{"id":3649,"date":"2026-10-12T12:32:09","date_gmt":"2026-10-12T12:32:09","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3649"},"modified":"2026-10-12T12:43:07","modified_gmt":"2026-10-12T12:43:07","slug":"lead-generation-platforms-gdpr-2026","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/lead-generation-platforms-gdpr-2026\/","title":{"rendered":"Lead Generation Platforms and the GDPR in 2026 \u2014 What to Implement Now"},"content":{"rendered":"

A customer fills out a form, clicks \u201csend”, and within three seconds their data passes through three different legal regimes. Your product team sees one endpoint. The supervisory authority will see three roles \u2014 and three sets of obligations. And if you earn a commission on a confirmed contract, a single field in the form determines whether your billing model has a legal basis.<\/p>\n

If you operate a platform that connects customers with contractors \u2014 a marketplace, lead generation service, or comparison site with a contact form \u2014 this article is for you. I will explain why lead generation platforms and the GDPR<\/strong> are an area where an error in role architecture costs more than an error in a privacy notice. You will learn how to assign the correct role to each stage of the data flow, why a survey confirming whether a contract has been concluded requires separate consent, and what to do to ensure that your privacy policy<\/a> reflects how your product actually works.<\/p>\n

Key concepts you need to know<\/h2>\n

Before we move on to the role map, let us establish the terminology. The following concepts appear in every document, agreement, and inspection \u2014 and misunderstanding them is the source of most problems.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Concept<\/th>\nWhat it means for the platform operator<\/th>\n<\/tr>\n<\/thead>\n
Controller<\/strong><\/td>\nAn entity that independently determines the purposes and means of processing personal data. If you decide why you collect data and what you do with it \u2014 you are the controller<\/td>\n<\/tr>\n
Processor<\/strong><\/td>\nAn entity that processes data solely on the controller\u2019s documented instructions. It does not determine the purposes \u2014 it follows instructions<\/td>\n<\/tr>\n
Joint controller<\/strong><\/td>\nTwo or more entities that jointly determine the purposes and means of processing. This requires a formal arrangement under Article 26 of the GDPR<\/td>\n<\/tr>\n
Legitimate interest (Article 6(1)(f) of the GDPR)<\/strong><\/td>\nA legal basis for processing that requires a documented balancing test: your interest vs. the individual\u2019s rights. The burden of proof lies with you (GDPR, Recital 69<\/a>)<\/td>\n<\/tr>\n
Commercial communication (Article 398 of the PKE)<\/strong><\/td>\nAny form of communication intended to promote the goods, services, or image of a business. Telephone or electronic contact for this purpose requires prior consent (PKE, Article 398<\/a>)<\/td>\n<\/tr>\n
Record of processing activities<\/strong><\/td>\nTwo separate documents: a record of your own processing activities (Article 30(1) of the GDPR \u2014 for the controller) and a record of categories of processing activities (Article 30(2) of the GDPR \u2014 for the processor)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Three roles of a lead generation platform operator in relation to the same data<\/h2>\n

The most common mistake? Treating the platform as a single legal entity throughout the entire data flow. In reality, a role is not a feature of the system \u2014 it is a feature of a particular stage in the data flow<\/strong>. The same set of data (name, telephone number, inquiry description) passes through three different legal regimes before anyone calls the customer.<\/p>\n

Stage 1: collecting the inquiry \u2014 the operator as controller<\/h3>\n

The customer fills out a form on your platform. At this point, you determine:<\/p>\n

    \n
  1. What data you collect (the scope of the form fields)<\/li>\n
  2. For what purpose (matching the customer with a contractor, verification, commission settlement)<\/li>\n
  3. How long you retain it<\/li>\n
  4. Who you will disclose it to<\/li>\n<\/ol>\n

    Since you independently determine the purposes and means of processing \u2014 you are the controller<\/strong> within the meaning of Article 4(7) of the GDPR<\/a>. This entails the full set of obligations: the information notice under Article 13, a legal basis under Article 6, and a record of processing activities under Article 30(1).<\/p>\n

    The obligation under Article 13(1)(e) of the GDPR requires you to display the name of the contractor who will receive the inquiry before the form is submitted<\/strong>. Not in the confirmation email. Not in the terms and conditions. On screen, before the customer clicks \u201csend”.<\/p>\n

