GDPR & Data Processing

Last updated 16 October 2026

The privacy policy covers this website. This page covers the thing your legal team actually needs to assess: what happens to personal data inside an engagement, when our people are working in your systems.

This page describes our intended approach, not a finished legal document, and has not yet been reviewed by counsel. It is not legal advice and is not a binding representation. Specific terms, the DPA itself, the breach-notification window, the sub-processor list as it stands at signature, are set by the signed agreement, not by this page — raise them on the first call rather than relying on what is written here.

Who is controller and who is processor

In a typical engagement you are the data controller for personal data in your systems, and LebSource acts as a processor, acting on your documented instructions. Where we determine purposes ourselves, our own recruitment, our own client correspondence, we are the controller, and the privacy policy applies.

The data processing agreement

We intend to sign a DPA before any engagement that involves personal data, covering the subject matter and duration, the nature and purpose of processing, the categories of data subject and personal data, and the obligations on both sides, as Article 28 requires.

A LebSource standard DPA is in preparation with counsel and is not yet finalised. Until it is, we work from the client's own DPA, which in practice is the more common path this early in an engagement in any case. Ask us at contact@lebsource.com for where that stands, and raise it on the first call rather than assuming the terms from this page.

International transfers

Data is hosted and stored in European regions rather than exported to Lebanon. Our team works from Lebanon, outside the EEA and without a current adequacy decision, so their access to it is a transfer in its own right. Our intended mechanism for that is the European Commission's Standard Contractual Clauses, together with a transfer impact assessment and the supplementary measures it identifies, finalised as part of the signed agreement rather than in place in advance of one. We would rather raise this early in a procurement conversation than have it surface late.

How we limit exposure in practice

• Access is scoped to what the engagement actually requires, and removed at ramp-down
• People work in your systems under your access controls rather than copying data into ours
• Production personal data is not used for testing where a synthetic or masked set will do
• Access changes are documented so you can evidence them in an audit

Sub-processors

Our current sub-processors are Vercel, which hosts and serves this website from European regions; Supabase, which stores applications submitted to our hiring portal; Resend, which delivers transactional email; and Google, which runs the calendar behind the booking page. We intend to notify you before any addition or replacement, with the opportunity to object, once that commitment is captured in a signed DPA. This list is the same one named in our privacy policy, so the two cannot drift apart.

Breach notification

If we become aware of a personal data breach affecting your data, our intention is to notify you within 48 hours so you can meet your own obligations, and to support your assessment and any notification you have to make. That window is deliberately shorter than the 72 hours the GDPR gives you to notify a supervisory authority, so the clock we start still leaves you time to act, but it becomes a contractual commitment only once it is written into the signed agreement, not from its appearing here.

Ask us the awkward questions early

If your compliance function has a hard requirement we cannot meet, data residency inside the EU, for instance, the useful time to discover that is the first call. We will tell you, and if the answer is that an EU-based partner suits you better, we will say that too.