Data processing agreement

The subject matter is providing the “Livo” software as an internet service, including storage and processing of the data the controller enters into it.

Processing lasts as long as the usage contract is in force. It ends when the contract ends; section 7 then applies.

Collection, storage, modification, retrieval, transmission and erasure — in each case to provide the functions booked by the controller: customer and job management, quotes and invoices, time tracking, scheduling, staff administration, document storage as well as export and reporting functions.

The processor does not process the data for its own purposes. In particular, the controller’s data is not used for advertising, profiling or training AI models.

The controller’s customers and prospects · the controller’s employees · contacts at suppliers and subcontractors · other individuals whose data the controller enters (for example a site contact).

Master data (name, address, customer number) · contact data (phone, email) · contract and job data · invoice and payment data including bank details where the controller records them · working time and absence data of employees · content uploaded by the controller (photos, documents, site diaries) · user login data (email address, password hash, session data).

Special categories under Art. 9 GDPR are not intended. The software does not ask for them. If the controller enters such data in free-text fields — for example a health note in a comment — that is within the controller’s responsibility.

Processing only on documented instructions from the controller (Art. 28(3)(a) GDPR). Use of the software constitutes an instruction. If the processor considers an instruction unlawful, it will say so.

Persons bound to confidentiality (Art. 28(3)(b) GDPR): access is limited to persons bound to confidentiality. Currently this is solely the operator; further persons will be bound before being granted access.

Assistance with data subject rights (Art. 28(3)(e)): access, rectification, erasure and portability can largely be exercised directly — a complete data export and business deletion are built into the software. Beyond that we assist on request.

Breach notification (Art. 33(2) GDPR): the processor notifies the controller of any personal data breach it becomes aware of without undue delay, at the latest within 48 hours of becoming aware, by email to the address on file.

🔴 This list states what is actually implemented — not what would be customary. What is not listed, we do not have.

Transmission: access is exclusively over HTTPS; unencrypted requests are redirected to HTTPS.

Authentication: passwords are not stored in plain text but as scrypt hashes. Sessions use random tokens with an expiry.

Access separation: each business sees only its own data. Separation happens in every single database query via the business identifier, not merely in the display. Within a business there are five roles with different permissions; every write action checks the role server-side — the interface does not merely hide things.

Third-party credentials on file: passwords for the customer’s own mail dispatch are stored encrypted with AES-256-GCM and never delivered to the browser.

Erasure: for every data table it is defined whether and when it is deleted. Deleting a business covers all associated tables; this is verified automatically on every change.

Location: servers are located in Germany (IONOS SE, data centres in Germany).

What we do NOT have and therefore do not warrant: ISO 27001 or SOC 2 certification, third-party penetration tests, encryption of database files at rest beyond the data centre’s measures, an appointed data protection officer (not currently required by law), or a certified business continuity plan. If you need any of these, say so before signing — we will then clarify whether and by when it is feasible.

The controller consents to the engagement of the sub-processors listed below. Further ones will be announced at least 30 days before processing begins; the controller may object and, in that case, terminate the contract.

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany — hosting and server operations. Processes all data arising from operating the application. Servers in Germany. Data processing agreement in place.

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland — payment processing for paid add-ons. Processes the controller’s own name, email address and payment data; data of the controller’s customers is not transmitted to Stripe.

🔴 Anthropic Ireland, Ltd. — receipt scanning (a photo of an incoming invoice is read to pre-fill the form). This function is built but NOT ACTIVE in the production environment: the required access key is not configured there and the function reports that it is not set up. No data is currently transmitted to Anthropic. The notice period above applies before any activation. We list the service here nonetheless, because a sub-processor appearing only after contract conclusion is precisely what the notice obligation is meant to prevent.

Services the controller sets up with their own credentials — for example their own mailbox for sending invoices, or a wholesaler account via IDS-Connect — do not count as sub-processors. There the controller is the responsible party vis-à-vis the provider.

After the contract ends, the controller’s data is deleted once they have secured it, at the latest 30 days after contract end — unless a statutory retention obligation prevents this.

Return is via the complete data export built into the software, which can be run at any time without our involvement. It expressly also works when the subscription is already suspended: a customer who can only get their data back for a fee is not a customer but a hostage.

Documents subject to a tax or commercial retention obligation are kept until the period expires and deleted thereafter.

The controller has the right to verify compliance with this agreement (Art. 28(3)(h) GDPR). Audits take place after reasonable advance notice, during normal business hours and without disrupting operations.

As a rule, written information suffices. An on-site audit is possible; it covers our own processes, not the hoster’s data centres — the hoster’s own certifications apply there and we pass them on upon request.

Amendments require text form. In the event of a conflict between this agreement and the general terms and conditions, this agreement prevails insofar as the processing of personal data is concerned.

Should any provision be invalid, the remainder of the contract remains in force.

Version of this template: 2026-08-20. For a signed agreement, write to kontakt@livogroup.de — we will send you the document with your details for countersignature.