This notice explains how LeadChange Group ("we," "us") handles personal data when you visit leadchangegroup.com or request pricing through our site. It is intended to meet the requirements of the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
Who is responsible for your data
The controller of your personal data is Onyx Digital Holdings, S.L., a Spanish limited company in formation, trading as LeadChange Group.
Corporate identification
- Controller: Onyx Digital Holdings, S.L., trading as LeadChange Group
- Postal address: Barcelona, Spain
- Official contact: hello@leadchangegroup.com
Privacy contact: privacy@leadchangegroup.com
Summary
- You can read our site without giving us any personal data.
- We collect personal data mainly when you use our matching form: your answers, then your email address and first name to unlock your matches, and a phone number if you choose to give one.
- Only if you use a work email and tick the box that names the providers matched to you (up to three) do we share your request with those providers, if they work with us; a provider may pay us for the introduction. You see your matches whatever you choose.
- In the past 12 months we have not sold or shared personal information.
- We use Google Analytics only if you accept analytics cookies, and you can withdraw that consent at any time in Cookie settings. We do not use advertising cookies.
- We honor the Global Privacy Control signal of your browser.
- You can withdraw consent, opt out of sale or sharing, and exercise your other rights by emailing privacy@leadchangegroup.com.
Data we collect
| Category | Examples | Source |
|---|---|---|
| Matching request (matching form) | Your first name and email address, your phone number if you give one, and your answers: software category, company size, main need, current tools and timeline | You |
| Consent records | Whether you ticked the consent box, the providers it named, the exact text and version shown to you, the date and time, the page where you submitted, a hashed IP address, and whether your browser sent a Global Privacy Control signal | You and our systems |
| Correction request (corrections form) | Your name, email address and, if you give it, your company; whether you write as the vendor, a user or someone else; the page, the fact in question, the value you propose and your evidence link | You |
| Attribution data | The page where you started, the referring page and the campaign tags (UTM parameters) of your visit, kept in your browser's session storage (only if you accepted analytics cookies) until you submit and then stored with your request | Your device |
| Request details | Your browser's user agent, how long the form took to complete, a qualification score computed from your company size, timeline, email type, consent and phone number, the matches we showed you, whether your email domain can receive mail (checked by a DNS lookup of the domain only) and whether your phone number is a toll-free one | Our systems |
| Bot-protection signals | Whether the form saw any pointer or keyboard input (counts only, never what you typed), whether the browser reports being automated, and the network your request came from | Your device and our systems |
| Hashed IP address | A one-way hashed version of your IP address, stored with form submissions | Your device |
| Google Analytics data (only with your consent) | A random cookie ID, pages viewed, how you arrived (referring site, campaign tags), clicks on our calls to action and on links to vendors, the steps of the matching form you reach, the software category and qualification score of a request you submit, words searched in our site search (never one that looks like an email address or phone number), device and browser type, and approximate location derived from your IP address | Your device |
| Cookie consent records | Your choice in the cookie banner (analytics on or off, and how you chose), the policy version, the date and time, the country your connection came from, and a random ID that does not identify you | Your device and our systems |
| Cookieless analytics | Aggregate visit data, such as pages viewed, referring site, and general device and browser type, without cookies or cross-site tracking | Your device |
| Server and security logs | IP address, browser user agent, requested URL, and date and time of requests | Your device, via our hosting and security providers |
We do not ask for sensitive personal data, such as health, financial account, or government ID information. Please do not include it in free-text fields.
A hashed IP address cannot be read back as the original address, but it may still be personal data under some laws. We treat it as such.
How we use data and our legal bases
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Showing you the matches that fit your answers | Matching request | Taking steps at your request |
| Sharing your request with the providers named in the consent box so they can contact you by email and, if you gave a phone number, by calls and texts | Matching request, attribution data | Your consent |
| Keeping one request per person and category: a new request with the same email and category within 30 days updates the earlier one | Matching request | Our legitimate interest in accurate records |
| Keeping a record of your consent and of withdrawals | Consent records, hashed IP | Compliance with legal obligations and our legitimate interest in demonstrating compliance |
| Preventing spam, fraud, and abuse, and keeping the site secure | Hashed IP, server and security logs, bot-protection signals | Our legitimate interest in protecting our site, our users, and the providers we work with |
| Measuring how the site is used with Google Analytics, so we can improve pages and the matching form | Google Analytics data, attribution data | Your consent, given in the cookie banner (also required for the cookies themselves by Spanish law, LSSI art. 22.2) |
| Keeping a record of your cookie choices | Cookie consent records | Compliance with legal obligations (showing that we asked for and respected your consent) |
| Understanding how the site is used, in aggregate | Cookieless analytics | Our legitimate interest in improving the site |
| Reviewing a correction request and, if needed, replying to you about it | Correction request, hashed IP, bot-protection signals | Our legitimate interest in publishing accurate information |
| Responding to your messages and requests | Information you send us | Our legitimate interest in responding, or compliance with legal obligations for rights requests |
Matching is automated: our system selects providers based on what you tell us about your needs. This does not produce legal or similarly significant effects on you. You choose whether to engage with any provider.