    Stage 2: delivering the lead \u2014 the contractor as a separate controller<\/h3>\n

    Once the inquiry has been delivered, the contractor independently decides whether to contact the customer, when to do so, what offer to make, and how long to retain the data. The contractor determines the purposes and means independently.<\/p>\n

    Therefore, the contractor receiving the lead is a separate controller, not a joint controller<\/strong>. Joint controllership under Article 26 of the GDPR requires the joint determination of purposes and means \u2014 whereas here, each party acts independently.<\/p>\n

    Consequences:<\/p>\n

      \n
    1. The contractor has its own information obligation under Article 14 of the GDPR towards the customer whose data it has received<\/li>\n
    2. You do not need a joint controllership arrangement \u2014 you need a precise description of the roles in the privacy policy<\/li>\n
    3. In the confirmation email, provide the recipient\u2019s registration details and a link to its privacy policy<\/li>\n<\/ol>\n

      Stage 3: the contractor dashboard \u2014 the operator as processor<\/h3>\n

      The contractor logs in to the dashboard and uploads photos of completed projects, service descriptions, and the contact details of its employees. The contractor enters this data for its own purposes and under its own responsibility. You provide the tool.<\/p>\n

      In this respect, you are a processor<\/a><\/strong> \u2014 you process data on the instructions of the contractor (the controller). Article 28 of the GDPR applies to you: a data processing agreement, acting solely on documented instructions, and an obligation to report breaches.<\/p>\n

      And this is where the trap I see most often arises.<\/p>\n

      When a processor becomes a controller \u2014 the marketing trap<\/h3>\n

      Your marketing team finds a project photo in the contractor\u2019s dashboard \u2014 a smiling crew against the backdrop of a finished interior. They post it on the platform\u2019s social media channels. At that point:<\/p>\n

        \n
      1. You have gone beyond the controller\u2019s (contractor\u2019s) instructions<\/li>\n
      2. You have used entrusted data for your own purpose<\/li>\n
      3. Under Article 28(10) of the GDPR, you have become the controller of that data<\/li>\n
      4. You are processing people\u2019s images without a legal basis and without fulfilling the information obligation<\/li>\n<\/ol>\n

        If the material is to be used in advertising for the platform \u2014 obtain separate consent for the use of the person\u2019s image, granted directly to the operator. Without it, every such use constitutes an infringement.<\/p>\n

        Contact us<\/a><\/p>\n

        Role map \u2014 overview of obligations at each stage<\/h2>\n

        The table below organises the obligations assigned to each role. Use it as the foundation for your privacy policy and agreements.<\/p>\n\n\n\n\n\n\n\n\n\n
        Stage of the data flow<\/th>\nOperator\u2019s role<\/th>\nOperator\u2019s obligations<\/th>\nOther party\u2019s obligations<\/th>\n<\/tr>\n<\/thead>\n
        Collecting the inquiry (form)<\/td>\nController<\/td>\nInformation notice under Article 13, legal basis under Article 6, record of processing activities under Article 30(1), displaying the recipient\u2019s name before submission<\/td>\n\u2014<\/td>\n<\/tr>\n
        Delivering the lead to the contractor<\/td>\nController (disclosing party)<\/td>\nInformation about the recipient in the confirmation email, procedure for forwarding requests under Articles 17 and 19 of the GDPR<\/a><\/td>\nContractor: its own information obligation under Article 14 of the GDPR<\/td>\n<\/tr>\n
        Contractor dashboard (data uploaded by the contractor)<\/td>\nProcessor<\/td>\nData processing agreement under Article 28, acting on instructions, reporting a breach within 36 hours, record of categories of processing activities under Article 30(2)<\/td>\nContractor: controller of its employees\u2019 data and materials<\/td>\n<\/tr>\n
        Survey after the lead is delivered<\/td>\nController<\/td>\nSeparate consent to be contacted (optional checkbox), separate email\/SMS consents, contact schedule in the privacy policy<\/td>\n\u2014<\/td>\n<\/tr>\n
        Platform marketing using contractors\u2019 materials<\/td>\nController (Article 28(10))<\/td>\nSeparate consent for the use of a person\u2019s image, full liability for the absence of a legal basis<\/td>\n\u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Survey after delivering the lead \u2014 why legitimate interest is no longer enough<\/h2>\n

