Data Processing Agreement

1. INTRODUCTION

2. SCOPE & APPLICABILITY

2.1 When This DPA Applies

This DPA applies when you use LivPro to process Personal Data, including:

• Customer contact information (names, emails, phone numbers)
• Lead and prospect data (job titles, company names, addresses)
• Communication history (emails sent/received, call logs)
• Behavioral data (email opens, clicks, website visits)
• Any other data you upload or process through LivPro

2.2 When This DPA Does NOT Apply

This DPA does NOT cover:

• Your account data: Your own name, email, billing information (LivPro is Controller for this data—see Privacy Policy)
• Aggregated/anonymized data: Data that cannot identify individuals
• Public information: Data already publicly available (e.g., company websites, LinkedIn profiles)

2.3 Incorporation into Terms

This DPA is incorporated into and forms part of the Terms of Service. In the event of conflict, this DPA takes precedence for data processing matters.

3. SUBJECT MATTER & DURATION

3.1 Categories of Personal Data

LivPro processes the following categories of Personal Data on your behalf:

• Contact Information: Names, email addresses, phone numbers, job titles, company names
• Professional Data: Company size, industry, location, LinkedIn profiles
• Communication Data: Email content, subject lines, timestamps, delivery status
• Behavioral Data: Email opens, clicks, website visits, form submissions
• Transactional Data: Deal values, pipeline stages, notes, custom fields
• Technical Data: IP addresses, browser type, device information (for analytics)

3.2 Categories of Data Subjects

Personal Data relates to the following Data Subjects:

• Your customers (current and former)
• Your leads and prospects
• Your email subscribers
• Website visitors (if tracked via LivPro integrations)
• Any other individuals whose data you upload to LivPro

3.3 Nature & Purpose of Processing

LivPro processes Personal Data for the following purposes:

• CRM Services: Storing and managing contact records, deals, and pipeline data
• Email Automation: Sending marketing and transactional emails on your behalf
• Analytics: Tracking campaign performance, email engagement, and lead behavior
• Reporting: Generating dashboards and reports based on your customer data
• Integration: Syncing data with third-party services (at your direction)

3.4 Duration of Processing

LivPro will process Personal Data:

• For the duration of your subscription (active account)
• For up to 30 days after account termination (to allow data export)
• As required by law or regulatory obligation (e.g., financial records retention)

4. DATA PROCESSOR OBLIGATIONS

4.1 Processing Instructions

LivPro will process Personal Data only:

• On your documented instructions (via the Service interface, API, or written request)
• As necessary to provide the Service (CRM, email, analytics)
• As required by EU or Irish law (with notice to you, if legally permitted)

If we believe an instruction violates GDPR or other data protection laws, we will immediately inform you.

4.2 Confidentiality

LivPro ensures that all personnel authorized to process Personal Data:

• Are bound by confidentiality obligations (contracts or statutory duties)
• Receive appropriate data protection training
• Access Personal Data only on a need-to-know basis

4.3 Sub-processor Management

LivPro engages the following Sub-processors:

Sub-processor Changes:

• We will notify you of any new or replacement Sub-processors at least 30 days in advance
• Notification will be sent via email or in-app notice
• You may object to a new Sub-processor within 30 days
• If you object, you may terminate your subscription without penalty

4.4 Data Subject Rights Support

LivPro will assist you in responding to Data Subject requests:

• Access requests: Provide data export functionality
• Rectification: Allow editing of contact records
• Erasure ("right to be forgotten"): Permanently delete data upon request
• Portability: Export data in machine-readable format (CSV, JSON)
• Objection/Restriction: Suspend processing or delete data

Response time: We will assist within 72 hours of your request. You are responsible for verifying the Data Subject's identity and legal basis.

4.5 Cooperation with Supervisory Authorities

LivPro will:

• Cooperate with the Irish Data Protection Commission (DPC) or other supervisory authorities
• Provide information and assistance during investigations or audits
• Notify you immediately if we receive a complaint or inquiry from a supervisory authority

5. DATA SECURITY

5.1 Technical Measures

LivPro implements the following technical security measures:

• Encryption in Transit: TLS 1.2+ for all data transmission
• Encryption at Rest: AES-256 encryption for database storage
• Access Control: Role-based access control (RBAC) and multi-factor authentication (MFA)
• Network Security: Firewalls, intrusion detection, DDoS protection
• Secure Authentication: OAuth 2.0, bcrypt password hashing
• Regular Updates: Automated security patching and vulnerability scanning

5.2 Organizational Measures

LivPro implements the following organizational security measures:

• Access Logging: All data access is logged and monitored
• Background Checks: All employees undergo background verification
• Training: Annual GDPR and security awareness training
• Incident Response: Documented breach notification procedures
• Data Minimization: Only necessary data is collected and retained
• Third-Party Audits: Regular security assessments (ISO 27001, SOC 2)

5.3 Data Breach Notification

In the event of a Personal Data breach:

• 24-hour notification: LivPro will notify you within 24 hours of becoming aware
• Breach details: Nature of breach, affected data, number of Data Subjects, likely consequences
• Mitigation: Measures taken to contain and remediate the breach
• Contact: Emergency breach notifications sent to support@livpro.io

6. DATA LOCATION & TRANSFERS

6.1 Primary Data Storage

LivPro stores Personal Data in the European Economic Area (EEA):

• Primary Region: Hetzner (Germany/Finland)
• Backup Region: Hetzner (Germany/Finland)
• Data does NOT leave the EU under normal operations