Who receives your data
Matching software providers. Only if you tick the box that names the providers matched to you (with a work email, and without a Global Privacy Control signal), we share your request with those providers, up to three, if they work with us. If you gave a phone number, the consent covers calls and text messages from them about pricing and demos, including autodialed, prerecorded and artificial or AI-generated voice calls and texts; consent is not a condition of any purchase, and you can reply STOP to any text to opt out. Each provider uses your data under its own privacy policy as an independent controller. Ask us at privacy@leadchangegroup.com and we will tell you which providers received your request.
Service providers (processors). We use service providers that process data on our behalf and under our instructions:
- Cloudflare: content delivery, hosting infrastructure, security, bot protection (Cloudflare Turnstile), and the DNS lookup that checks whether the domain of your email address can receive mail (only the domain is looked up). Cloudflare also processes Turnstile challenge data for its own security purposes, as described in its Turnstile privacy policy.
- Neon: database hosting.
- Google: Google Analytics 4, only if you accept analytics cookies. Google processes this data on our behalf under its data processing terms. We keep Google signals and advertising features off, and we do not send Google your name, email address or phone number. Google Analytics does not log or store IP addresses of visitors in the EU, Switzerland or the UK; it uses them only to derive approximate location, then discards them.
Others when required. We may disclose data where required by law, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets, subject to this notice.
International transfers
We are based in the European Union. Some recipients, including our service providers and software providers, may process data in the United States or other countries outside the European Economic Area and the UK. Where such transfers require safeguards, we rely on appropriate mechanisms, such as the European Commission's Standard Contractual Clauses or, where a recipient is certified, the EU-U.S. Data Privacy Framework and its UK extension. Google LLC, which may process Google Analytics data in the United States, is certified under the EU-U.S. Data Privacy Framework. You can ask for more information at privacy@leadchangegroup.com.
How long we keep data
- Pricing request data: 24 months from submission, unless you withdraw consent or ask us to delete it sooner.
- Correction requests: 24 months from submission once the request is closed. A correction we publish stays in the public correction log and page change logs without your name or contact details.
- Consent records: as long as needed to show we obtained and respected your consent, which may extend beyond the deletion of the related request data.
- Server and security logs: for short periods, as needed for security and troubleshooting.
- Google Analytics data: 14 months, after which Google deletes the event-level data; the
_gacookies on your device expire after 13 months, or as soon as you withdraw consent. - Cookie consent records: 36 months from your choice.
- Cookieless analytics: stored in aggregate form that does not identify you.
Software providers that receive your request keep it according to their own policies.
Your rights
EU, EEA, and UK residents
You have the right to:
- Access your personal data and receive a copy.
- Correct inaccurate data.
- Delete your data.
- Restrict or object to processing, including processing based on legitimate interests.
- Receive your data in a portable format.
- Withdraw consent at any time, without affecting processing that took place before withdrawal.
- Lodge a complaint with a data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD). You may also contact the authority where you live or work.
US residents
Depending on your state of residence, including California and other states with comprehensive privacy laws, you may have the right to:
- Know and access the personal information we collect, use, and disclose about you.
- Delete personal information we hold about you.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of your personal information, and of targeted advertising.
- Not be discriminated against for exercising your rights.
- Appeal our decision on your request, where your state law provides this right.
Sale and sharing of personal information
If you tick the consent box, we share your request with the software providers it names, and a provider may pay us for the introduction. Under some US state laws, this may be considered a "sale" of personal information. In the past 12 months we have not sold or shared personal information. If that changes, the categories involved would be identifiers (first name, email address and, if given, phone number) and professional information (company size and software needs), disclosed to the software providers named in the consent box.
We do not sell or share personal information for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of consumers under 16.
Your privacy choices: do not sell or share
- Don't tick the consent box. Without the tick, your request is never shared with any provider; you still see your matches.
- Global Privacy Control. If your browser sends a GPC signal, we treat it as a request to opt out of sale and sharing: nothing you submit is shared, whatever you tick. We also treat it as "Reject all" in our cookie banner.
- Email us. Write to privacy@leadchangegroup.com with the subject "Do Not Sell or Share" and the email address you used on our site. We will stop sharing your information with providers going forward. Information already shared is handled by those providers; we will tell you who they are so you can contact them directly.
How to exercise your rights
Email privacy@leadchangegroup.com. We may need to verify your identity, usually by confirming control of the email address you used on our site. An authorized agent may submit a request on your behalf with proof of authorization, where the law allows. We respond within the time required by applicable law. If we decline your request, we will explain why and, where applicable, how to appeal.
Children
Our site is intended for business users and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact privacy@leadchangegroup.com and we will delete it.
Cookies and analytics
We do not use cookies for advertising. Google Analytics, and its cookies, run only if you accept analytics cookies; until then no request is made to Google. Visits and requests from LeadChange Group team devices are excluded from our statistics. You can withdraw your consent at any time in Cookie settings, which also deletes the Google Analytics cookies from your browser. See our cookie notice for every cookie and similar technology we use, with its purpose and duration.
Security
We use technical and organizational measures to protect personal data, including encrypted connections, access controls, hashing of IP addresses, and bot and abuse protection. No system is completely secure, but we work to protect your data and limit who can access it.
Changes to this notice
We may update this notice. The date at the top shows when it was last changed. If we make material changes, we will make them clear on this page before they take effect.
Contact
Privacy questions and requests: privacy@leadchangegroup.com
Onyx Digital Holdings, S.L., Barcelona, Spain. See the controller details above.