        The commission model looks simple: the operator earns money when it confirms that the customer and contractor have signed a contract. The only way to confirm this is to contact the customer \u2014 after 30, 60, and 90 days, and after 6 and 11 months.<\/p>\n

        Until now, many operators have based this contact on the controller\u2019s legitimate interest<\/strong> under Article 6(1)(f) of the GDPR. The argument was: \u201cI need to verify whether the transaction took place so that I can settle the commission”.<\/p>\n

        The problem is that this argument requires a documented balancing test. And the balancing test takes into account the reasonable expectations of the individual at the time the data is collected<\/strong> (GDPR, Recital 47<\/a>). A customer who has submitted an inquiry about a bathroom renovation does not expect to receive calls and emails for the next 11 months asking whether they have signed a contract.<\/p>\n

        Additional restriction under the Electronic Communications Law<\/h3>\n

        Article 398(1) of the Electronic Communications Law<\/a> prohibits the use of telephones and terminal equipment to send commercial communications without prior consent \u2014 including in B2B relationships. This provision replaced the previous regulations under the Act on the Provision of Electronic Services and the Telecommunications Law.<\/p>\n

        The dividing line is as follows: purely verification-related contact (confirming data or status) is generally not covered by Article 398 of the PKE. However, if other offers are recommended during the conversation or in the message, or if it includes encouragement to make a purchase or any promotional element \u2014 the contact becomes a commercial communication and requires prior consent.<\/p>\n

        Note:<\/strong> there is no unequivocal position from either the President of UKE or the President of UODO directly determining whether a telephone satisfaction survey or verification survey constitutes a \u201ccommercial communication”. The distinction is based on the interpretation of Article 398 of the PKE and depends on the actual content of the contact, not its label.<\/p>\n

        What this means for your form<\/h3>\n

        You need a separate, optional checkbox<\/strong> for consent to be contacted to verify whether a contract has been concluded. Failure to select it must not prevent the inquiry from being submitted \u2014 otherwise, the consent will not be freely given (Article 7(4) of the GDPR).<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
        Form element<\/th>\nRequired<\/th>\nPrevents the inquiry from being submitted?<\/th>\n<\/tr>\n<\/thead>\n
        Inquiry details (name, telephone number, description)<\/td>\nYes<\/td>\nYes<\/td>\n<\/tr>\n
        Acknowledgement of the privacy policy<\/td>\nYes (notice, not acceptance)<\/td>\nYes<\/td>\n<\/tr>\n
        Acceptance of the terms and conditions<\/td>\nYes (separate action)<\/td>\nYes<\/td>\n<\/tr>\n
        Consent to email contact for verification<\/td>\nOptional<\/td>\nNo<\/td>\n<\/tr>\n
        Consent to SMS contact for verification<\/td>\nOptional (separate field)<\/td>\nNo<\/td>\n<\/tr>\n
        Consent to email marketing<\/td>\nOptional (separate field)<\/td>\nNo<\/td>\n<\/tr>\n
        Consent to SMS marketing<\/td>\nOptional (separate field)<\/td>\nNo<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Consent to email and consent to SMS are two separate consents<\/strong>, not one. Separate fields are required for different processing purposes (UODO \u2014 consent is not always the legal basis for processing<\/a>).<\/p>\n

        Without optional consent to the survey \u2014 you have no evidentiary basis for commission settlements. The entire settlement model rests on uncertain ground.<\/p>\n

        Consent layer, cookie banner, and technical pitfalls<\/h2>\n

        Consent banner \u2014 equal prominence of the reject option<\/h3>\n

        Article 7 of the GDPR requires consent to be freely given, specific, informed, and unambiguous. Pre-ticked boxes do not meet this standard. The EDPB has adopted guidelines on dark patterns<\/a> in interfaces \u2014 visually prioritising \u201cAccept” while hiding \u201cReject” in subsequent layers may undermine the validity of consent.<\/p>\n

