LeadAboard CRM System handles GDPR by acting as a data processor, offering a Data Processing Agreement (DPA), and providing tools for compliance such as a cookie consent banner, explicit opt-in forms, and the ability to delete or export data. Users (agencies/marketers) act as the data controller, responsible for obtaining lawful consent, while GoHighLevel ensures the platform supports, but does not guarantee, full compliance. HighLevel Support Portal +5

Key GDPR Features & Procedures:

Data Processing Agreement (DPA): GoHighLevel offers a DPA that includes Standard Contractual Clauses (SCCs) to legitimize data transfers to the USA, which can be found in the Agency Settings.

Cookie Consent Banner: The platform allows users to add a compliant cookie consent banner to landing pages and websites, crucial for UK/EU visitors.

Data Controller vs. Processor: GoHighLevel states it is the data processor and will not use client-uploaded data for its own purposes.

Right to be Forgotten/Data Portability: The platform provides mechanisms to export or delete customer data upon request, enabling compliance with rights of access and erasure.

Opt-in Consent Controls: Users can configure forms to avoid pre-checked boxes and ensure explicit consent for email/SMS marketing.

DND (Do Not Disturb) Functionality: Contacting a contact who has opted out can be managed via the DND system, which is automatically triggered by keywords like "STOP".

Data Privacy Framework: GoHighLevel is certified under the EU Data Privacy Framework.

Actionable Steps for Users:

Sign the DPA: Locate the DPA in your Agency Account under Settings > Compliance.

Enable Cookie Banners: Add a compliant banner to all funnels and websites.

Update Forms: Ensure all opt-ins are explicit (not pre-checked) and include links to your privacy policy.

Data Retention: Manually manage data removal for contacts who have not interacted with your service for a long period.