Data Processing Agreement (DPA)

Parties

Controller: the company or other body that uses Lavesy under the terms of service, with the details stored in its customer account – the “Customer”.

Processor: Henry Manke, An der Eveke 3, 58511 Lüdenscheid, Germany, email mail@lavesy.de – the “Provider”. Full details are in the imprint.

The parties have concluded a contract for the use of the software-as-a-service application “Lavesy” on the basis of the Provider’s terms of service (the “Main Contract”). In doing so the Provider processes personal data for which the Customer is the controller within the meaning of Art. 4(7) GDPR. This agreement sets out the rights and obligations of the parties under Art. 28 GDPR.

1. Subject matter, nature, purpose, duration and location of the processing

(1) Subject matter. This agreement covers the processing of personal data by the Provider on behalf of the Customer when providing and operating Lavesy as a cloud-based warehouse, inventory and document management application within the scope of the plan booked by the Customer, including backups, troubleshooting and support.

(2) Nature of the processing. Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, alignment, disclosure by transmission within the application and to recipients designated by the Customer (for example when emails and messages are sent from the application), restriction, erasure and destruction – in each case solely for the purpose set out in paragraph 3.

(3) Purpose. The processing serves solely to provide the services agreed in the Main Contract. The Provider does not process the data for its own purposes, in particular not for advertising, profiling, selling data or training artificial intelligence systems. Paragraph 7 remains unaffected.

(4) Types of data and categories of data subjects. See Annex 1.

(5) Duration. The processing begins when access is provided and lasts as long as the Main Contract exists; the wind-down after its end is governed by clause 9. Cancelling a paid plan does not end the Main Contract; the account then continues on the free “Private” plan (terms of service, clause 7).

(6) Location of the processing. The Provider stores and processes the data in data centres in the European Union or another state party to the Agreement on the European Economic Area; the locations currently used are listed in Annex 3. Transfers to a third country take place only in accordance with clause 11.

2. Instructions of the Customer (Art. 28(3)(a) GDPR)

(1) The Provider processes the personal data only on documented instructions from the Customer, including with regard to transfers to a third country or an international organisation. This does not apply where the Provider is required to process by Union or Member State law to which it is subject; in such a case it informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

(2) The Main Contract, the functions described there and the configuration the Customer makes in the application constitute the Customer’s instructions. Instructions include in particular: creating, changing and deleting records by the Customer’s users, managing members, roles and permissions, sending emails and messages from the application, activating or deactivating optional functions and connected services (clause 10), triggering an export and triggering deletion.

(3) The Customer gives further instructions in text form (for example by email to the address in Annex 4). Instructions may be given by the administrators of the Customer’s company in Lavesy and by persons the Customer names in text form. The Customer confirms oral instructions in text form without delay. The Provider documents the instructions.

(4) If the Provider considers that an instruction infringes the GDPR or other Union or Member State data protection provisions, it informs the Customer immediately (Art. 28(3), third sentence, GDPR). It may suspend the instruction until the Customer confirms or changes it.

(5) If an instruction goes beyond the scope of services agreed in the Main Contract, the Provider tells the Customer in advance in text form whether and for what fee it will implement it; it is implemented only once the Customer agrees. The Provider does not make the performance of its obligations under this agreement and under the GDPR dependent on a fee.

(6) The Provider ensures that persons acting under its authority who have access to the data process them only on the Customer’s instructions (Art. 29, Art. 32(4) GDPR).

3. Obligations of the Customer

(1) The Customer is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects. In particular, it ensures that there is a legal basis for the processing and that data subjects are informed under Art. 13 and 14 GDPR.

(2) Lavesy is not intended for processing special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR); the Customer does not deliberately enter such data. If they nevertheless end up in the application, for example as content of uploaded documents, the obligations of this agreement apply to them unchanged; the Customer checks whether the measures in Annex 2 are sufficient for them.