        The safe approach: make both options equally accessible on the first layer of the banner<\/a>. There are no binding guidelines requiring the buttons to look identical, but the requirement is functional \u2014 the authority assesses the overall experience to determine whether the user could easily refuse.<\/p>\n

        Analytics and advertising pixels<\/h3>\n

        Article 399(3) of the PKE provides a \u201cstrictly necessary” exemption only for session cookies. It does not cover analytics or advertising pixels. These tools must be blocked until consent has been obtained.<\/p>\n

        A separate pitfall: enhanced conversions<\/strong> in advertising tools. If your team enables \u201cadvanced matching” on forms, the customer\u2019s hashed email address and telephone number are sent to the advertising platform without a legal basis. Disable this feature.<\/p>\n

        The CJEU judgment in Case C-40\/17 (Fashion ID<\/em>) confirmed that deliberately embedding an element serving a shared purpose (e.g. an advertising pixel) may create joint controllership for the collection and disclosure phase (CJEU press release<\/a>). The assessment must be operational \u2014 it depends on the specific mechanism, not the product\u2019s name.<\/p>\n

        Inquiry deduplication \u2014 a hidden breach<\/h3>\n

        If your system compares telephone numbers for deduplication and displays the message \u201cthis inquiry has already been submitted” \u2014 you disclose to the person at the keyboard that the given number is in the database. This constitutes a breach affecting a third party.<\/p>\n

        The safe solution: for logged-in users \u2014 a server-side flag; for guests \u2014 a session cookie only. Never compare telephone numbers and never display a message revealing that a number is present in the database.<\/p>\n

        Document vs. product \u2014 what the supervisory authority will actually inspect<\/h2>\n

        The most common flaw in projects of this kind is not an incorrect privacy notice, but a promise made in a document that the product does not fulfil<\/strong>. The outcome of an inspection is determined by the discrepancy between the privacy policy and the system\u2019s actual behaviour.<\/p>\n

        Examples of discrepancies I regularly encounter:<\/p>\n\n\n\n\n\n\n\n\n
        What the document states<\/th>\nWhat the product does<\/th>\nRisk<\/th>\n<\/tr>\n<\/thead>\n
        \u201cWe jointly control data with advertising providers” (heading)<\/td>\nThe body of the same section describes them as separate controllers<\/td>\nAn inconsistency that undermines the credibility of the entire document<\/td>\n<\/tr>\n
        \u201cWe retain data for 12 months”<\/td>\nNo automatic deletion, backups with no overwrite cycle<\/td>\nBreach of the storage limitation principle<\/td>\n<\/tr>\n
        \u201cYou can withdraw your consent at any time”<\/td>\nNo toggle in the dashboard, no unsubscribe link in messages<\/td>\nA separate infringement of Article 7(3) of the GDPR<\/td>\n<\/tr>\n
        \u201cWe will notify recipients that the data has been erased”<\/td>\nNo automatic notification to contractors following a request under Article 17 of the GDPR<\/td>\nErasure request fulfilled only in part<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Before publishing your privacy policy, check it line by line to ensure that every promise has a counterpart in the code and configuration.<\/p>\n

        Operational deadlines you need to know<\/h2>\n

        The following deadlines arise from the GDPR, the PKE, and standard data processing agreements. Record them and assign them to specific members of your team.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
        Deadline<\/th>\nEvent<\/th>\nResponsible party<\/th>\n<\/tr>\n<\/thead>\n
        180 seconds<\/td>\nValidity of the SMS code used to verify the inquiry<\/td>\nProduct \/ backend<\/td>\n<\/tr>\n
        36 hours<\/td>\nNotification to the contractor (controller) of a breach involving entrusted data<\/td>\nDPO \/ compliance<\/td>\n<\/tr>\n
        72 hours<\/td>\nNotification of your own breach to the President of UODO<\/td>\nDPO \/ management board<\/td>\n<\/tr>\n
        3 business days<\/td>\nForwarding a data subject\u2019s request to the contractor<\/td>\nCustomer service \/ DPO<\/td>\n<\/tr>\n
        14 days<\/td>\nAdvance notice to contractors of a change of subprocessor<\/td>\nLegal \/ operations<\/td>\n<\/tr>\n
        30 days<\/td>\nDeletion of entrusted data after the agreement ends<\/td>\nProduct \/ backend<\/td>\n<\/tr>\n
        12 months<\/td>\nCommission settlement period from the delivery of the inquiry<\/td>\nFinance \/ legal<\/td>\n<\/tr>\n
        3 years<\/td>\nRetention related to the limitation period for claims (until the end of the calendar year)<\/td>\nLegal<\/td>\n<\/tr>\n
        5 years<\/td>\nRetention of accounting records<\/td>\nAccounting<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Two records of processing activities \u2014 why one is not enough<\/h2>\n

