1. SCOPE AND JURISDICTIONAL ROLES
This addendum describes processing roles and current controls for authorised use of LeakTrace, subject to applicable data-protection law. It is not a certification of regulatory compliance. - Consumer services: LeakTrace determines the purposes and means of processing for its direct customer services and acts as a data controller for that processing. - Business Email Plan services: Where business processing is enabled and agreed, the client determines the lawful purposes and instructions for individual email checks, including addresses managed for client organisations, and LeakTrace processes those records on the client's behalf. By explicitly authorizing an imported list, the client instructs LeakTrace to run one initial check for each listed address and enable daily monitoring and new-finding email alerts. LeakTrace remains responsible for processing it determines independently, such as its own account and billing administration. - Availability: The Business Email Plan costs £19.99 per selected seat per month and is available after payment and an explicit authority attestation. The account operator is responsible for confirming authority to manage the account, submit each listed individual email for checking, including addresses managed for another organisation, and meet applicable privacy, notice and consultation requirements. LeakTrace does not verify who controls each inbox. Business email checks are limited to individually enrolled addresses; searches for unlisted addresses or organisation-wide/domain-wide scans are not performed. This attestation does not create a negotiated enterprise processing agreement.
2. SUB-PROCESSOR ENGAGEMENTS
Hosting and database services store and process application records. Connected exposure providers process a lookup hash or, where required, the assessed address. Stripe processes billing information, and Resend processes configured outgoing email. These providers have their own processing terms and may have distinct legal roles. LeakTrace does not represent that all provider contracts contain identical safeguards or that international-transfer arrangements have been independently verified. Any applicable enterprise agreement must identify the relevant processors, processing locations, instructions and transfer safeguards before the associated processing starts.
3. CURRENT SECURITY AND RETENTION CONTROLS
Current controls include password hashing, authenticated sessions, expiring single-use security links, restricted owner processing and database-enforced privacy-request and retention workflows. Session completion does not purge data. Unpaid free/anonymous scans expire after 90 days; paid snapshots remain while the account is open; removed-address findings remain for 12 months for authorised re-enrollment, subject to separately retained paid snapshots and verified erasure. Completed/expired operational records have a 90-day retention rule, resolved contacts 12 months and minimal completed privacy-request audits 3 years. The Privacy Policy describes the start dates, worker schedule, legacy-date treatment, legal holds, unresolved delivery investigations and billing/receipt exceptions. Verified account erasure follows billing cancellation and owner approval, normally within 30 days, with changed inventories requiring fresh review. Service-data erasure does not guarantee deletion of hosting backups or external provider/recipient copies. Application-level encryption of all email fields and a fixed five-year notice-audit schedule are not claimed. Enterprise-specific instructions and any different retention requirements must be separately agreed and implemented before reliance.
4. DATA REQUESTS AND SECURITY INCIDENTS
Clients and individuals can use account Privacy requests or /privacy-requests for access and erasure, and Contact for other rights requests or suspected security incidents. Identity, authority and the processing role must be established before disclosure or erasure; corporate and family data require documented owner authority review. Owners see a record inventory, protected categories and reasons before confirming irreversible erasure. Billing obligations and dated legal holds must be resolved or reviewed rather than deleted indiscriminately. A scoped access export excludes security secrets and other accounts. Incident assessment and communication still require operator action; there is no automated enterprise incident-notification capability. Where the UK/EU GDPR applies, a processor must notify the controller without undue delay after becoming aware of a personal-data breach. The controller's supervisory-authority notification deadline is generally 72 hours where required and feasible; that is not an unconditional guarantee of notice to every enterprise administrator within 72 hours.