Data Processing Addendum

1. Who is who

For the personal data of your customers and prospective customers — the people who fill in a form or call the number on your website — you are the controller (a "business" under California law) and LocalSitesEngine is the processor (a "service provider"). You decide why and how that data is collected; we handle it to deliver the service you bought.

For your own account data — your name, business details, billing information and support correspondence — we are the controller, and our Privacy Policy applies.

2. Subject matter, duration, nature and purpose

• Subject matter: hosting your website, capturing enquiries submitted through it, and operating the tracked phone line and messaging attached to it.
• Duration: the term of your subscription, plus the retention period in section 8.
• Nature: collection, storage, organisation, transmission to you, display in your portal and reports, and deletion.
• Purpose: delivering enquiries to you and reporting on them. We do not use lead data to advertise, to build our own marketing lists, or to train AI models.

3. Categories of data and data subjects

Data subjects: your prospective and existing customers, and anyone else who contacts you through your site or phone line.

Categories of personal data:

• Name, telephone number, email address and postal or service address where supplied.
• The content of the enquiry, including any job details the person chooses to give.
• Call metadata: the calling number, time, duration and which marketing source the call came from.
• Voicemail recordings, where a caller chooses to leave a message.
• Where the AI receptionist is enabled, a text transcript of what the caller said.
• Technical data such as IP address and device type collected in the ordinary course of serving the website.

We do not ask for and the service is not designed to collect special category data (health, biometric, racial or ethnic origin and similar) or payment card details from your leads. Please do not configure forms to request them.

4. Our obligations as processor

• Documented instructions. We process lead data only on your documented instructions — which include the configuration you choose in onboarding and your admin settings — and as required by law. If we believe an instruction breaks data protection law, we will tell you.
• No sale or sharing. We do not sell lead data or share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. We do not retain, use or disclose it for any purpose other than performing the service.
• Confidentiality. Personnel authorised to access lead data are bound by confidentiality obligations.
• Assistance. We will help you respond to data subject requests and, to the extent applicable, with security, breach notification and impact assessments.
• Breach notification. We will notify you without undue delay after becoming aware of a personal data breach affecting your lead data, with the information you need to meet your own notification deadlines.

5. Security measures

Lead data is held in an access-controlled database with row-level security policies that restrict each customer to their own records. Data is encrypted in transit using TLS and at rest by our hosting and database providers. Administrative access requires authenticated accounts with a separate administrator role. Payment card details are handled entirely by our payment processor and never reach our systems.

6. Sub-processors

You authorise the sub-processors below. Each is bound by terms materially as protective as those in this Addendum. We will give reasonable notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds — in which case you may cancel without further charge if we cannot offer an alternative.

7. Data subject requests

If one of your customers contacts us directly to access, correct or delete their data, we will not respond substantively — we will refer them to you, because you are the controller, and tell you about it. If you need us to locate, export or delete a particular person's records to answer a request, email support@localsitesengine.com and we will do it at no charge within the timescale your obligation requires.

8. What happens to your leads when you cancel

Your leads are yours. On cancellation:

• You can export your full lead history from your portal at any time while the subscription is active. Do this before you cancel.
• After cancellation we retain lead data for 30 days so it can be restored if you return or need a late export, then delete it.
• You may ask us in writing to delete it immediately instead, and we will do so within 14 days.
• Backups are overwritten on a rolling cycle and any residual copies are deleted within 90 days.

9. International transfers

The service and its sub-processors operate in the United States. It is designed for contractors serving customers in the United States. If you direct traffic from the UK or EEA to your site, tell us before you do — additional transfer safeguards would be needed and we would need to agree them with you in writing first.

10. Audit and information rights

On reasonable written request, and not more than once a year unless required by a regulator or following a breach, we will provide the information reasonably necessary to demonstrate compliance with this Addendum.

11. Version

This Addendum is version 2026-09-02. The version you accepted is recorded against your account at the time of acceptance.

This document is provided as part of the service and is not legal advice. It has not been reviewed by a lawyer on your behalf. If you are subject to specific regulatory obligations, have it reviewed before relying on it.