(3) The Provider sends notices under this agreement to the email addresses of the administrators of the Customer’s company in Lavesy or to another contact address the Customer has named in text form (Annex 4). The Customer keeps these details up to date.

(4) The Customer informs the Provider without delay if it discovers errors or irregularities concerning data protection when reviewing the processing.

4. Confidentiality (Art. 28(3)(b) GDPR)

(1) The Provider ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(2) At present only the owner of the Provider has access to the Customer’s data. If further persons are given access (for example employees or freelancers), the Provider first commits them to confidentiality in text form, familiarises them with the relevant data protection provisions and limits their access to what their task requires.

(3) The duty of confidentiality continues after the end of the activity.

5. Technical and organisational measures (Art. 28(3)(c), Art. 32 GDPR)

(1) The Provider implements the technical and organisational measures described in Annex 2. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the likelihood and severity of the risk for the rights and freedoms of data subjects, they ensure an appropriate level of security.

(2) The Provider reviews the effectiveness of the measures regularly, at least once a year, and whenever the application or infrastructure changes significantly.

(3) The Provider may adapt the measures to technical developments provided the level of protection of Annex 2 is not reduced. It publishes the current version of Annex 2 on this page and informs the Customer of significant changes on request.

(4) The Customer uses Annex 2 to check whether the measures are appropriate for the data it processes.

6. Subprocessors (Art. 28(2) and (4) GDPR)

(1) The Customer gives the Provider general authorisation to engage other processors (subprocessors) in accordance with this clause. The subprocessors engaged are listed in Annex 3 with their as-of date; those listed there when this version was concluded or accepted are deemed approved, as are those added later under paragraphs 2 to 4 if the Customer did not object. The Provider also publishes the list at lavesy.de/en/subprocessors (German: lavesy.de/auftragsverarbeiter).

(2) The Provider informs the Customer of any intended addition or replacement of a subprocessor at least four weeks before the planned use, by email to the addresses under clause 3(3) and by a notice in the list under paragraph 1. The information states the name and address, the service, the place of processing, the data concerned and, where applicable, the safeguards for a third-country transfer.

(3) The Customer may object to the intended change in text form on objective data protection grounds until that period expires. The parties then seek an amicable solution. If none is found, the Customer may terminate the Main Contract for cause with effect before the new subprocessor is used; the Provider refunds fees paid in advance for the period after the end of the contract on a pro rata basis.

(4) If a subprocessor has to be replaced at short notice for urgent reasons of security or availability (for example a security incident or failure of the service provider), the Provider may shorten the period under paragraph 2. It then informs the Customer without delay, stating the reasons; the right under paragraph 3 remains unaffected.

(5) The Provider selects subprocessors carefully, in particular with regard to sufficient guarantees for appropriate technical and organisational measures, and imposes on them by contract the same data protection obligations as set out in this agreement (Art. 28(4), first sentence, GDPR). Where a subprocessor fails to fulfil its data protection obligations, the Provider remains liable to the Customer for the performance of that subprocessor’s obligations (Art. 28(4), second sentence, GDPR).

(6) If a subprocessor itself engages further processors, the list under paragraph 1 states where their list is published. The Provider informs the Customer of changes in this chain without delay after learning of them itself. On request, the Provider makes the data protection terms of its contracts with subprocessors available to the Customer; it may redact commercial information.

(7) Not subprocessing within the meaning of this clause are third-party services in which the third party is not intended to access the Customer’s data (for example telecommunication and postal services), and the services connected by the Customer itself under clause 10. Services the Provider operates itself on its infrastructure are listed separately in Annex 3.

7. Assistance with data subject rights (Art. 28(3)(e) GDPR)

(1) If a data subject contacts the Provider directly about the Customer’s data, the Provider forwards the request to the Customer without delay and does not answer it itself unless the Customer instructs it to do so.

(2) Taking into account the nature of the processing, the Provider assists the Customer by appropriate technical and organisational measures, insofar as this is possible, in responding to requests for access, rectification, erasure, restriction, data portability and objection (Art. 12 to 22 GDPR).

