users' websites may be processed temporarily. We do not store this data. This processing is governed by the DPA.

8 -- YOUR RIGHTS AS A DATA SUBJECT

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): you may request an overview of the data we process about you.

• Right to rectification (Art. 16 GDPR): you may have inaccurate or incomplete data corrected.

• Right to erasure (Art. 17 GDPR): you may request deletion of your data, to the extent no statutory retention obligation applies.

• Right to restriction of processing (Art. 18 GDPR).

• Right to data portability (Art. 20 GDPR).

• Right to object (Art. 21 GDPR): you may object to processing based on legitimate interests.

• Right to withdraw consent (Art. 7(3) GDPR): withdrawal does not affect the lawfulness of prior processing.

Submitting a request is free of charge, unless your request is manifestly unfounded or excessive (Art. 12(5) GDPR).

You may submit your request to: connect@tracklead.eu

We will respond within the statutory period of one (1) month. We may ask you to verify your identity before processing your request.

If you believe we are processing your personal data in a manner inconsistent with applicable law, you have the right to lodge a complaint with the competent supervisory authority in your country of residence. TrackLead is established in the Netherlands; the lead supervisory authority is:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

P.O. Box 93374, 2509 AJ The Hague, the Netherlands

autoriteitpersoonsgegevens.nl

9 -- SECURITY

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure. These measures include access control, logging of system access, encryption of OAuth tokens (AES-256-GCM), secure infrastructure and separation of customer environments where technically possible.

For the security measures applicable to the Service (as data processor), please refer to the DPA (Article 9), available at tracklead.eu.

10 -- CHANGES TO THIS POLICY

We reserve the right to amend this privacy policy. Any changes will be published on tracklead.eu. The date of the most recent version is stated at the top of this document. In the event of material changes, we will notify you proactively, for example by email.

11 -- GOOGLE USER DATA

TrackLead works in the Google accounts of our users and their clients. This section describes exactly which Google user data we access, what we use it for, and with whom we share it.

11.1 What we request access to

Google Tag Manager: read, edit, create and publish versions, and manage user permissions.

Google Analytics: read account and property lists, and manage user permissions.

In each situation we request the narrowest set of permissions the action requires. Someone who only shares access never grants permission to edit or publish containers.

11.2 What we store

An encrypted OAuth refresh token and the email address of the connected Google account. Tokens are encrypted with AES-256-GCM, are only decrypted on our servers and never reach your browser.

In the end-client onboarding flow we do not request a refresh token. The access token from that flow is deleted as soon as sharing succeeds, and is never kept longer than 15 minutes.

11.3 What we use it for

Only for the action you instruct us to perform in your own account: creating containers and tags, publishing a version, or granting an account access. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.

TrackLead's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

11.4 With whom we share Google user data

We share Google user data only with the parties below, and only to the extent the action you instruct requires:

1. The agency you grant access to. If you share access to your Google Tag Manager container or Google Analytics property through an onboarding link, we grant that agency's Google account the permissions you approve. That agency's TrackLead users can then see the names and IDs of the shared containers and properties.

2. Members of your own TrackLead workspace. They can see the names and IDs of connected containers and properties, and the email address of the connected Google account. They never see OAuth tokens.

3. Your server-side tagging provider (Stape, Taggrs or AdPage), if you choose one. To set up your server container, we send that provider the container configuration and container ID needed to run the container. We send nothing else.

4. Our infrastructure providers: Supabase (database, hosted in Ireland, AWS region eu-west-1) and Hetzner (application servers, in Germany). They only store or process data on our instructions, under a data processing agreement, and do not use it for their own purposes. Tokens are encrypted before they reach them.

5. Government authorities, when required by law, and only to the extent required by law.

6. A successor in the event of a merger or acquisition. The data will remain subject to this policy, and we will notify you in advance.

We do not share Google user data with anyone else.

11.5 How to revoke access

You can disconnect at any time in the application. We then delete the stored tokens and revoke them with Google. You can also revoke access yourself at any time via myaccount.google.com/permissions. The configuration in your own Tag Manager container keeps working afterwards, because it is yours.

11.6 Retention

We keep tokens for as long as the connection exists; when you disconnect, we delete and revoke them. If an account or organisation is deleted, we keep the data for 90 more days so it can be restored, and then permanently delete it.

12 -- CONTACT

For questions, requests or complaints regarding the processing of your personal data:

TrackLead B.V.

Breda, the Netherlands

KvK / CoC: 42155616

Email: connect@tracklead.eu

TrackLead B.V. -- Privacy Policy version 1.1