Last updated on April 03, 2025
1 General information on data processing
This privacy policy describes the collection and use of personal data in connection with the use of our app and in accordance with the provisions of the General Data Protection Regulation ("GDPR”). Processing activities that are not covered by this privacy policy may be supplemented by other privacy policies, which must be observed separately.
This privacy policy contains information on how Leapsome, as the controller, processes your personal data. It, therefore, concerns processing activities in which Leapsome determines the means and purposes of processing. In simpler terms, the processing of personal data that we carry out at Leapsome, in particular for our own purposes.
When using our platform and its features, Leapsome will act as a processor for the majority of the personal data processed. This means that the data will only be processed on the controller's instructions, which is your organization. For such processing activities, please contact your organization for more information on how your personal data is processed.
1.1 Controller
Controller within the meaning of the GDPR is
Leapsome GmbH (“Leapsome”/“we”/“us”)
Brunnenstraße 153
10115 Berlin, Germany
1.2 Data Protection Officer
We have appointed an external data protection officer.
You can contact our appointed data protection officer at
1.3 Rights of data subjects and supervisory authority
You can exercise the following rights:
- Right to be informed about your data stored by us and its processing (Art. 15 GDPR),
- Right to correction of incorrect personal data (Art. 16 GDPR),
- Right to erasure of your data stored by us (Art. 17 GDPR),
- Right to restriction of data processing if we are not yet permitted to erase your data due to legal obligations (Art. 18 GDPR)
- Right to data portability if you have consented to data processing or have concluded a contract with us (Art. 20 GDPR)
- Right to object to the processing of your data by us (Art. 21 GDPR)
- If we process your data on the basis of your consent, you have the right to revoke your consent at any time with effect for the future (Art. 7 para. 3 GDPR).
To exercise your rights, you can contact us by email at privacy@leapsome.com.
Please note that in this case, we will need to verify your identity and, therefore, identify you by appropriate means. The processing of your enquiry and the identification of your person is based on Art. 6 (1) (c) GDPR.
You can lodge a complaint with a supervisory authority at any time in accordance with Art. 77 GDPR in conjunction with Section 19 of the German Federal Data Protection Act (“BDSG”), e.g., with the competent supervisory authority of the federal state where you reside or with the authority responsible for us.
All supervisory authorities can be found at the following link
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
1.4 Processing of data, purpose and legal basis
We process your personal data in accordance with the provisions of the GDPR and the BDSG.
The legal basis for all our processing activities is Art. 6 (1) GDPR. Further information can be found in the description of the individual processing activities.
1.5 Storage period
We will take all reasonable steps to ensure that your personal data is only processed for the period necessary for the purpose for which it is processed. If the storage period is not specified below, your personal data will be deleted or locked as soon as the purpose or legal basis for storage no longer applies. Personal data will not be deleted if storage is required by law (e.g., Section 257 of the German Commercial Code, Section 147 of the German Tax Code). Furthermore, we may retain your personal data until the expiry of the statutory limitation periods (usually 3 years; in individual cases, however, up to 10 years or longer) if this is necessary for the assertion, exercise, or defense of legal claims.
1.6 Recipient of the data
We use various service providers to provide our services. These service providers only act in accordance with our instructions and are contractually obliged to comply with the provisions of Art. 28 GDPR.
1.7 Transfer to third countries
Unless otherwise stated below, your data will not be transferred to a third country outside the European Union. Your personal data will only be transferred to third countries if the requirements of Art. 44 - 49 GDPR are met, in particular standard contractual clauses, binding corporate rules, and an adequacy decision of the Commission.
1.8 No obligation to provide data / no profiling
There is no legal or contractual obligation to provide us with data. However, some services
can only be provided if you provide the necessary data. Your personal data will not be used for automated individual decision-making, including profiling.
2 Processing activities in the app
2.1 Admin Account
Nature and purpose of data processing:
To enable the use of our app and the processing of the contract, it is necessary to set up an administrator user profile, a so-called "admin account". This is used to configure all settings for the organization of our customers. As part of the provision of this account, the name, company, email address, and usage data (including IP-address and User ID).
