Legal

Privacy Policy

Last updated: June 2026

1. Data Controller

The data controller responsible for processing your personal data is:

ELBE Labs s.r.o. (operating as Leadsplug)
Registered office: Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic
Company ID (IČO): 296 37 121
Registered in the Commercial Register at the Municipal Court in Prague, file no. C 449886
Email: hello@leadsplug.com

If you have any questions about how we handle your personal data, please contact us at the email address above.

2. Our Two GDPR Roles

Our role under the GDPR depends on the activity:

  • Independent controller: for data about visitors to this website and for prospect data we source and contact in our own lead generation outreach, we determine the purposes and means of processing and are responsible for it ourselves.
  • Processor: where an automation system we build processes personal data on a client's behalf and on their instructions (for example, an AI workflow that handles the client's inbound email, official data box (datová schránka) messages, or candidate CVs), the client is the controller and we act as their processor under a separate Data Processing Agreement signed before processing starts. A human reviews anything important before such a system acts.

3. Data We Collect: Website Visitors

This website has no contact forms and sets no tracking cookies. We collect visitor data only in these cases:

  • Booking a call: when you schedule a call through Calendly, Calendly collects your name, email address, and scheduling preferences and shares the booking with us. Links on this site include tags that tell us which page the booking came from.
  • Emailing us: if you write to hello@leadsplug.com, we process your email address and the content of your message to respond.
  • Aggregate analytics: cookieless, privacy-first page statistics (see Section 8).
  • Technical data: server logs processed by our hosting provider (including IP addresses) to deliver pages and protect the site, and anonymous error reports that help us fix technical issues.

We do not collect sensitive personal data (special categories under GDPR) through our website.

4. Data We Process: Business Prospects

As part of our lead generation service we contact people in business roles at companies that may benefit from our clients' products or services. If you received an email or LinkedIn message from a campaign we run, this section explains the processing (information duty under Art. 14 GDPR):

  • What we process: business contact details (name, work email, role), the company you work for and basic company facts, and a log of the outreach itself (what was sent, when, and any reply).
  • Where it comes from: publicly available sources, professional networks, verification and enrichment tools, and occasionally referrals from business partners who confirm they may share the contact with us.
  • Why we may do this: the law lets us send work messages to people in business roles without asking first. This is called legitimate interest (Art. 6(1)(f) GDPR). We only write to you about offers that fit your job. Czech and Slovak rules differ, so campaigns run separately for each country under that country's rules.
  • Your choice: every message includes an easy way to opt out. If you opt out, you go on a suppression list and are never contacted again. You can also object at any time by writing to hello@leadsplug.com; objection to direct marketing is an absolute right and we always honor it.

5. Purpose and Legal Basis of Processing

We process personal data under the following legal bases as defined in Article 6 of the GDPR:

  • Contract (Art. 6(1)(b)): scheduling and holding the call you booked, and delivering services to clients.
  • Legitimate interest (Art. 6(1)(f)): responding to inquiries, B2B direct marketing as described in Section 4, keeping aggregate site statistics, and protecting the website against abuse. We balance these interests against your rights and stop on objection.
  • Legal obligation (Art. 6(1)(c)): retaining invoicing and accounting records as required by Czech law.

6. Data Retention

  • Inquiries and bookings: up to 2 years from last contact, unless a business relationship follows.
  • Prospect and outreach data: outreach logs are kept for up to 12 months after the last contact (they also serve as delivery records for our clients), then deleted or anonymized.
  • Suppression list: opt-outs are kept permanently in minimal form (the address itself), because that is the only way to guarantee you are never contacted again.
  • Accounting records: retained for the periods required by Czech law.

7. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR. You may exercise any of these rights by contacting us at hello@leadsplug.com :

  • Right of Access: request a copy of the personal data we hold about you.
  • Right to Rectification: request correction of inaccurate or incomplete data.
  • Right to Erasure ("Right to be Forgotten"): request deletion of your personal data when it is no longer necessary for the purposes for which it was collected.
  • Right to Data Portability: receive your personal data in a structured, commonly used, machine-readable format.
  • Right to Object: object to processing based on legitimate interest at any time. For direct marketing, this right is absolute: we stop immediately, no questions asked.

We will respond to your request within 30 days. If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority; in the Czech Republic this is the Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz); in Slovakia, the Office for Personal Data Protection of the Slovak Republic (uoou.sk).

8. Cookies & Analytics

This website sets no tracking cookies, which is why you do not see a cookie banner. Specifically:

  • Plausible Analytics: privacy-first, cookieless page statistics. No personal data, no cross-site tracking, EU-based. See plausible.io/data-policy.
  • Vercel Speed Insights: anonymous performance metrics (page load times, Core Web Vitals). No cookies, no personal data.
  • Sentry: anonymous error reports (browser type, page URL, stack traces) so we can fix technical issues. No cookies; configured to use Sentry's EU (Germany) data ingestion endpoint.

We do not use advertising cookies, cross-site tracking, session recording, or fingerprinting. If we ever add a tool that requires consent, a consent banner will be introduced before it loads.

9. Third-Party Services

We use the following service providers. Fonts used on this website are self-hosted and do not trigger connections to external font providers. In delivering client services we may also use vetted subcontractors and tools (for example, for data verification and email delivery); we remain responsible for their work as for our own.

  • Calendly: call scheduling. Collects your name, email address, and scheduling preferences when you book. See: calendly.com/privacy.
  • Vercel: website hosting. Processes server logs (including IP addresses) to deliver pages, plus the anonymous performance metrics above. See: vercel.com/legal/privacy-policy.
  • Plausible Analytics: cookieless aggregate statistics, hosted in the EU. See: plausible.io/data-policy.
  • Sentry: error monitoring via Sentry's EU ingestion endpoint. See: sentry.io/privacy.

10. International Data Transfers

A few of our website tools are run by US companies. When your data goes to the US, EU-approved safeguards keep it protected. Campaign and prospect data for our outreach service is hosted in the EU. Some website service providers are based in the United States; where data leaves the EU, the transfer is protected by an adequacy decision or standard contractual clauses:

  • Calendly (US): certified under the EU-US Data Privacy Framework; standard contractual clauses as fallback.
  • Vercel (US): certified under the EU-US Data Privacy Framework; standard contractual clauses as fallback.
  • Plausible (EU): data stays in the EU.
  • Sentry: configured to ingest error data in the EU (Germany).

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our website is served over HTTPS, and we regularly review our data handling practices.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or applicable legislation. Any updates will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

For any data protection inquiries, requests to exercise your rights, or questions about this privacy policy, please contact us:

ELBE Labs s.r.o. (operating as Leadsplug)
Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic
Email: hello@leadsplug.com