1. Who We Are

LOLA ("the Service") is a lead management SaaS platform operated by OXO Digital Ltd ("OXO", "we", "us", "our"), a company registered in Mauritius.

Contact: dpo@oxo.mu

2. Scope of This Policy

This Privacy Policy explains how LOLA collects, uses, stores, and protects personal data when:

• A lead submits information via a LOLA web form or landing page;
• A lead responds to an ad with a Meta Lead Ad or Google Lead Form connected to LOLA;
• A user accesses the LOLA platform as an employee or agent of a tenant organization.

3. Data We Collect

3.1 Lead Data (collected on behalf of tenants)

When you submit a lead form — whether on a website, through a Meta Lead Ad, or a Google Lead Form — we may collect:

• Full name (first name, last name)
• Email address
• Phone number
• Any custom fields defined by the tenant (e.g., project type, budget, location, message)
• Submission timestamp and source (form name, campaign name)

3.2 Platform User Data

For users who log in to LOLA as members of a tenant workspace:

• Name and email address
• Activity logs (actions performed within the platform)
• Authentication tokens (stored encrypted)

3.3 Technical Data

• IP address and browser information (server logs)
• Webhook metadata from connected ad platforms (Meta, Google)

Data not provided by you directly

Some professional contact details in LOLA are not submitted by the individual. A tenant may add them manually, import them from a file, or obtain them from publicly available professional sources and B2B data-enrichment providers — typically a name, job title, employer, professional email address, LinkedIn profile URL, company website, country and business sector.

Where we hold such data, the tenant informs you of its origin no later than the first message sent to you, and every such message carries a one-click link to object (see Sections 5 and 9).

4. How We Use Your Data

We use collected data exclusively to:

• Route and display lead submissions to the appropriate tenant;
• Deduplicate contacts and match leads to existing records;
• Send notifications to tenant users about new leads;
• Provide the LOLA CRM features (pipeline, deal tracking, assignment);
• Maintain platform security, integrity, and audit logs;
• Allow a tenant to contact you individually by email about its products or services, where this relates to your professional role (business-to-business outreach). Such messages are written and sent one-by-one by a named person at the tenant, from that person's own mailbox, and always include a link to object.
• Record and honour your objection to being contacted, including keeping a one-way hash of your email address so that the objection survives even if your contact record is deleted and later re-supplied to us (see Section 7).

We do not use personal data for advertising, profiling, automated mass-mailing campaigns, or any purpose beyond the service delivery described above.

5. Legal Basis for Processing

We process personal data under the following legal bases (under GDPR and applicable Mauritian data protection law):

• Consent: when leads voluntarily submit a form;
• Legitimate interests: for platform security and fraud prevention; and for business-to-business outreach to professional contacts, where the message relates to the recipient's professional role (Article 6(1)(f) GDPR). You may object at any time, free of charge, using the link included in every message or the contact details in Section 11 — and we will stop;
• Contract: for processing data on behalf of tenants under a data processing agreement.

Your right to object is absolute here. Where we rely on legitimate interests for outreach, we stop contacting you as soon as you object — we do not ask you to justify the request, and we do not weigh it against our own interest.

6. Data Storage & Security

• Database: PostgreSQL hosted on Laravel Cloud (EU/US infrastructure). Data is isolated per tenant using row-level security.
• Encryption: OAuth tokens and sensitive credentials are encrypted using envelope encryption (per-tenant encryption keys). Data in transit is protected by TLS 1.2+.
• Attachments: Files are stored with access-controlled signed URLs (5-minute expiry). No public access to raw attachment URLs.
• Backups: Automated daily backups with point-in-time recovery.

7. Data Retention

Lead and contact data is retained for 24 months from the date of last activity, unless:

• The tenant requests earlier deletion;
• You submit a data deletion request (see Section 9);
• Applicable law requires a different retention period.

One exception, and it exists to protect you. If you object to being contacted, we keep a one-way cryptographic hash of your email address — not the address itself — on a suppression list, for as long as the tenant workspace exists. This is the only way to honour your objection if your details are supplied to us again later. It is pseudonymised data, not anonymous data, and it is never used for any other purpose, never displayed, and never shared.

8. Data Sharing

We do not sell, rent, or share your personal data with third parties for commercial purposes.

Data may be shared with:

• Tenant organizations: the business that owns the LOLA workspace to which your lead was submitted;
• OXO group entities: solely for internal service delivery;
• Infrastructure providers: Laravel Cloud (hosting), Cloudflare (CDN/DNS) — under data processing agreements;
• Law enforcement: only when required by applicable law.

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data;
• Object to or restrict processing;
• Receive a copy of your data in a portable format.

To exercise any of these rights, visit our Data Deletion & Rights page or contact us at dpo@oxo.mu.

10. Meta Lead Ads

LOLA integrates with the Meta Lead Ads platform (Facebook/Instagram). When you submit a Meta Lead Ad:

• Meta shares your submitted information with the advertiser (tenant) via the Meta Lead Ads API;
• LOLA receives this data via a secure webhook and stores it within the tenant's workspace;
• Meta's own Privacy Policy governs how Meta processes your data on their platform.

11. Cookies

The LOLA web application uses only essential session cookies for authenticated users. No advertising or tracking cookies are used. Public-facing lead forms may use a CSRF token cookie for security.

12. Changes to This Policy

We may update this policy periodically. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact

For privacy-related questions or to exercise your rights:

• Email: dpo@oxo.mu
• Data Protection Officer: Jean Marc Santucci, OXO Digital Ltd, Mauritius
• Data deletion requests: hilola.app/data-deletion