Legal basis:
The processing is carried out as part of the processing of the user contract for the app in accordance with Art. 6 (1) (b) GDPR.
Recipients:
Other data recipients are processors who provide the technical infrastructure of our platform. As processors, the service providers are obliged to process the data only in accordance with our instructions.
Transfer to third countries:
Data is transferred to the United States of America. The order processing contracts with the service providers contain standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
The personal data will be stored for up to 30 days after your user account has been deactivated. We may be obliged to process individual data for longer due to statutory retention periods (in particular, tax obligations). In all other respects, Section 1.5 of this privacy policy applies.
2.2 Product news and events
Nature and purpose of data processing:
All administrators regularly receive information from us about our product, product news, or to make administrators aware of certain events that are related to the services we provide. For this purpose, we process your name and e-mail address in order to be able to send you messages.
Legal basis:
We process your data in accordance with Section 7 (3) of the German Unfair Competition Act in conjunction with Art. 6 (1) (f) GDPR.
Revocation of consent / objection
If you do not wish to receive our product news and wish to object to the use of your data with effect for the future, you can do so via the unsubscribe link in the e-mails or by sending an e-mail to privacy@leapsome.com.
Recipient:
Another recipient of the data is a processor for sending emails. As a processor, the service provider is obliged to process the data only in accordance with our instructions.
Transfer to third countries:
Data is transferred to the United States of America. The order processing contracts with the service provider contain standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
We process your data until you unsubscribe from our product updates, revoke your consent, or request us to delete it. In all other respects, Section 1.5 of this privacy policy applies.
2.3 Error tracking/platform security
Nature and purpose of data processing:
By monitoring system stability and identifying code errors, we can ensure and continuously improve the technical stability of our service. We process data for these purposes (e.g., user ID and IP address). The processing serves these purposes alone and does not analyze data for advertising purposes.
Legal basis:
The processing of your data is carried out in accordance with Art. 6 (1) (f) GDPR, based on our legitimate interest in the technical stability of our service.
Recipient:
Another recipient of the data is a processor. As a processor, the service providers are obliged to process the data only in accordance with our instructions.
Transfer to third countries:
Data is transferred to the United States of America. The order processing contracts with the service provider contain standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
Your personal data will be deleted as soon as the purpose or legal basis for storage no longer applies. In all other respects, Section 1.5 of this privacy policy applies.
2.4 Processing of payments
Nature and purpose of data processing:
To process your payment, the data you provide during the order process (name, address, account number, bank sort code, credit card number if applicable, invoice amount, currency, and transaction number) will be processed.
Legal basis:
The data is processed for the fulfillment of the contract in accordance with Art. 6 (1) (b) GDPR.
Recipient:
Another recipient of the data is a processor for payment processing. We pass on your payment data to the service provider as part of payment processing insofar as this is necessary for payment processing.
Transfer to third countries:
Data is transferred to the United States of America. The order processing contracts with the service provider contain standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
Personal data will be stored for as long as your user account exists. We may be obliged to process individual data for longer due to statutory retention periods (in particular, tax obligations). In all other respects, Section 1.5 of this privacy policy applies.
2.5 Basic customer support
Nature and purpose of data processing:
We offer you the opportunity to use our customer service via a contact form for troubleshooting or general support questions or to contact us by e-mail. All enquiries sent to us become support tickets. In this context, we process your name, email address, if applicable, and the content of your enquiry. In order to respond to specific enquiries as part of customer support, it may be necessary for us to access usage profiles and usage data (log files, device data) as well as company data in order to rectify errors.
Legal basis:
The data is processed for the fulfilment of contractual measures (Art. 6 (1) (b) GDPR). It is also used to safeguard our legitimate interests (Art. 6 (1) (f) GDPR) to provide customer service that is available everywhere (in the form of a chat or a customer email).
Recipients:
Other recipients of the data are processors for the processing of customer enquiries. As a
processor, the service provider is obliged to process the data only in accordance with our instructions.
Transmission to third countries:
Data is transferred to the United States of America. The order processing contracts with the service provider contain standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
The data is stored for 30 days after termination of the contractual relationship. In all other respects, Section 1.5 of this privacy policy applies.
