Data Processing Agreement (DPA)

Full agreement

Version 1.0 · Last updated: 27 Sep 2026

§ 1 Parties and subject matter

This agreement is concluded between the customer as controller (Art. 4(7) GDPR) and Lisorect d. Locher Matthias, Steinackerstr. 37, IT-39040 Tramin a.d.W. (BZ), VAT no. 03221840212, as processor (Art. 4(8) GDPR). It governs the processing of personal data carried out by the processor on behalf of the customer under the terms of use (the "main contract"). It is concluded electronically when the terms of use are accepted during registration (Art. 28(9) GDPR).

§ 2 Term

This agreement runs for the term of the main contract, including the free trial, and ends with it. The obligations under § 9 (deletion) and confidentiality survive termination.

§ 3 Nature, purpose, types of data and data subjects

(1) Nature and purpose: storage, hosting, backup and technical provision of the data entered by the customer in its instance, solely to perform the main contract; troubleshooting and support at the customer's request.
(2) Types of data and data subjects per product:
• All products: user accounts of the instance (name, email, username, password hash, roles, login times, IP addresses) – data subjects: the customer's users.
• LisorectPrjVW: working hours, projects, work steps, absences, trips and expenses – data subjects: the customer's employees; names and contact details of project clients.
• LisorectProdVW: production and machine data linked to operators (name, shift, times) – data subjects: the customer's employees.
• LisorectConVW: names, contact details, units, shares, tasks and cases – data subjects: owners, tenants, contractors and staff.
• LisorectDogVW: names, contact details, appointments, services and pet data – data subjects: the customer's clients.
(3) Processing of special categories of data (Art. 9, 10 GDPR) is not intended; the customer processes such data only where strictly necessary for the intended purpose and at its own responsibility.

§ 4 Instructions

(1) The processor processes the data only on documented instructions from the customer, unless required to do so by Union or Italian law; in that case it informs the customer beforehand unless the law prohibits this.
(2) Instructions result from the main contract, this agreement and the customer's use of the product's functions. Further instructions are given in text form (email to info@lisorect.it).
(3) If the processor considers an instruction unlawful, it informs the customer without delay and may suspend its execution until confirmed.
(4) No processing for the processor's own purposes takes place, in particular no analysis, profiling, model training, advertising or disclosure to third parties.

§ 5 Confidentiality

The processor ensures that all persons with access to the data are bound by confidentiality or are under a statutory obligation of confidentiality. Customer data is accessed only where necessary for operation, security or a support request of the customer.

§ 6 Security of processing

The processor implements the technical and organisational measures described in Annex 1 (Art. 32 GDPR). It may adapt them to the state of the art provided the level of protection is not reduced. Material changes are documented.

§ 7 Sub-processors

(1) The customer grants general authorisation to engage sub-processors. The sub-processors engaged at conclusion of this agreement are listed in Annex 2 and are deemed approved.
(2) The processor informs the customer by email at least 30 days in advance of any addition or replacement of a sub-processor. The customer may object within this period on reasonable data protection grounds. If the parties cannot agree, the customer may terminate the main contract with effect from the change.
(3) The processor imposes the same data protection obligations on each sub-processor by contract and remains liable to the customer for their compliance.

§ 8 Assistance to the customer

(1) Data subject rights: the processor assists the customer by appropriate measures in responding to requests from data subjects (Art. 15–22 GDPR). If a data subject contacts the processor directly, it forwards the request to the customer without delay.
(2) Data breaches: the processor notifies the customer of a personal data breach without undue delay, where possible within 24 hours and at the latest within 48 hours after becoming aware of it, with the information under Art. 33(3) GDPR as far as available. It takes immediate containment measures and assists the customer with its notification obligations (Art. 33, 34 GDPR).
(3) The processor assists the customer with data protection impact assessments and prior consultations (Art. 35, 36 GDPR) within the information available to it.
(4) Assistance beyond the ordinary scope that is not caused by a breach by the processor may be charged at reasonable rates.

§ 9 Return and deletion

(1) After the main contract ends, the customer may save its data within 30 days using the export functions or request an export in a common, machine-readable format.
(2) Thereafter the processor deletes the instance with all personal data unless a statutory retention obligation applies. Data in backups is overwritten in the regular backup cycle, at the latest after a further 90 days. On request the processor confirms the deletion in text form.

§ 10 Evidence and audits

(1) On request, the processor provides the customer with all information necessary to demonstrate compliance with this agreement, primarily through written information and documents, including certificates of sub-processors.
(2) If these are insufficient, the customer may, with at least 30 days' notice, during business hours and at most once a year, carry out an audit itself or through an auditor bound by confidentiality, without access to other customers' data and without disrupting operations. Audits following a data breach are permitted at any time. The customer bears the costs unless a breach by the processor is found.

§ 11 Place of processing

Processing takes place exclusively in member states of the European Union or the EEA. Data is transferred to third countries only after prior notice under § 7(2) and only if the requirements of Art. 44 et seq. GDPR are met (e.g. adequacy decision or EU standard contractual clauses).

§ 12 Customer obligations

The customer is responsible for the lawfulness of the processing, for informing data subjects (e.g. its employees under Art. 13 GDPR and employment law) and for safeguarding their rights. It informs the processor without delay if it detects errors or irregularities in the processing.

§ 13 Liability

Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability rules of the main contract (§ 15 of the terms of use) apply to the extent permitted by law.

§ 14 Final provisions

(1) In case of conflict, this agreement prevails over the main contract in matters of data protection.
(2) Changes to this agreement are communicated in the same way as changes to the terms of use (§ 18); changes required by law remain reserved.
(3) Italian law applies; place of jurisdiction is Bolzano. In case of doubt the German version prevails.
(4) If any provision is invalid, the remainder of the agreement remains in effect.

Annex 1 – Technical and organisational measures (Art. 32 GDPR)

• Physical access control: servers exclusively in data centres of Hetzner Online GmbH in the EU (ISO/IEC 27001 certified) with access control, video surveillance and 24/7 security staff.
• System access control: administrative server access only for the processor via encrypted connections with key authentication; firewall with only the required ports; application passwords stored only as BCrypt hashes; automatic lockout after repeated failed logins.
• Data access control: role and permission concept in the application, managed by the customer; processor accesses customer data only where needed (§ 5).
• Separation: each customer gets its own instance with dedicated containers, internal network and database with separate credentials; no shared storage of multiple customers' data.
• Transfer control: all connections between browser and platform TLS-encrypted; databases not reachable from the internet.
• Input control: logging of logins and security-relevant events.
• Availability: regular backups of instances; redundant power and network in the data centre; service monitoring.
• Recoverability: restore from backups; regular restore tests.
• Organisation: timely installation of security updates; data breach notification procedure (§ 8); regular review of these measures.

Annex 2 – Approved sub-processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – provision of servers and data centres (hosting); place of processing: EU.
• Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy – sending emails from the platform (e.g. notifications, password links); place of processing: EU.

The payment provider Mollie B.V. is not a sub-processor: it receives no data from the customer's instance, only the customer's own payment data (see privacy policy).