Data processing agreement (DPA)

1. Parties

Controller: the Customer, i.e. the organisation that holds an account with livelisted, with the company details stored in the account.

Processor: GMC Holding GmbH, Viktringer Ring 13, 9020 Klagenfurt am Wörthersee, Austria, FN 584929 s, Landesgericht Klagenfurt. Managing director: Georg Micheu. Privacy enquiries: privacy@livelisted.app.

2. Subject matter and duration

The subject matter is the operation of the livelisted software for the Customer: managing objects, projects and units, handling leads and prospects, providing brochures and documents, processing e-mails and appointments, feeding portals and showing reports.

The agreement applies for the term of the subscription. After the end of the contract the data is deleted or returned in accordance with section 9.

3. Nature and purpose of the processing

Storage, display, sending and evaluation of the data entered by the Customer or received through its forms, brochure links and integrations, solely for the management and marketing of real estate by the Customer.

4. Categories of data and data subjects

Categories of data:

• contact data of prospects, owners and sales partners (name, e-mail address, phone number, postal address)
• property requirements (budget, financing, search and location preferences, messages)
• appointment and communication data (e-mails, bookings, video call invitations, the Customer's notes)
• usage and log data (brochure views, reading times, technical logs)
• data of the Customer's staff (name, e-mail address, profile picture, signature)

Data subjects: prospects and buyers, owners, sales partners, the Customer's staff.

5. Instructions

The processor processes personal data only on the Customer's documented instructions. This agreement, the Terms of Service and the use of the software by the Customer and its members constitute instructions. Further instructions are given in text form to the address above.

If the processor considers an instruction unlawful, it informs the Customer without undue delay and may suspend its execution until the matter is clarified.

6. Obligations of the processor

• commitment of all persons involved in the processing to confidentiality
• technical and organisational measures under Art. 32 GDPR (section 8)
• assistance with data subject requests (access, rectification, erasure, portability) through the export and deletion functions of the software and on request
• assistance with data protection impact assessments and consultations of the supervisory authority as far as processing in the software is concerned
• notification of personal data breaches without undue delay and no later than 48 hours after becoming aware, to the Customer's account address
• provision of all information necessary to demonstrate compliance with this agreement; audits by the Customer or an auditor mandated by it with 14 days' notice, at most once a year unless there is a specific reason

7. Sub-processors and server location

The application data is stored in data centres in Frankfurt am Main, Germany (European Union). The processor uses the following sub-processors:

• Supabase Inc. — Database, authentication and file storage. Servers in Frankfurt (AWS eu-central-1); provider based in the USA.
• Vercel Inc. — Application hosting and website delivery. Data centre Frankfurt; provider based in the USA.
• Resend Inc. — Delivery of system and notification emails. EU region (Ireland); provider based in the USA.
• Anthropic PBC — Reading uploaded PDF price lists (only when the PDF import is used; the file content is transmitted) and answering questions in the support chat (only the chat messages and plan status are transmitted, no account data). Provider based in the USA; content is not used for training.
• Daily (Daily.co, Inc.) — Video calls in livelisted: real-time transmission of video and audio (no recording) and, only with the invited person's consent, the transcription of the conversation (through the sub-processor Deepgram); the transcript is deleted at the provider once it has been taken over into livelisted. Media servers in the EU (Frankfurt, where configured); provider based in the USA.
• Stripe Payments Europe Ltd. — Payment processing, customer portal and invoice delivery (name, email address, billing address, VAT id; payment data such as card number or IBAN are processed exclusively by Stripe and never reach us) – independent controller for the payment data. Based in Dublin, Ireland (EU).

The Customer consents to the use of these sub-processors. The processor gives at least 30 days' notice of intended changes by e-mail to the account address; the Customer may object for good cause and terminate the contract for cause in that case. A contract under Art. 28(4) GDPR is in place with every sub-processor.

Transfers to third countries take place only with appropriate safeguards under Chapter V GDPR (adequacy decision, EU standard contractual clauses with a transfer impact assessment).

8. Technical and organisational measures

• access control: access to production systems only by the management through personal accounts; no third-party access
• tenant isolation: every database table is restricted to the own organisation by access rules (row level security); the isolation is tested automatically with every change
• encryption: transport exclusively over TLS; storage encrypted (AES-256) in the sub-processors' data centres
• availability: daily database backups at the database provider; hosting in data centres with redundant power and network supply
• input control: changes to statuses, prices and leads are logged immutably with time and author
• deletion concept: accounts and data are deleted in accordance with section 9; log data after 30 days
• member access: roles owner, admin, member and viewer; invitations only by owners and admins

9. Deletion and return

The Customer can retrieve its data as an export (Excel, PDF) at any time and delete leads, documents and objects itself. After the end of the contract the Customer's application data is deleted within 90 days unless an export is requested beforehand; statutory retention obligations for contract and invoice data remain unaffected.

10. Liability and final provisions

Liability is governed by the Terms of Service. Austrian law applies. In the event of conflicts between this agreement and the Terms of Service, this agreement prevails in data protection matters. The agreement is provided in German and English; in the event of discrepancies the German version prevails.

Wording for your privacy policy

The Customer may use the following paragraph in the privacy policy of its own website:

"To manage enquiries, brochures and appointments we use the livelisted software of GMC Holding GmbH, Viktringer Ring 13, 9020 Klagenfurt am Wörthersee, Austria. The data is processed on servers in Frankfurt am Main (Germany, EU). A data processing agreement under Art. 28 GDPR is in place with the provider. Further information: https://livelisted.app/legal/privacy."