(3) To this end the application provides the Customer in particular with:

• viewing, correcting and deleting individual records in the application;
• an export of the company data as a structured JSON file, on every plan, for company administrators; uploaded documents can be downloaded individually;
• deactivating members, and deletion of a user’s own account by that person;
• deletion of the company with all data (clause 9(4)).

(4) If the Customer cannot fulfil a request with these functions itself, the Provider assists on request in text form, in particular by deleting data of or providing information about individual persons. This assistance is free of charge unless it is caused by the Customer’s breach of this agreement.

8. Security, personal data breach notification and impact assessment (Art. 28(3)(f), Art. 32 to 36 GDPR)

(1) Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in complying with the obligations under Art. 32 to 36 GDPR.

(2) Notification. The Provider notifies the Customer of any personal data breach affecting the Customer’s data that comes to its knowledge without undue delay, where possible within 24 hours and at the latest 48 hours after becoming aware of it, by email to the addresses under clause 3(3) (Art. 33(2) GDPR).

(3) The notification contains, insofar as known: a description of the nature of the breach, where possible with the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address and mitigate it; a contact point for further information. Information not yet available at the time of notification is provided without undue delay. The Provider takes the necessary measures without delay to secure the data and mitigate possible adverse effects, and documents the breach.

(4) Notifying the supervisory authority (Art. 33 GDPR) and communicating with data subjects (Art. 34 GDPR) is the Customer’s responsibility; the Provider assists with the information available to it.

(5) On request, the Provider assists the Customer with a data protection impact assessment (Art. 35 GDPR) and a prior consultation of the supervisory authority (Art. 36 GDPR) with the information it holds on processing operations and safeguards.

(6) Requests from authorities and third parties. If an authority or other third party asks the Provider for information about or disclosure of the Customer’s data, the Provider informs the Customer without delay, where legally permitted, and discloses data only on the Customer’s instructions or on the basis of a legal obligation. It also informs the Customer without delay of inspections and measures of the supervisory authority concerning the processing for the Customer.

9. Deletion and return after the end of the contract (Art. 28(3)(g) GDPR)

(1) After the end of the provision of services, the Provider, at the Customer’s choice, deletes all of the Customer’s personal data or returns them to the Customer and then deletes existing copies, unless Union or Member State law requires storage.

(2) Choice period. If the Main Contract ends because the entire contract is terminated, a choice period of 30 days begins. During this time the application remains usable for the Customer so that it can export its data; the Customer can also withdraw the termination within the period. About seven days before the period expires, the Provider notifies the Customer of the deletion date by email. When the period expires, the Provider deletes the data in accordance with paragraph 4 without any further declaration by the Customer. If the Customer deletes its company itself (function “Delete account & data”), there is no choice period; deletion takes place immediately.

(3) Return. Return primarily takes place through the export under clause 7(3). On request in text form within the choice period, the Provider makes the data, including the uploaded document files, available to the Customer free of charge in a common machine-readable format.

(4) How deletion is carried out. In the database the Provider deletes the personal reference by irreversible anonymisation: all information identifying a natural person is removed or overwritten without any mapping being kept; data without personal reference (for example quantities and bookings) may remain in this anonymised form. The Provider deletes uploaded files and the access credentials for services under clause 10 stored by the Customer at the latest 30 days after the anonymisation.

(5) Backups. Data in backups are not deleted individually but disappear when the backups are overwritten as scheduled, at the latest 90 days after deletion in the live system. Until then they are excluded from any further processing. If a backup has to be restored, the Provider repeats deletions already carried out.

(6) Exceptions. If Union or Member State law requires storage, the Provider restricts the processing of the data concerned to that purpose and deletes them when the obligation expires. Data that the Provider processes as controller under clause 1(7) – in particular its invoices to the Customer – are not subject to this clause.

(7) On request, the Provider confirms the deletion to the Customer in text form.

