This notice explains how LeadChange Group ("we," "us") handles personal data when you visit leadchangegroup.com or request pricing through our site. It is intended to meet the requirements of the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
Who is responsible for your data
The controller of your personal data is Onyx Digital Holdings, S.L., a Spanish limited company in formation, trading as LeadChange Group.
Corporate identification
- Controller: Onyx Digital Holdings, S.L., trading as LeadChange Group
- Postal address: Barcelona, Spain
- Official contact: hello@leadchangegroup.com
Privacy contact: privacy@leadchangegroup.com
Summary
- You can read our site without giving us any personal data.
- We collect personal data mainly when you use our matching form: your answers, then your email address and first name to unlock your matches, and a phone number if you choose to give one.
- Only if you use a work email and tick the consent box do we share your request, and only with the companies the box names (and, where the box says so, up to 3 partners listed on our partners page). The box names a company only if it takes requests through us; when none does for your answers, there is no box and nothing is shared. A company that receives your request may pay us for it. You see your matches whatever you choose. If you tell us you are not buying (for example, as a student, job seeker or employee), we never share your request.
- If you open one of our free checklists or sheets with your email address, we keep that address with the request only: we never share or sell it, and we send you nothing unless you tick the optional box to hear when it changes.
- When you tick the consent box, we may sell your request to the companies it names. You can opt out at any time (see "Your privacy choices" below).
- We use Google Analytics only if you accept analytics cookies, and you can withdraw that consent at any time in Cookie settings. We do not use advertising cookies.
- We honor the Global Privacy Control signal of your browser.
- You can withdraw consent, opt out of sale or sharing, and exercise your other rights by emailing privacy@leadchangegroup.com.
Data we collect
| Category | Examples | Source |
|---|---|---|
| Matching request (matching form) | Your first name and email address, your phone number if you give one, and your answers: software category, company size (a range or an exact number), your role in the decision, main need (or, if you are switching providers, why you are leaving your current one), current tools, and your timeline or when your current contract ends. Depending on the category, the form may also ask a few questions about your company, such as in how many US states or which countries you employ people, your state or industry, how many people you hire, train, pay by the hour or give company cards to, how many background checks or immigration cases you handle, how you buy health benefits today, or which accounting system you use. We ask only questions that change your matches or what a provider needs to answer your request | You |
| Checklist or sheet request (free checklists and sheets) | Your email address, which checklist or sheet you opened, the page you opened it on, and whether you ticked the optional box to hear when it changes | You |
| Consent records | Whether you ticked the consent box, the providers it named, the exact text and version shown to you, the date and time, the page where you submitted, a hashed IP address, and whether your browser sent a Global Privacy Control signal | You and our systems |
| Correction request (corrections form) | Your name, email address and, if you give it, your company; whether you write as the vendor, a user or someone else; the page, the fact in question, the value you propose and your evidence link | You |
| Attribution data | The page where you started, the referring page and the campaign tags (UTM parameters) of your visit, kept in your browser's session storage (only if you accepted analytics cookies) until you submit and then stored with your request | Your device |
| Request details | Your browser's user agent, how long the form took to complete, a qualification score computed from your company size, timeline, role in the decision, email type, consent and phone number, the version of the form and the kind of page you used it on, the matches we showed you, whether your email domain can receive mail (checked by a DNS lookup of the domain only) and whether your phone number is a toll-free one | Our systems |
| Bot-protection signals | Whether the form saw any pointer or keyboard input (counts only, never what you typed), whether the browser reports being automated, and the network your request came from | Your device and our systems |
| Hashed IP address | A one-way hashed version of your IP address, stored with form submissions | Your device |
| Google Analytics data (only with your consent) | A random cookie ID, pages viewed, how you arrived (referring site, campaign tags), clicks on our calls to action and on links to vendors, the steps of the matching form you reach, the software category and qualification score of a request you submit, words searched in our site search (never one that looks like an email address or phone number), device and browser type, and approximate location derived from your IP address | Your device |
| Cookie consent records | Your choice in the cookie banner (analytics on or off, and how you chose), the policy version, the date and time, the country your connection came from, and a random ID that does not identify you | Your device and our systems |
| Cookieless analytics | Aggregate visit data, such as pages viewed, referring site, and general device and browser type, without cookies or cross-site tracking | Your device |
| Server and security logs | IP address, browser user agent, requested URL, and date and time of requests | Your device, via our hosting and security providers |
We do not ask for sensitive personal data, such as health, financial account, or government ID information. Please do not include it in free-text fields.
