Data Processing Addendum

Last updated 24 September 2026

Roles

For the planning records themselves PlanningLeads is an independent controller: the data comes from public statutory registers, is held at organisation level, and every personal identifier is gated or purged as described in our privacy notice. For the account data you give us (names, emails, saved searches, API keys, usage) PlanningLeads is the controller of that account. Where you put your own contact lists or notes into the CRM fields, PlanningLeads is the processor and you are the controller; this addendum governs that processing.

What we process for you

Account identifiers, saved searches and bookmarks, CRM notes typed against a lead, webhook endpoints, API keys (hashed), a request log holding the route template, status, timing and key id, never a path, query string or body, and a per-key daily count of requests and errors. Where an account holds an Enterprise data licence we also hold the licence record itself: the organisation, the scope, the seats, the term and our contract reference.

Sub-processors

We give 30 days' notice of a new sub-processor by email to the account owner.

Security measures

TLS on every connection, HSTS and a strict Content-Security-Policy; API keys hashed with SHA-256 and shown once; HMAC-signed webhooks; per-key rate limits and export caps; session cookies with CSRF tokens; EU hosting in ISO 27001-certified data centres; nightly encrypted backups with scheduled restore drills; key-based administrative access with automated intrusion banning; and regular operating-system and dependency patching. Administrative privilege over accounts is not stored in the database: it is read from an environment allowlist on the server, no endpoint grants it, and administrative endpoints refuse an API key outright. Every privileged act against an account is written to an append-only log naming the administrator who performed it. More at Trust & Security.

Retention and deletion

Account data is deleted within 30 days of account closure. Request logs roll off continuously once the ledger reaches its cap, which at current volume is a little over a day; the per-key daily counts that summarise them are kept for the life of the account so that consumption can be evidenced over a full term. Backups roll off after 14 days. One record deliberately outlives the account: the append-only log of privileged administrative acts, including the grant or revocation of a data licence and the deletion of an account. It holds business-account identifiers only, never planning-record data, and we retain it on the basis of legitimate interest and, for licence grants, the establishment and defence of legal claims (Article 17(3)(e)). Individuals named in public planning records can ask for suppression at privacy@planningleads.ie and the record is hidden from every surface within 72 hours of the request.

Breach notification

We notify affected account owners without undue delay, and within 72 hours of becoming aware, with what happened, what data was involved and what we have done.

Audit and assistance

On request we provide this addendum, the sub-processor list, the security summary and our incident history, and we assist with data-subject requests that concern data we process on your behalf.

Data location and transfers

Production data is stored in Germany. Transfers to the sub-processors above rely on the EU Standard Contractual Clauses in their terms.