1. Who we are (data controller)
The data controller is Outwork Software AS (organization number 937 497 687), operating the LeadsHeaven service, registered at Nedre gate 8A, 0551 Oslo, Norway. Contact: post@leadsheaven.com, +47 9796 8677.
2. What data we collect
2.1 Website visitors
Our website uses only strictly necessary cookies required to keep the site working (for example, remembering your cookie preference). We do not use tracking, advertising or third-party analytics cookies. Server logs may temporarily record IP address, user agent and requested URL for security and abuse prevention.
No third-party service is contacted when a page loads. If you choose to book a call, the scheduling widget provided by Calendly is loaded at that moment and the details you enter there (name, email, and any answers you give) are processed by Calendly on our behalf. If you never open the booking widget, no request is made to Calendly at all.
2.2 Prospects and business contacts
When we run outbound campaigns on behalf of a client, we process business contact data (name, work email, company, job title, public professional profile, publicly listed company information). The data controller for those campaigns is the client; LeadsHeaven acts as processor under a written agreement.
2.3 Clients and enquiries
If you contact us or become a client, we process the information you provide (name, work email, phone, company, message) and information generated through the engagement (invoices, contracts, correspondence).
3. Legal bases
- Consent — for non-essential cookies (we currently use none) and for optional marketing communications.
- Contract — to deliver services you have engaged us for.
- Legitimate interests — to run and secure the website, respond to enquiries, and, on behalf of clients, conduct business-to-business outreach to relevant professional contacts (GDPR art. 6(1)(f)).
- Legal obligation — bookkeeping, tax and other statutory requirements.
4. Cookies
We store a single, first-party value in your browser's local storage (lh-consent-v1) to remember your cookie choice so we do not repeat the banner. This is a strictly necessary preference cookie and does not identify you. If you decline, no other cookies are set. If we ever add analytics or marketing cookies, they will be loaded only after opt-in consent.
Opening the booking widget loads Calendly, which sets its own cookies needed to run the scheduling session. Because the widget is only fetched when you click to book, those cookies are never set simply by browsing the site. See Calendly's own privacy notice for the detail.
5. Recipients and subprocessors
We share personal data only with vetted subprocessors who help us operate the service (for example, hosting, email delivery infrastructure, meeting scheduling via Calendly, CRM and invoicing tools). All subprocessors are bound by data processing agreements. A current list is available on request from post@leadsheaven.com.
6. International transfers
Some subprocessors are located outside the EU/EEA — Calendly, which powers call booking, is based in the United States. Where that is the case, transfers rely on adequacy decisions, EU Standard Contractual Clauses or other lawful transfer mechanisms.
7. Retention
- Prospect data used in outbound campaigns: retained for the duration of the campaign and up to 12 months after last contact, unless a longer period is agreed with the client.
- Client contract and billing records: retained for the period required by Norwegian bookkeeping law (currently 5 years).
- Website server logs: retained up to 90 days.
8. Your rights
Under the GDPR you have the right to access, correct, delete, restrict or object to processing of your personal data, and the right to data portability. To exercise any of these rights, email post@leadsheaven.com. You can also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.
If you received an outbound message from us and want to opt out of further contact, reply "unsubscribe" or email the address above; we will remove you from active campaigns within a reasonable time.
9. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted transport (TLS), access controls, least-privilege permissions and vendor due diligence. No system is perfectly secure; if we become aware of a personal data breach that meets the notification threshold under the GDPR, we will notify the relevant authority and affected individuals as required.
10. Children
Our service is directed at businesses. We do not knowingly collect personal data from children under 16.
11. Changes to this policy
We may update this policy from time to time. Material changes will be highlighted on this page with an updated revision date.
12. Contact
Outwork Software AS — LeadsHeaven, Nedre gate 8A, 0551 Oslo, Norway. Email: post@leadsheaven.com. Phone: +47 9796 8677.