        A platform operator that acts as both controller and processor must maintain two separate records<\/strong>:<\/p>\n

          \n
        1. Record of its own processing activities<\/strong> (Article 30(1) of the GDPR) \u2014 as controller: customer data from forms, settlement data, marketing data<\/li>\n
        2. Record of categories of processing activities<\/a> carried out on behalf of contractors<\/strong> (Article 30(2) of the GDPR) \u2014 as processor: contractors\u2019 employee data, offer materials, photos<\/li>\n<\/ol>\n

          The exemption from the record-keeping obligation for entities with fewer than 250 employees does not apply<\/strong> if the processing is not occasional (GDPR, Article 30(5)<\/a>). A lead generation platform processes data regularly \u2014 the exemption does not apply.<\/p>\n

          Additionally, make the list of subprocessors available in the contractor dashboard, with notice of changes given 14 days in advance (Article 28(2) of the GDPR). Changing a subprocessor without the controller\u2019s (contractor\u2019s) prior written authorisation constitutes a breach of the data processing agreement.<\/p>\n

          Data processing agreements across the entire vendor stack<\/h2>\n

          Signing data processing agreements with vendors is not a formality that can be postponed. Every vendor that processes personal data on your behalf requires an agreement under Article 28 of the GDPR.<\/p>\n

          A typical vendor stack for a lead generation platform:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
          Vendor<\/th>\nData categories<\/th>\nData processing agreement required?<\/th>\nTransfer outside the EEA?<\/th>\n<\/tr>\n<\/thead>\n
          Hosting \/ database<\/td>\nAll platform data<\/td>\nYes<\/td>\nCheck server locations<\/td>\n<\/tr>\n
          CMS<\/td>\nContent data, account data<\/td>\nYes<\/td>\nCheck<\/td>\n<\/tr>\n
          SMS provider<\/td>\nTelephone numbers, message content<\/td>\nYes<\/td>\nCheck<\/td>\n<\/tr>\n
          Email provider<\/td>\nEmail addresses, correspondence content<\/td>\nYes<\/td>\nCheck<\/td>\n<\/tr>\n
          Analytics tool<\/td>\nIdentifiers, behavioural data<\/td>\nYes (or joint controllership)<\/td>\nCheck<\/td>\n<\/tr>\n
          Advertising platform<\/td>\nHashed contact data<\/td>\nYes or joint controllership<\/td>\nCheck<\/td>\n<\/tr>\n
          Consent management platform (CMP)<\/td>\nConsent logs<\/td>\nYes<\/td>\nCheck<\/td>\n<\/tr>\n
          Accounting firm<\/td>\nSettlement data<\/td>\nYes<\/td>\nUsually not<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          For transfers outside the EEA<\/a>: the mere fact that infrastructure is located in the US or general declarations of compliance with the Data Privacy Framework are not sufficient. Check whether the vendor is certified in the DPF register. If not \u2014 use the standard contractual clauses (SCCs) under Article 46 of the GDPR together with an assessment of the law and practices of the recipient country (EDPB Recommendations 01\/2020<\/a>).<\/p>\n

          Additional DSA and P2B obligations \u2014 what overlaps with the GDPR layer<\/h2>\n

          If your platform enables consumers to conclude contracts with businesses, you are also subject to obligations under the Digital Services Act (DSA)<\/a> and the P2B Regulation<\/a>.<\/p>\n

