Privacy policy

Note: the French version of this Privacy Policy is the legally binding one. This English translation is for convenience.

1. Data controller

The data controller is N.Y.B.K. SAS, a French company registered under SIREN 934 391 764. Contact details in the legal notice.

2. Data collected

Marketing site (leacrm.com): contact form (name, email, company, team size, message), IP address (anti-spam), User-Agent. Single technical cookie NEXT_LOCALE for language preference. No third-party trackers, no analytics.

Application (Lea account): identification data, business data (contacts, deals, etc.), audit logs.

3. Hosting and data location

The Lea application and its database are hosted by Railway Corp. on its servers located in Amsterdam (Netherlands).

4. Subprocessors

• Railway Corp. (USA, EU-hosted infra), application hosting and database. GDPR-compliant DPA.
• Resend Inc. (USA), transactional email sending. GDPR-compliant DPA, EU-hosted metadata.

5. Retention periods

• Active user account: subscription duration + 1 year after termination.
• Billing data: 10 years (accounting obligation).
• Audit log: per tier (6 months Starter, 2 years Business, 5 years Enterprise).
• Marketing site contact lead: 3 years from last contact.
• Cookie NEXT_LOCALE: 1 year.

6. Your rights (GDPR)

Access, rectification, erasure ("right to be forgotten"), portability (CSV export available anytime in app), objection, restriction, withdrawal of consent.

To exercise: contact form. Response within one month.

7. CNIL complaint

For French data subjects, complaints can be lodged with the CNIL: www.cnil.fr. For other EU residents, your local Data Protection Authority.

8. Security

TLS encryption in transit, disk encryption at rest, 2FA available, strict multi-tenant isolation (logical at DB level), audit log, encrypted daily backups.

9. Contact

For questions: contact form.