A hashed IP address cannot be read back as the original address, but it may still be personal data under some laws. We treat it as such.
How we use data and our legal bases
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Showing you the matches that fit your answers | Matching request | Taking steps at your request |
| Sharing your request with the companies named in the consent box (providers and, for some categories, a broker) so they can contact you by email and, if you gave a phone number, by calls and texts | Matching request, attribution data | Your consent |
| Keeping one request per person and category: a new request with the same email and category within 30 days updates the earlier one | Matching request | Our legitimate interest in accurate records |
| Giving you the full checklist or sheet you asked for, keeping one record per person and checklist (opening the same one again within 30 days updates it), and remembering whether you asked to hear when it changes. We do not send emails about it today | Checklist or sheet request, hashed IP, bot-protection signals | Taking steps at your request; your consent for the optional updates box |
| Keeping a record of your consent and of withdrawals | Consent records, hashed IP | Compliance with legal obligations and our legitimate interest in demonstrating compliance |
| Preventing spam, fraud, and abuse, and keeping the site secure | Hashed IP, server and security logs, bot-protection signals | Our legitimate interest in protecting our site, our users, and the providers we work with |
| Measuring how the site is used with Google Analytics, so we can improve pages and the matching form | Google Analytics data, attribution data | Your consent, given in the cookie banner (also required for the cookies themselves by Spanish law, LSSI art. 22.2) |
| Keeping a record of your cookie choices | Cookie consent records | Compliance with legal obligations (showing that we asked for and respected your consent) |
| Understanding how the site is used, in aggregate | Cookieless analytics | Our legitimate interest in improving the site |
| Reviewing a correction request and, if needed, replying to you about it | Correction request, hashed IP, bot-protection signals | Our legitimate interest in publishing accurate information |
| Responding to your messages and requests | Information you send us | Our legitimate interest in responding, or compliance with legal obligations for rights requests |
Matching is automated: our system selects providers based on what you tell us about your needs. This does not produce legal or similarly significant effects on you. You choose whether to engage with any provider.
Who receives your data
Matching software providers. Only if you tick the consent box (with a work email, and without a Global Privacy Control signal), we share your request with the providers it names, up to three. The box names a provider only if it takes requests through us, so every provider it names receives your request when you tick it. If you gave a phone number, the consent covers calls and text messages from them about pricing and demos, including autodialed, prerecorded and artificial or AI-generated voice calls and texts; consent is not a condition of any purchase, and you can reply STOP to any text to opt out. Each provider uses your data under its own privacy policy as an independent controller. Ask us at privacy@leadchangegroup.com and we will tell you which providers received your request.
Lead partners and brokers. When a partner buys requests in your category, the consent box says your request may also go to up to 3 software vendors and partners matched to it, and links the list of partners. For some categories the box names one partner by name, with what it does (for example, an independent broker that compares quotes from several providers for you, or a background-check provider that can quote your screening needs). Partners the box does not name receive your request by email only; the partner it names, like the providers it names, also receives your phone number if you gave it with the wording about calls and texts. A request never goes to two brokers, and never to more than three companies in all. Each partner uses your data under its own privacy policy as an independent controller.
Service providers (processors). We use service providers that process data on our behalf and under our instructions:
- Cloudflare: content delivery, hosting infrastructure, security, bot protection (Cloudflare Turnstile), and the DNS lookup that checks whether the domain of your email address can receive mail (only the domain is looked up). Cloudflare also processes Turnstile challenge data for its own security purposes, as described in its Turnstile privacy policy.
- Neon: database hosting.
- Google: Google Analytics 4, only if you accept analytics cookies. Google processes this data on our behalf under its data processing terms. We keep Google signals and advertising features off, and we do not send Google your name, email address or phone number. Google Analytics does not log or store IP addresses of visitors in the EU, Switzerland or the UK; it uses them only to derive approximate location, then discards them.
Others when required. We may disclose data where required by law, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets, subject to this notice.
International transfers
We are based in the European Union. Some recipients, including our service providers and software providers, may process data in the United States or other countries outside the European Economic Area and the UK. Where such transfers require safeguards, we rely on appropriate mechanisms, such as the European Commission's Standard Contractual Clauses or, where a recipient is certified, the EU-U.S. Data Privacy Framework and its UK extension. Google LLC, which may process Google Analytics data in the United States, is certified under the EU-U.S. Data Privacy Framework. You can ask for more information at privacy@leadchangegroup.com.