          The most important obligations that overlap with the personal data layer:<\/p>\n

            \n
          1. Verification of traders\u2019 identities<\/strong> and retention of identification data for 6 months after the end of the business relationship (Article 30 of the DSA)<\/li>\n
          2. Statement of reasons for a moderation decision<\/strong> specifying the type of restriction, the facts, the legal or contractual basis, information on the use of automated means, and available means of redress (Article 17 of the DSA)<\/li>\n
          3. Statement of reasons for restricting or suspending a service<\/strong> provided to a business user, supplied on a durable medium (Article 4 of the P2B Regulation)<\/li>\n
          4. Point of contact<\/strong> for authorities and recipients of the service (Articles 11\u201312 of the DSA)<\/li>\n
          5. Internal complaint-handling system<\/strong> (Article 11 of the P2B Regulation)<\/li>\n<\/ol>\n

            The same moderation decision (e.g. suspending a contractor\u2019s account) may need to meet the statement-of-reasons requirements under both regulations. Add three separate addresses to the website footer: general contact, personal data matters, and a point of contact for content reports (DSA).<\/p>\n

            Implementation order \u2014 where to start<\/h2>\n

            You do not need to do everything at once. The sequence below organises the work from the highest priority. The minimum realistic implementation time for a platform with a limited number of integrations is approximately 4\u20138 weeks \u2014 the GDPR does not specify implementation deadlines, but the longer you delay, the longer you operate without a legal basis.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
            Week<\/th>\nAction<\/th>\nOwner<\/th>\n<\/tr>\n<\/thead>\n
            1<\/td>\nInventory data flows and assign roles (controller \/ processor) to each stage<\/td>\nLegal + product<\/td>\n<\/tr>\n
            1\u20132<\/td>\nDetermine the legal basis for each operation and conduct a balancing test for legitimate interests<\/td>\nLegal<\/td>\n<\/tr>\n
            2\u20133<\/td>\nRedesign the form: separate the checkboxes, display the recipient\u2019s name, create a consent log<\/td>\nProduct + frontend<\/td>\n<\/tr>\n
            2\u20133<\/td>\nPrepare the first-layer notice and a privacy policy that reflects the product<\/td>\nLegal<\/td>\n<\/tr>\n
            3\u20134<\/td>\nSign data processing agreements with vendors and verify transfers outside the EEA<\/td>\nLegal + operations<\/td>\n<\/tr>\n
            3\u20134<\/td>\nConfigure the consent banner, block analytics and pixels until consent is obtained, disable enhanced conversions<\/td>\nMarketing + product<\/td>\n<\/tr>\n
            4\u20135<\/td>\nSet up two records of processing activities<\/td>\nLegal \/ DPO<\/td>\n<\/tr>\n
            4\u20135<\/td>\nImplement the breach procedure (36h \/ 72h) and the request-forwarding process (3 business days)<\/td>\nDPO + customer service<\/td>\n<\/tr>\n
            5\u20136<\/td>\nReview survey content \u2014 remove promotional elements and add an opt-out option to every contact<\/td>\nMarketing + legal<\/td>\n<\/tr>\n
            6\u20138<\/td>\nAudit the consistency of documents with the product, testing, monitoring<\/td>\nLegal + QA<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            How we can help your platform<\/h2>\n

            We conduct a platform data journey audit<\/a> \u2014 from the form to commission settlement. We assign a legal role to each stage of the data flow, verify the consent layer and consent logs, prepare data processing agreements with vendors, and check whether the privacy policy reflects how your product actually works.<\/p>\n

            Three levels of engagement:<\/p>\n

              \n
            1. Operational minimum<\/strong> \u2014 a map of roles assigned to each stage + improved checkboxes and first-layer notice<\/li>\n
            2. Solid foundation<\/strong> \u2014 documents + data processing agreements with vendors + two records of processing activities + breach and request-handling procedures<\/li>\n
            3. Full protection<\/strong> \u2014 implementation with the product team, audit questionnaires for contractors, operational templates (statement of reasons for a moderation decision, response to a GDPR request, statement of reasons for suspending a business partner)<\/li>\n<\/ol>\n

              We combine law with product context. We do not create documents \u201cjust in case” \u2014 we design rules where the risk actually arises.<\/p>\n

              Contact us<\/a><\/p>\n

              Lead generation platforms and the GDPR in 2026 \u2014 what to implement now<\/h2>\n

