GDPR Compliance

Last updated: June 2026

1. Scope

This GDPR Compliance statement explains how Broad Leads LLC ("Broad Leads," "we," "us," or "our") handles personal data of individuals located in the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK) in accordance with the EU General Data Protection Regulation (GDPR) and the UK GDPR. It supplements, and should be read together with, our Privacy Policy. Where there is a conflict for data subjects in these regions, this statement controls.

2. Controller and Processor Roles

Depending on the activity, Broad Leads may act as a data controller (for example, in relation to our own customers and website visitors) or as a data processor (for example, when processing lead data on behalf of an agent who acts as the controller). We process personal data only for legitimate, clearly defined purposes and in line with the responsibilities of our role.

3. Lawful Bases for Processing

We process personal data only where we have a valid lawful basis under Article 6 of the GDPR. Depending on the context, our lawful bases include:

• Consent — where you have given clear, affirmative consent, such as for certain marketing or SMS communications;
• Contract — where processing is necessary to provide the Services you have requested or to perform our agreement with you;
• Legitimate interests — where processing is necessary for our legitimate business interests, such as improving the Services, securing our platform, and preventing fraud, balanced against your rights; and
• Legal obligation — where processing is necessary to comply with applicable law.

4. Data Subject Rights

If you are located in the EU, EEA, or UK, you have the following rights with respect to your personal data:

• Right of access — to obtain confirmation of whether we process your data and to receive a copy of it;
• Right to rectification — to have inaccurate or incomplete data corrected;
• Right to erasure — to request deletion of your data ("right to be forgotten"), subject to legal exceptions;
• Right to restriction — to request that we limit how we process your data in certain circumstances;
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible; and
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes.

You also have the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

5. International Data Transfers

Broad Leads is based in the United States, and your personal data may be transferred to and processed in the United States or other countries that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data out of the EU, EEA, or UK, we implement appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission (and the UK Addendum, where applicable), to ensure your data remains protected.

6. Data Protection Measures

We maintain appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage. These measures include access controls, encryption in transit where appropriate, internal policies and training, vendor due diligence, and data minimization and retention practices. For more on how data moves through our platform, see our Data Policy.

7. How to Exercise Your Rights

To exercise any of the rights described above, contact us using the details in Section 9. We will respond to verified requests within the timeframes required by the GDPR (generally within one month, which may be extended for complex requests). We may need to verify your identity before acting on your request, and certain rights are subject to legal limitations.

8. Complaints to a Supervisory Authority

If you believe our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement, or with the UK Information Commissioner's Office (ICO) if you are in the UK. We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority, so please consider contacting us first.

9. Data Protection Contact

For any GDPR-related questions or requests, please contact our data protection contact:

• Broad Leads LLC
• 2717 Commercial Center Blvd, Suite E200, Katy, TX 77494, USA
• Phone: +1 346 214 6333
• Email: support@broadleads.com