Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
LeadSquared is a marketing automation and CRM platform headquartered in Bengaluru, India, with United States operations. Its website tracking script captures visitor behaviour such as pages viewed and time spent, sets a cookie to identify and score leads, and syncs the collected activity to the LeadSquared CRM. Because this is non essential behavioural tracking and profiling, LeadSquared must load only after the visitor has given consent.
LeadSquared is a marketing automation and customer relationship management platform. Its head office is in Bengaluru, India, and it runs its United States operations from there as well. Sales and marketing teams place a small LeadSquared tracking script on their website so they can see which visitors browse the site, capture leads from forms and score those leads inside the LeadSquared CRM. The script loads from the LeadSquared tracker host and runs inside every page where it is installed.
The tracking script records visitor behaviour such as the pages viewed, the time spent on each page, the referral source, repeat visits and form submissions. It generates a prospect identifier, exposed to the page as MXCProspectId, and stores it in a cookie on the visitor browser so that a returning visitor can be recognised and their activity attributed to a single profile. When a visitor completes a form or is otherwise identified, the collected activity is synchronised to the LeadSquared CRM, where it feeds lead scoring, segmentation and marketing automation. This is non essential behavioural tracking rather than a first party feature the visitor asked for.
The behavioural data and the prospect identifier that LeadSquared processes are personal data under the GDPR, because they relate to an identifiable visitor and are used to profile and score that person. Reading and writing an identifier on the visitor device also falls squarely within Article 5(3) of the ePrivacy Directive, which the CNIL in France, the German authorities under the TDDDG and the AEPD in Spain all enforce as a strict prior consent obligation for non essential trackers. Lead scoring adds a profiling dimension that raises the sensitivity of the processing.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent is required before the LeadSquared script loads and before any lead capture, because the tracking is not strictly necessary for the visitor to receive the content of the page. That consent must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. Until the visitor accepts, the script should not run and no cookies should be written. Legitimate interest cannot be relied on for this non essential tracking and profiling.
LeadSquared processes tracking and lead data on infrastructure in India and the United States, so European visitor data is transferred outside the European Economic Area to two third countries. India is not covered by a European Union adequacy decision, and the United States is covered only where a specific safeguard applies, so both transfers must rely on the EU Standard Contractual Clauses 2021/914 within the LeadSquared Data Processing Agreement. A documented Transfer Impact Assessment is needed for each destination, in line with the Schrems II ruling and the guidance of the European Data Protection Board.
Gate the LeadSquared script behind your consent management platform so it fires only after the analytics or marketing category is accepted, and keep lead capture blocked until then. Describe LeadSquared in your cookie policy, including the prospect identifier it sets and its lifetime. Sign the LeadSquared Data Processing Agreement, confirm the Standard Contractual Clauses for the India and United States transfers and complete a Transfer Impact Assessment for each. Apply the shortest workable retention on visitor and lead records and honour deletion and objection requests promptly.
Websites using LeadSquared must obtain user consent under GDPR regulations.
DPIA considerations
A Data Protection Impact Assessment is advisable when LeadSquared is used at scale to track visitors and score leads, because lead scoring is a form of profiling. Document the behavioural data collected by the tracking script, the prospect identifier stored in the cookie, the synchronisation of activity into the LeadSquared CRM, the transfers to India and the United States and the retention period applied to visitor and lead records. Configure the script so that it loads only after consent and block lead capture until the visitor accepts.
Sample consent text
We use LeadSquared, a marketing automation and CRM service operated by LeadSquared (India and United States), to understand how you use our site and to manage leads. LeadSquared records your activity and stores an identifier in a cookie on your device. This data may be transferred to India and the United States under the EU Standard Contractual Clauses. LeadSquared will only load if you click Accept.
Third-party domains contacted
leadsquared.comweb.mxradon.commxradon.comapp.leadsquared.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| MXCProspectId | HTTP cookie (first party) | Persistent | Stores the LeadSquared prospect identifier generated by the tracking script so LeadSquared can recognise a returning visitor and attribute page views, time on page, referral source and form submissions to a single lead record in the CRM. |
| LeadSquared tracking session | HTTP cookie (first party) | Session | Groups the page views and interactions of a single visit so the tracking script can report the current browsing session before the activity is synced to the LeadSquared CRM. |
| LeadSquared cookie consent | HTTP cookie (first party) | Persistent | Records the visitor choice made in the LeadSquared cookie consent banner, so that tracking is enabled or disabled on later visits according to the preference expressed. |
LeadSquared places tracking cookies for advertising — comply with GDPR using FlowConsent.
LeadSquared sets a first party cookie that stores a prospect identifier, exposed to the page as MXCProspectId, so it can recognise a returning visitor and attribute page views, time on page and form submissions to a single lead. The identifier is synced to the LeadSquared CRM once the visitor is identified.
Yes. LeadSquared performs non essential behavioural tracking and writes an identifier to the visitor device, so under the ePrivacy rules you must obtain prior consent before the script loads and before any lead capture. The tracking script should stay blocked until the visitor accepts.
The only valid legal basis is consent under Article 6(1)(a) GDPR, combined with the prior consent requirement of Article 5(3) of the ePrivacy Directive. Legitimate interest cannot be used for this kind of non essential tracking and lead scoring, which involves profiling of the visitor.
Yes. LeadSquared processes data on infrastructure in India and the United States, so European visitor data is transferred to both. India is not covered by an EU adequacy decision, so you need the EU Standard Contractual Clauses in the LeadSquared Data Processing Agreement and a Transfer Impact Assessment for each destination.
A Data Protection Impact Assessment is recommended, because LeadSquared combines behavioural tracking with lead scoring, which is a form of profiling, and it transfers data to third countries. Assess the tracking, the identifier stored on the device, the CRM enrichment and the transfers to India and the United States.
Load the script only through your consent management platform after the relevant category is accepted, and keep lead capture blocked until then. Describe LeadSquared in your cookie policy, sign the Data Processing Agreement, confirm the Standard Contractual Clauses and complete a Transfer Impact Assessment. Apply a short retention period to visitor and lead records.
Alternatives include HubSpot, Salesforce Marketing Cloud, Zoho CRM, ActiveCampaign and Freshsales. They raise similar consent, cookie and transfer questions, so evaluate their hosting location and data processing terms before assuming any of them is lighter on privacy.
Add a dedicated entry that names LeadSquared as the provider, lists the prospect identifier with its lifetime, explains the behavioural tracking and lead scoring it performs, and discloses the transfers to India and the United States and the safeguard used. Keep the entry in step with your consent categories.