How long we keep data
- Pricing request data: 24 months from submission, unless you withdraw consent or ask us to delete it sooner.
- Checklist and sheet requests: 24 months from your request, unless you ask us to delete them sooner.
- Correction requests: 24 months from submission once the request is closed. A correction we publish stays in the public correction log and page change logs without your name or contact details.
- Consent records: as long as needed to show we obtained and respected your consent, which may extend beyond the deletion of the related request data.
- Server and security logs: for short periods, as needed for security and troubleshooting.
- Google Analytics data: 14 months, after which Google deletes the event-level data; the
_gacookies on your device expire after 13 months, or as soon as you withdraw consent. - Cookie consent records: 36 months from your choice.
- Cookieless analytics: stored in aggregate form that does not identify you.
Software providers that receive your request keep it according to their own policies.
Your rights
EU, EEA, and UK residents
You have the right to:
- Access your personal data and receive a copy.
- Correct inaccurate data.
- Delete your data.
- Restrict or object to processing, including processing based on legitimate interests.
- Receive your data in a portable format.
- Withdraw consent at any time, without affecting processing that took place before withdrawal.
- Lodge a complaint with a data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD). You may also contact the authority where you live or work.
US residents
Depending on your state of residence, including California and other states with comprehensive privacy laws, you may have the right to:
- Know and access the personal information we collect, use, and disclose about you.
- Delete personal information we hold about you.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of your personal information, and of targeted advertising.
- Not be discriminated against for exercising your rights.
- Appeal our decision on your request, where your state law provides this right.
Sale and sharing of personal information
When you tick the consent box, we may sell your request to the companies it names and to the lead partners listed on our partners page for the categories they buy. Under some US state laws, passing a request to a company that pays us for it is a "sale" of personal information. The categories involved are identifiers (first name, work email and, only for the providers and the partner the box names, phone number) and professional information (company size, your role in the decision, software needs and the other answers you gave about your company). We keep requests for 24 months. You can opt out at any time with the form below.
We do not sell or share personal information for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of consumers under 16.
Your privacy choices: do not sell or share
- Use the form below. Enter the email address you used on our site: from then on, no request sent with it is sold or shared, whatever you tick. No account or verification is needed.
- Don't tick the consent box. Without the tick, your request is never shared with any provider; you still see your matches.
- Global Privacy Control. If your browser sends a GPC signal, we treat it as a request to opt out of sale and sharing: nothing you submit is shared, whatever you tick. We also treat it as "Reject all" in our cookie banner.
- Email us. Write to privacy@leadchangegroup.com with the subject "Do Not Sell or Share" and the email address you used on our site. We will stop sharing your information with providers going forward. Information already shared is handled by those providers; we will tell you who they are so you can contact them directly.
Opt out of sale and sharing
Enter the email address you used on our site. From then on, no request sent with it is sold or shared with any provider or partner. We keep only a one-way hash of the address, never the address itself.
How to exercise your rights
Email privacy@leadchangegroup.com. We may need to verify your identity, usually by confirming control of the email address you used on our site. An authorized agent may submit a request on your behalf with proof of authorization, where the law allows. We respond within the time required by applicable law. If we decline your request, we will explain why and, where applicable, how to appeal.
Children
Our site is intended for business users and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact privacy@leadchangegroup.com and we will delete it.
Cookies and analytics
We do not use cookies for advertising. Google Analytics, and its cookies, run only if you accept analytics cookies; until then no request is made to Google. Visits and requests from LeadChange Group team devices are excluded from our statistics. You can withdraw your consent at any time in Cookie settings, which also deletes the Google Analytics cookies from your browser. See our cookie notice for every cookie and similar technology we use, with its purpose and duration.
Security
We use technical and organizational measures to protect personal data, including encrypted connections, access controls, hashing of IP addresses, and bot and abuse protection. No system is completely secure, but we work to protect your data and limit who can access it.
Changes to this notice
We may update this notice. The date at the top shows when it was last changed. If we make material changes, we will make them clear on this page before they take effect.
Contact
Privacy questions and requests: privacy@leadchangegroup.com
Onyx Digital Holdings, S.L., Barcelona, Spain. See the controller details above.