(8) The Customer itself deletes copies it has made (for example exports or backups in its own storage under clause 10).

10. Third-party services connected by the Customer

(1) The Customer can connect third-party services in Lavesy that it uses itself in its own name and with its own access. Currently these are:

1. AI providers for AI-assisted document extraction and the AI assistant (currently OpenAI and Anthropic), each with the Customer’s own API key;
2. the Customer’s own email account (own SMTP server or Microsoft 365) for sending business emails, for example purchase orders;
3. messaging channels (for example WhatsApp or Telegram) with own credentials;
4. the Customer’s own S3-compatible storage for backups;
5. AI applications of the Customer to which a user grants access to the data through the MCP interface with their consent (OAuth).

(2) These functions are switched off until the Customer activates them or stores access credentials. Without activation the Provider transmits no data to these services; text recognition (OCR) of uploaded documents then runs exclusively on the Provider’s infrastructure.

(3) Activation is a documented instruction from the Customer to transmit the data required for the respective function to the chosen service using the Customer’s access, or to grant it access. The Provider transmits only the data required for the function.

(4) The connected services are not subprocessors of the Provider. The contractual relationship for these services – including any required data processing agreement and the safeguards for a third-country transfer – exists between the Customer and the respective service.

(5) If the Customer activates such a service, it

• concludes, where required, a contract under Art. 28 GDPR with the service and checks the admissibility of a third-country transfer (Art. 44 et seq. GDPR);
• uses the settings available at the service, in particular to exclude the use of its data for training AI models and regarding the retention period;
• ensures that it is entitled to transmit the data concerned, and records the processing in its record of processing activities;
• revokes the access at the respective service when it no longer uses it.

(6) The Provider stores the access credentials in field-level encrypted form (Annex 2) and lists the common connectable services with references to their contract documents on the subprocessors page.

(7) The application presents the results of AI-assisted document extraction to the Customer’s users for review and approval; no decision based solely on automated processing within the meaning of Art. 22 GDPR takes place. The AI assistant and the MCP interface act only with the permissions of the respective user.

11. Transfers to third countries

(1) The Provider stores the Customer’s data exclusively in the European Union (Annex 3) and does not itself transfer them to third countries.

(2) For network and email services the hosting provider in turn engages further processors, including companies based in the USA. Insofar as these process the Customer’s data when emails are sent through the Provider’s sending route (for example invitations and notifications), this is based on the European Commission’s standard contractual clauses in the hosting provider’s agreement. Emails the Customer sends through its own email account under clause 10 are not affected.

(3) If a user activates push notifications, the Provider delivers them through the push service specified by the user’s browser or operating system (for example from Google, Apple or Mozilla); these services may be based in third countries. The content of the notification is transmitted end-to-end encrypted and cannot be read by the push service.

(4) Clause 10(4) and (5) apply to the connected services under clause 10. Any other transfer to a third country takes place only on the Customer’s documented instructions or under the procedure of clause 6, and only if the requirements of Art. 44 et seq. GDPR are met.

12. Evidence and audits (Art. 28(3)(h) GDPR)

(1) On request, the Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and this agreement, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by it.

(2) The Provider may provide evidence in particular through the current Annex 2, written information (for example answers to a questionnaire from the Customer), documents and logs, evidence from its subprocessors (for example certificates or audit reports) or approved codes of conduct or certifications under Art. 40 and 42 GDPR.

(3) If this evidence is not sufficient in an individual case, the Customer may carry out an inspection at the Provider or have it carried out by an auditor bound to confidentiality who is not a competitor of the Provider. The inspection must be announced in text form at least 30 days in advance, takes place during normal business hours, is limited to what is necessary and must not endanger the security of other customers. As a rule it takes place at most once per calendar year; in the event of a personal data breach, justified doubts about compliance with this agreement or at the request of a supervisory authority it is also possible beyond that and at shorter notice.

(4) Each party bears its own costs arising from an audit.