              One data flow, three legal roles, one optional checkbox determining the legality of the commission model. If you operate a platform that connects customers with contractors, your legal architecture must reflect your product architecture \u2014 stage by stage.<\/p>\n

              Start with the role map. Separate the checkboxes. Sign data processing agreements. Check whether your privacy policy describes what your product actually does. And if you need help organising these areas \u2014 contact us<\/a>.<\/p>\n

              Frequently asked questions<\/h2>\n

              Is my platform a joint controller together with the contractors?<\/strong>
              \nUsually not. Joint controllership under Article 26 of the GDPR requires the joint determination of the purposes and means of processing. If the contractor independently decides whether and when to contact the customer, what offer to make, and how long to retain the data \u2014 it is a separate controller. Your role changes depending on the stage: controller when collecting the inquiry, processor when operating the contractor dashboard. A joint controllership arrangement is not required \u2014 you need a precise description of the roles in the privacy policy and a data processing agreement covering the dashboard data.<\/p>\n

              Will an additional survey consent checkbox reduce my form conversion rate?<\/strong>
              \nAn additional field increases the number of actions required from the user \u2014 that is a fact. However, there are no verified numerical benchmarks (e.g. \u201cone checkbox reduces conversion by X%”) in Polish-language official sources or primary research (              UODO \u2014 consent is not always the legal basis for processing<\/a>). Without this checkbox, you risk losing the evidentiary basis for commission settlements \u2014 the cost of that risk is higher than the potential drop in conversion. The checkbox must be optional and must not prevent the inquiry from being submitted.<\/p>\n

              As a company with fewer than 250 employees, do I need to maintain two records of processing activities?<\/strong>
              \nYes, if the processing is not occasional. A lead generation platform processes data regularly \u2014 the exemption under Article 30(5) of the GDPR does not apply. You maintain a record of your own processing activities (Article 30(1)) as controller and a record of categories of processing activities (Article 30(2)) as processor for contractors.<\/p>\n

              How long can I retain lead data if the commission is settled over 12 months?<\/strong>
              \nRetention depends on the purpose. Data used to settle the commission \u2014 12 months from delivery of the inquiry. Data related to the limitation period for claims \u2014 up to 3 years, calculated until the end of the calendar year. Accounting records \u2014 5 years. Once each of these periods expires, data associated with the relevant purpose should be deleted. Implement automatic deletion with a defined backup overwrite cycle.<\/p>\n

              Can I activate analytics and pixels before obtaining consent if the data is hashed?<\/strong>
              \nNo. Article 399(3) of the PKE permits the \u201cstrictly necessary” exemption only for session cookies. Hashing does not change the fact that the data is sent to an advertising platform without a legal basis. Disable advanced matching and enhanced conversions on forms. Block analytics and pixels until consent has been obtained through the banner.<\/p>\n

              What will the authority actually inspect during an audit \u2014 the wording of the privacy policy or the product\u2019s behaviour?<\/strong>
              \nBoth \u2014 but the discrepancy between them will determine the outcome. The               President of UODO has imposed fines<\/a> for processing the data of customers and prospective customers without a legal basis. If the policy declares mechanisms that the product does not provide (automatic deletion, recipient notifications, a consent withdrawal toggle), the document itself becomes evidence of the infringement. Check line by line whether every promise in the policy has a counterpart in the code.<\/p>\n","protected":false},"excerpt":{"rendered":"

              Map controller and processor roles across lead forms, contractor dashboards, and surveys, then align consent, vendor agreements, and your privacy policy.<\/p>\n","protected":false},"author":13,"featured_media":3653,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"84ab329f-56bd-4718-bdaf-97f79a530458","sip_pair_state":"verified"},"categories":[1],"tags":[1533,1552,1446,1553,1531,1534],"specialization":[1215],"practice_area":[],"class_list":["post-3649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bez-kategorii","tag-data-breach","tag-dsa-en","tag-gdpr","tag-gdpr-audit","tag-personal-data-protection","tag-uodo-en","specialization-gdpr"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3649"}],"version-history":[{"count":4,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3649\/revisions"}],"predecessor-version":[{"id":3656,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3649\/revisions\/3656"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/3653"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3649"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3649"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}