Documentation Privacy and security

Using Leadwon in line with the GDPR

Consent, retention, data subject requests and your privacy policy.

Leadwon is built so that you can use it in line with the GDPR and similar laws. You stay the controller of your visitors’ data; it is stored in your own WordPress database. This page lists what to set up. It is no legal advice: whether you need consent and what your privacy policy has to say depends on your site, so ask your data protection officer or legal advisor if unsure.

Campaign tracking with cookies usually needs prior consent in the EU and the UK. Under Leads → Settings → Tracking, let Leadwon wait for consent through the WP Consent API or your own consent tool. See Cookie consent.

With Leadwon Pro, visitors who refused marketing cookies are not reported to Meta, and their email address and phone number are not sent to Google Ads or Microsoft Advertising.

2. Retention

Under Leads → Settings → Privacy, enter after how many days Delete leads after removes them, for example 365. Older leads are deleted automatically; 0 keeps them.

Visits and form starts are counted only as anonymous daily totals, which identify nobody.

3. Requests from people

Leadwon works with the WordPress tools under Tools → Export Personal Data and Tools → Erase Personal Data. A request for an email address includes all leads with that address. Conversions still waiting for an erased lead are not sent; data already sent to an ad platform or CRM has to be deleted there.

4. Privacy policy

Leadwon suggests text under Settings → Privacy → Policy guide: the cookies, the reporting to ad platforms if you use Pro, the CRM if you connect one, and notifications to Slack or Microsoft Teams. Adapt it to your site and add it to your privacy policy.

5. Agreements

When you report conversions, the ad platforms receive data about your leads. Accept their terms for this in your ad accounts, for example the customer data terms in Google Ads for enhanced conversions. For HubSpot and Pipedrive, their data processing agreements apply. For Leadwon Cloud, see Leadwon Cloud and your data.

What helps by design

  • No data goes to Leadwon unless you use Leadwon Pro, and then no lead data is stored there.
  • Email addresses and phone numbers are hashed with SHA-256 on your site before an ad platform receives them.
  • Fonts, scripts and the tracking itself are served from your site; Leadwon loads nothing from other services.
  • Access tokens are stored encrypted.