Lea

Privacy policy

Dernière mise à jour : 7 mai 2026

Note: the French version of this Privacy Policy is the legally binding one. This English translation is for convenience.

1. Data controller

The data controller is N.Y.B.K. SAS, a French company registered under SIREN 934 391 764. Contact details in the legal notice.

2. Data collected

Marketing site (leacrm.com): contact form (name, email, company, team size, message), IP address (anti-spam), User-Agent. Single technical cookie NEXT_LOCALE for language preference. No third-party trackers, no analytics.

Application (Lea account): identification data, business data (contacts, deals, etc.), audit logs.

3. Hosting and data location

Data is hosted exclusively in Europe, in the Amsterdam datacenter (Netherlands) operated by Railway Corp. on GCP region europe-west4. No transfer outside the European Union.

Lea is not subject to the US Cloud Act nor Patriot Act: data physically in EU, French publisher, no US subprocessor with access to business data.

4. Subprocessors

  • Railway Corp. (USA, EU-hosted infra), application hosting and database. GDPR-compliant DPA.
  • Resend Inc. (USA), transactional email sending. GDPR-compliant DPA, EU-hosted metadata.

5. Retention periods

  • Active user account: subscription duration + 1 year after termination.
  • Billing data: 10 years (accounting obligation).
  • Audit log: per tier (6 months Starter, 2 years Business, 5 years Enterprise).
  • Marketing site contact lead: 3 years from last contact.
  • Cookie NEXT_LOCALE: 1 year.

6. Your rights (GDPR)

Access, rectification, erasure ("right to be forgotten"), portability (CSV export available anytime in app), objection, restriction, withdrawal of consent.

To exercise: contact form. Response within one month.

7. CNIL complaint

For French data subjects, complaints can be lodged with the CNIL: www.cnil.fr. For other EU residents, your local Data Protection Authority.

8. Security

TLS encryption in transit, disk encryption at rest, 2FA available, strict multi-tenant isolation (logical at DB level), audit log, encrypted daily backups.

9. Contact

For questions: contact form.