6.2 International Data Transfers

Some Sub-processors are located outside the EEA:

• Paddle (UK/Global): Merchant of Record & Payment processing - relies on UK Adequacy Decision and SCCs for other regions
• Resend (US): Email delivery - relies on SCCs

6.3 Transfer Safeguards

For all transfers to non-EEA countries, LivPro ensures:

• Use of EU-approved Standard Contractual Clauses (SCCs)
• Adequacy decisions (if applicable)
• Supplementary measures (encryption, access controls) to address risks
• Regular review of transfer mechanisms post-Schrems II

6.4 Data Residency Restrictions

If you have specific data residency requirements:

• Contact support@livpro.io to discuss custom arrangements
• Additional fees may apply for region-specific hosting
• Not all features may be available with restricted data residency

7. DATA SUBJECT RIGHTS

7.1 Rights Supported

LivPro provides functionality to support the following GDPR rights:

7.2 Request Process

To exercise Data Subject rights:

• You submit a request via your LivPro account or email support@livpro.io
• LivPro provides assistance within 72 hours (business days)
• You are responsible for verifying the Data Subject's identity
• You decide on the appropriate action (we execute on your instructions)

7.3 Your Obligations

You remain responsible for:

• Responding to Data Subjects within GDPR timelines (1 month)
• Determining whether a request is valid and lawful
• Providing privacy notices and consent mechanisms
• Documenting all Data Subject requests and responses

8. DATA RETENTION & DELETION

8.1 Retention During Service

While your account is active:

• Personal Data is retained as long as you choose (you control deletion)
• We recommend following GDPR data minimization principles
• You can delete individual records or bulk delete at any time

8.2 Retention After Termination

After account cancellation or termination:

• 30-day grace period: Data is retained for 30 days to allow export
• You will receive: Email reminder to export data (sent at termination and 7 days before deletion)
• After 30 days: All Personal Data is permanently deleted from production systems
• Backups: Data in backups is deleted within 90 days (overwritten during backup rotation)

8.3 Secure Deletion

LivPro uses industry-standard deletion practices:

• Database records are permanently deleted (not just marked as deleted)
• File storage is securely wiped using cryptographic erasure
• Backup media is securely destroyed or overwritten

8.4 Legal Hold Exceptions

LivPro may retain Personal Data beyond standard retention periods:

• When required by law (court order, regulatory investigation)
• To resolve disputes or enforce agreements
• For financial records (invoices, payments) as required by Irish tax law (6 years)

9. AUDIT & COMPLIANCE

9.1 Audit Rights

You have the right to audit LivPro's compliance with this DPA:

• Frequency: Once per year (or more if required by supervisory authority)
• Notice: 30 days' advance notice required
• Scope: Security measures, data processing activities, Sub-processor agreements
• Cost: At your expense (unless a breach is discovered)
• Confidentiality: Auditors must sign NDAs

9.2 Third-Party Certifications

In lieu of individual audits, LivPro provides:

• ISO 27001: Information security management (certification in progress)
• SOC 2 Type II: Security, availability, and confidentiality controls (annual report)
• GDPR Compliance: Internal audits and documentation available upon request

Certification reports are available to customers under NDA.

9.3 Data Protection Impact Assessments (DPIA)

If you are required to conduct a DPIA (GDPR Article 35):

• LivPro will provide reasonable assistance and documentation
• We will share technical and organizational measures
• Response time: 30 days for standard requests
• Contact support@livpro.io to request DPIA assistance

9.4 Records of Processing Activities

LivPro maintains records of processing activities as required by GDPR Article 30, including:

• Categories of processing performed
• Categories of Personal Data processed
• Sub-processors engaged
• Security measures implemented

10. INDEMNIFICATION & LIABILITY

10.1 LivPro Indemnification

LivPro will indemnify you for losses arising from:

• LivPro's breach of this DPA (failure to implement security measures)
• Unauthorized access to Personal Data caused by LivPro's negligence
• LivPro's failure to notify you of a data breach within 24 hours

10.2 Liability Cap

LivPro's total liability under this DPA is capped at:

• Total fees paid by Customer during the 12 months preceding the incident
• Except for liability that cannot be limited under Irish law (death, fraud, gross negligence)

10.3 Customer Liability

You remain liable for:

• Your own GDPR violations (lack of consent, unlawful processing)
• Inaccurate or misleading instructions to LivPro
• Failure to respond to Data Subject requests within GDPR timelines
• Fines imposed by supervisory authorities for your non-compliance

10.4 GDPR Fines & Penalties

In the event of GDPR fines:

• You are responsible for fines related to your Controller obligations
• LivPro is responsible for fines related to our Processor obligations
• If a fine is joint (both parties at fault), liability will be apportioned based on degree of fault

11. AMENDMENTS & UPDATES

11.1 DPA Updates

LivPro may update this DPA:

• To reflect changes in GDPR or other data protection laws
• To add new Sub-processors or change processing activities
• To improve security measures or clarify obligations

11.2 Notification Process

For material changes to this DPA:

• 30 days' advance notice via email or in-app notification
• Summary of changes and effective date
• You may object within 30 days
• If you object, you may terminate your subscription without penalty

11.3 Minor Updates

For non-material changes (typos, clarifications, formatting):

• No advance notice required
• Updated DPA will be posted on livpro.com
• "Last Updated" date will be revised

12. CONTACT & DISPUTES

13. ACKNOWLEDGMENT