Privacy, Compliance & Security Policy

XLR8Leads delivers a suite of automation modules including Speed to Lead, Follow-Up, Recover, Ad-Ons, Out of Hours, Reputation, Document Collection, eCommerce, Webinars and others under a unified compliance framework. Each module is operated with the same strict safeguards to ensure lawful engagement, secure data handling, and brand-safe outcomes.

12.1 Consent & Lawful Basis

• All outreach is performed only where a lawful basis exists (e.g., prior consent, contractual necessity, or legitimate interest).

• Re-permissioning campaigns are recommended when consent records are uncertain, incomplete, or outdated.

• Consent records are securely maintained in accordance with regional laws, including GDPR, CCPA, CASL, Spam Act 2003, and DPDPA 2023.

12.2 Data Minimisation & Purpose Limitation

• Only the minimum information necessary to deliver each module is collected and processed.

• No personal data is copied, sold, or used outside of the agreed campaign or workflow scope.

• All workflows are reviewed periodically to ensure alignment with compliance obligations.

12.3 Transparency & Opt-Outs

• Every outbound communication clearly identifies the sender and includes simple, accessible opt-out instructions.

• SMS and messaging campaigns comply with A2P, TCPA, CASL, Spam Act 2003, and DPDPA 2023, while email, WhatsApp, and other channels follow their respective legal standards.

• Opt-out requests are honoured immediately, logged for audit purposes, and confirmed back to the contact.

12.4 Module-Specific Safeguards

• Speed to Lead – Ensures prospects are contacted quickly, but always within compliant communication windows.

• Follow-Up – Designed to re-engage warm leads on-demand while maintaining opt-out options.

• Recover – Used to re-engage missed opportunities lawfully, turning unconverted leads into compliant new outreach.

• Out of Hours – Configured to respect local time zones and regulatory contact-hour restrictions.

• Reputation – Manages post-sale communications ethically, including customer feedback and review requests.

• Document Collection – Where verification documents (e.g., ID or financial proof) are required, outreach may begin via SMS but transitions to WhatsApp for secure, encrypted document sharing across multiple file formats.

• eCommerce – Operates under opt-in frameworks for cart recovery and promotional messaging, with transparent unsubscribe mechanisms.

• Webinars – Engagement flows for pre- and post-event communication are managed with explicit opt-in and data protection safeguards.

• Ad-Ons (Resell, Cross-Sell, Upsell) – This module is designed to unlock new revenue from the client’s existing database by re-engaging prior leads and customers with contextually relevant offers. Because these databases often include a mix of different contact types, the following rules apply:

1. Current Customers

• Lawful basis: Contractual necessity or legitimate interest.

• You may engage them with:

• Upsell opportunities (higher-tier products or services).

• Cross-sell opportunities (related products or services).

• Resell opportunities (repeat purchase cycles).

• Conditions: Clear opt-out instructions must be included in all communications.

2. Ex-Customers (recent churn, past 6–12 months)

• Lawful basis: Legitimate interest may apply if the outreach is related to their prior purchase, if it’s within a reasonable timeframe.

• You may engage them with:

• Resell offers reminding them of prior services.

• Cross-sell opportunities that are closely related to prior use.

• Conditions:

• Outreach must be relevant and non-intrusive.

• Where uncertainty exists, a re-permissioning campaign should precede ongoing communication.

3. Inactive Leads (engaged in past but never converted)

• Lawful basis: Prior consent must be demonstrated (e.g., original opt-in to receive marketing).

• You may engage them with:

• Cross-sell or upsell if related to their original inquiry.

• Resell-style messaging if their inquiry indicated purchase intent.

• Conditions:

• Consent must still be valid (not excessively aged).

• If consent status is unclear, initiate a re-permissioning campaign first.

4. Aged Leads (very old, unclear consent)

• Lawful basis: Cannot re-engage without refreshed consent.

• You may not directly engage them with promotional outreach.

• Recommended:

• Launch a re-permissioning campaign (e.g., “Would you like to hear from us again?”) before including them in cross-sell or upsell flows.

12.5 Compliance Monitoring

• All modules undergo routine compliance reviews to ensure alignment with global privacy and consumer protection standards.

• Clients are responsible for ensuring that contact lists provided to XLR8Leads were lawfully collected with proper consent.

By applying this comprehensive compliance framework across all modules, XLR8Leads ensures that every engagement from lead capture to document collection and beyond is delivered securely, ethically, and in full compliance with applicable laws.