1. Roles
The Customer is the controller of campaign personal data. 3DMA Ltd. (3DMA OOD), a company registered in Bulgaria, European Union is the processor and processes that data only to provide Leadomino and on the Customer's documented instructions, including these terms and the settings used in the app.
2. Details of processing
| Subject matter | Finding business contacts, writing and sending B2B emails, handling replies and opt-outs |
| Duration | The term of the Customer's account, plus the deletion period |
| Data subjects | Business contacts at target companies; Customer users |
| Data types | Name and role where published, business email, company, website, country, language, email content, replies, opt-out status |
| Special categories | None. Customers must not use Leadomino to process them. |
3. Our commitments
- Process data only on documented instructions, and tell the Customer if an instruction seems unlawful.
- Ensure everyone with access is bound by confidentiality.
- Apply appropriate technical and organisational security measures (Art. 32), including encryption in transit, access control, hardened infrastructure, logging and backups.
- Help the Customer answer data subject requests and with impact assessments where needed.
- Notify the Customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach.
- At the end of the service, delete or return the data, unless the law requires us to keep it.
- Make the information needed to show compliance available and allow reasonable audits, with 30 days' notice, at most once a year unless there's been a breach.
4. Sub-processors
The Customer gives general authorisation to use the sub-processors below. We'll give 30 days' notice of new sub-processors on this page or by email; the Customer may object on reasonable data protection grounds and, if we can't resolve it, end the affected service.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, DNS, website forms and waitlist storage | Global network, USA |
| OVH US LLC (OVHcloud) | Application hosting and database | USA |
| Anthropic, PBC | AI that writes emails and scores leads | USA |
| Serper (serper.dev) | Web search used to find companies | USA |
| Resend, Inc. | Login links and service emails | USA |
| Reamaze (GoDaddy) | Sending campaign emails and receiving replies | USA |
| Telegram | Internal alerts to our team (sign-ups, contact and opt-out requests) | Global |
5. International transfers
Where data leaves the EEA, transfers rely on the EU-US Data Privacy Framework for certified providers or on the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 or 3 as applicable, with supplementary measures where needed.
6. Global do-not-contact list
To protect recipients, 3DMA keeps opt-out emails and domains as an independent controller and applies them to all customers. This is necessary to honour objections to direct marketing.