2.6 Customer support with profile access
Nature and purpose of data processing:
To answer specific customer support inquiries, it may be necessary for one of our customer support employees to access your profile. In this case, customer support will have access to all the information stored in your profile for a limited period of time. You will be asked to give your consent before customer support accesses your profile.
If an admin has a query about the settings in the app for the organization of our customers, we can directly access the settings saved by the admin in the admin account for the organization of our customers in the app in order to resolve the query, limited to the time and content of the processing. This access is exclusively for the purpose of processing the inquiry and providing the necessary support.
In addition, we can access the analytics sections of the respective customer account during the term of the contract in order to provide insights and recommendations for the preparation of meetings (such as in particular graphics for launch retros or strategic reviews) with administrators of this customer.
Legal basis:
We process your data with your consent (Art. 6 (1) (a) GDPR).
Recipients:
Other recipients of the data are processors who process customer inquiries. As a processor, the service provider is obliged to process the data only in accordance with our instructions.
Transfer to third countries:
Data is transferred to the United States of America. The order processing contracts with the service provider contain standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
The data is stored for 30 days after termination of the contractual relationship. In all other respects, Section 1.5 of this privacy policy applies.
2.7 Product improvement
Nature and purpose of data processing:
Our app uses cookie-based technologies to help us better understand how our app is used. We do this by compiling reports on activity in the app that do not identify specific individuals. Analytics cookies transmit your IP address and usage behavior data to a service provider for this purpose.
Legal basis:
Processing is based on our legitimate interests in improving our platform (Art. 6 (1) (f) GDPR).
Recipients:
Other recipients of the data are processors who process customer inquiries. As a processor, the service provider is obliged to process the data only in accordance with our instructions.
Transfer to third countries:
Data is transferred to the United States of America. The order processing contracts with the service provider contain standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
Your personal data will be deleted as soon as the purpose or legal basis for storage no longer applies. In all other respects, Section 1.5 of this privacy policy applies.
2.8 Customer loyalty and satisfaction measurement
Nature and purpose of data processing:
Our app uses Net Promoter Score (NPS) to measure customer satisfaction and loyalty, with a focus on providing a streamlined experience.
Legal basis:
Processing is based on our legitimate interests in improving our platform (Art. 6 (1) (f) GDPR).
Recipients:
Other recipients of the data are processors for the processing of customer enquiries. As a processor, the service provider is obliged to process the data only in accordance with our instructions.
Transfer to third countries:
Data is transferred to the United States of America. The order processing contracts with the service provider contain standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
Your personal data will be deleted as soon as the purpose or legal basis for storage no longer applies. In all other respects, Section 1.5 of this privacy policy applies.
2.9 Customer support
Nature and purpose of data processing:
In order to provide you with the best possible support when using our services, we offer you the option of using our customer service in chat form in the app or contacting us by email. All enquiries sent to us become support tickets. In this context, we process your name, your email address if applicable, and the content of your enquiry.
To process support tickets, we may also record your screen, including audio, with your consent. Your consent is voluntary, so you can also use our customer support without screen recording.
Legal basis:
The data in the context of customer support is processed for the fulfilment of contractual measures (Art. 6 (1) (b) GDPR).The screen recording is carried out exclusively with your express consent in accordance with Art. 6 (1) (a) GDPR.Please note that your consent only relates to the respective screen recording as part of the customer ticket and that you must give your consent again for all future tickets.
Recipients:
The recipient of the data is an IT service provider in the United States. As a processor, the service provider is obliged to process the data only in accordance with our instructions set out in a contract for commissioned data processing.
Transfer to a third country:
Appropriate safeguards are in place for the transfer of your data to countries outside the EU. The contract for commissioned data processing with the service provider contains standard contractual clauses approved by the EU Commission and appropriate guarantees that the data protection obligations will be complied with.
Storage period:
Your data will be deleted as soon as we have solved your ticket.
Revocation of consent:
You can revoke your consent at any time with effect for the future.
3. Changes to the privacy policy
We reserve the right to amend this privacy policy at any time. The current version of the privacy policy applies.