01 Who we are
Maxx Leads is a GoHighLevel agency operating as [Add Registered Legal Entity Name], based in Pakistan and working with clients worldwide. We build funnels, CRM systems, automations and ad campaigns for other businesses.
For the purposes of data protection law, we are the data controller (or "business", under US law) for information you give us through this website — meaning we decide what is collected and why. Where we build and manage systems inside a client's own account, we act as a processor on that client's instructions. See section 7.
Address: [Add Business Address]. Contact details are in section 19.
02 What we collect
Information you give us
- Your name, email address, phone or WhatsApp number, and company name.
- Your website URL and anything you tell us about your business, budget, current funnel or ad spend.
- Whatever you write in a form field, an email, a WhatsApp message or a booking note.
- The time slot you pick when you book a call, and your timezone.
Information collected automatically
- IP address, browser type, device type and operating system.
- Pages you viewed, how long you stayed, and the page or ad that referred you.
- Cookies, pixels and similar identifiers set by the services listed in section 5.
We do not ask for and do not want payment card numbers, government ID numbers, health information or any other special category data through this website. Please don't put any of it in a form field.
03 How we collect it
Through the contact form and booking calendar on this site, both of which run on GoHighLevel; through email and WhatsApp when you message us directly; through cookies and tracking pixels while you browse; and from Meta, Google or TikTok when you click one of our ads and land here.
04 How we use it
- To reply to you. Answering enquiries, sending proposals, confirming calls.
- To deliver work. Scoping, building and supporting the projects you hire us for, and invoicing you for them.
- To run the site. Keeping it up, spotting errors, blocking spam and abuse of our forms.
- To measure our advertising. Seeing which ads and pages produce enquiries that actually fit, and building audiences on Meta, Google and TikTok.
- To follow up. Occasional emails about our services, where you've asked for them or where we have an existing business relationship. Every one has an unsubscribe link.
- To meet legal obligations. Tax records, accounting, and responding to lawful requests.
We do not sell your personal information for money. Note that our use of advertising pixels may count as "sharing" under California law — section 12 explains how to opt out.
07 Client account data
When you hire us, we usually get access to your GoHighLevel sub-account, ad accounts, or other tools that contain your customers' personal data. In that situation you are the controller and we are your processor.
- We only touch that data to do the work you've asked for.
- We don't export, reuse or market to your contact lists.
- We keep access credentials confidential and expect you to revoke our access when the engagement ends — ask us and we'll confirm removal in writing.
Where required, we'll sign a data processing agreement covering this work.
08 How long we keep it
- Enquiries that don't become projects: up to 24 months, then deleted.
- Client records and correspondence: for the length of the engagement plus 2 years, to cover support questions and disputes.
- Invoices and tax records: as long as tax law requires, even where that's longer than 2 years.
- Analytics and pixel data: per the retention period set inside each platform.
You can ask us to delete your data sooner — see section 10.
09 Security
The site runs over HTTPS. Access to our CRM and client accounts is limited to the two people on our team, protected by strong passwords and two-factor authentication where the platform supports it. We remove access we no longer need.
No system is perfectly secure. If a breach affects your personal data and creates a real risk to you, we'll notify you and the relevant regulator as the law requires.
10 Your rights
Wherever you live, you can ask us to:
- Tell you what we hold about you, and give you a copy.
- Correct anything inaccurate.
- Delete your data.
- Stop using it for marketing or ad targeting.
- Send it to you in a portable format.
Email [email protected] with what you want and we'll respond within 30 days. We may ask you to confirm your identity first. It costs nothing, and we won't treat you differently for asking. Sections 11 to 13 add rights specific to where you are.
11 If you're in the EU or UK
The GDPR and UK GDPR apply. Our legal bases are:
- Consent — for analytics and advertising cookies, and for marketing emails. Withdraw it any time; that doesn't affect what we did beforehand.
- Performance of a contract — to deliver work you've engaged us for, or to take steps at your request before a contract.
- Legitimate interests — to reply to enquiries, secure the site and prevent fraud, balanced against your rights.
- Legal obligation — where we're required to keep or disclose records.
You also have the right to restrict or object to processing, including profiling for advertising, and the right to complain to your supervisory authority — the ICO in the UK, or your national authority in the EU. We'd rather you came to us first, but you don't have to.
12 If you're in California or another US state
Under the CCPA/CPRA and similar laws in Virginia, Colorado, Connecticut, Texas and others, you have the right to know what we collect, to delete it, to correct it, to opt out of sale or sharing, and not to be discriminated against for exercising any of it.
Categories we collect
- Identifiers — name, email, phone, IP address, cookie IDs.
- Commercial information — services enquired about or purchased.
- Internet activity — pages viewed, referring ad, time on site.
- Inferences — audience segments built by advertising platforms.
We do not sell personal information for money and we don't collect sensitive personal information as that term is defined in California law.
Do not sell or share my personal information
Our Meta, Google and TikTok pixels pass identifiers to those platforms for cross-context behavioural advertising, which California treats as sharing. To opt out, do any of the following: email [email protected] with "Do not share my data" and we'll suppress you; block cookies for this site in your browser; or use the platform opt-outs listed in section 5.
You can use an authorised agent to make a request on your behalf, with written proof of authorisation.
13 If you're in Pakistan
We operate from Pakistan and handle personal data in line with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016 and any data protection legislation in force. Where Pakistani law gives you fewer rights than the GDPR or CCPA, we'll still honour the requests set out in section 10 for everyone, regardless of where you live.
14 International transfers
We're based in Pakistan and our providers are mostly in the United States, so your data will cross borders. Where data leaves the UK or EEA, we rely on the safeguards our providers have in place — typically Standard Contractual Clauses, and the EU-US and UK-US Data Privacy Frameworks where the provider is certified. We only work with providers that publish their own data protection terms.
15 Email, SMS & WhatsApp
If you give us your number, you're agreeing that we may contact you about your enquiry by phone, SMS or WhatsApp. Message and data rates may apply. Reply STOP to opt out of SMS, or just tell us to stop on WhatsApp and we will. Marketing emails carry an unsubscribe link in every send. Opting out of marketing doesn't stop necessary messages about a live project.
16 Children's privacy
This is a business-to-business service and it isn't directed at anyone under 18. We don't knowingly collect data from children. If you believe a child has sent us personal information, email us and we'll delete it.
17 Links to other sites
Our pages link out to client work, platforms and social profiles we don't control. Once you leave this site, their privacy policies apply, not ours.
18 Changes to this policy
We'll update this page when our tools or practices change, and the "last updated" date at the top will change with it. Material changes will be flagged on the site. Continuing to use the site after an update means you accept the revised policy.
19 Contact us
Questions about this policy, or want your data removed? Reach us any of these ways:
- Email — [email protected]
- WhatsApp — +92 301 000 7193
- Contact form — our contact page
Mon–Sat, 9AM–6PM PKT. We reply within 24 hours.
This policy is governed by the laws of the Islamic Republic of Pakistan, without limiting any rights you have under the laws of your own country.