(5) The Provider supports the Customer in audits by the supervisory authority insofar as they concern the processing on behalf of the Customer, and cooperates with the supervisory authority (Art. 31 GDPR).

13. Liability

(1) Liability towards data subjects is governed by Art. 82 GDPR; this agreement does not limit it.

(2) Liability between the parties is governed by the provisions of the Main Contract (German terms of service, clause 11), unless mandatory law provides otherwise. Clause 6(5), second sentence, remains unaffected.

14. Term and precedence

(1) This agreement applies for the term of the Main Contract and beyond for as long as the Provider processes the Customer’s data; clause 9 continues to apply after the end of the contract. Separate ordinary termination of this agreement is excluded.

(2) If the Provider seriously breaches this agreement or data protection provisions and does not remedy the breach after being requested to do so, the Customer is entitled to terminate the Main Contract for cause.

(3) In the event of conflicts between this agreement and the Main Contract or other agreements, this agreement prevails in all matters of data protection.

15. Amendments to this agreement

(1) Amendments to this agreement take effect only if the Customer expressly agrees to them, at least in text form – for example by an administrator of the Customer agreeing in the application. Publishing a new version on this page or the Customer’s silence is not sufficient; clause 13 of the German terms of service does not apply to this agreement.

(2) If the Customer does not agree to a new version, the previous version continues to apply to it. The right of both parties to terminate the Main Contract ordinarily remains unaffected.

(3) Updating Annex 2 under clause 5(3) and changing subprocessors under the procedure of clause 6 are not amendments to this agreement.

(4) Each version bears a version identifier (at the top of this page). The Provider lists earlier versions in the section Earlier versions on this page and makes them available on request in text form.

16. Final provisions

(1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods; the place of jurisdiction is governed by clause 14(3) of the German terms of service.

(2) The German version of this agreement (Auftragsverarbeitungsvertrag) is binding. This English translation is for information only.

(3) Should a provision of this agreement be invalid, the validity of the remaining provisions remains unaffected; the invalid provision is replaced by the statutory rule, in particular Art. 28 GDPR.

(4) Annexes 1 to 4 form part of this agreement.

Annex 1 – Data subjects, types of data and processing activities

1.1 Categories of data subjects

• the Customer’s users (in particular employees and owners);
• contact persons at the Customer’s suppliers, including persons who fill in a price form of the Customer;
• the Customer’s customers and their contact persons;
• persons named in uploaded documents;
• recipients of emails and messages the Customer sends through the application;
• other persons whose data the Customer records in free-text fields or addresses.

1.2 Types of personal data

Data under Art. 9 and 10 GDPR are not subject matter of the processing; clause 3(2) applies.

1.3 Processing activities

Stock keeping and storage locations · goods receipt and goods issue · stocktaking · management of suppliers, customers and projects · purchasing including price requests to suppliers · the Customer’s delivery notes and invoices · document and invoice checks with approval workflow · text recognition of uploaded documents on the Provider’s infrastructure · optional functions and services under clause 10 · sending emails, messages and push notifications · import and export · logging (audit log) · backups · error tracking · support.

Annex 2 – Technical and organisational measures (Art. 32 GDPR)

As of 22 October 2026.

2.1 Confidentiality (Art. 32(1)(b) GDPR)

Physical access control

• The application runs on a virtual private server (VPS) in a data centre of the hosting provider (Annex 3); physical security of the premises lies with the hosting provider and follows its data processing agreement. The Provider does not operate server rooms of its own.

System access control

• Access to the application only over encrypted connections (HTTPS with TLS); HSTS and security headers including a Content Security Policy are set.
• Passwords are stored only as a cryptographic hash; sign-in attempts and API calls are rate-limited (protection against automated attacks).
• The administration interface is located under a non-public path and requires a second factor (TOTP or WebAuthn).
• The database and cache are reachable only through an internal network of the server, not from the internet.
• The technical access for automated deployment of new versions is key-based and restricted to one fixed command.

Data access control

• Role and permission concept per company, managed by the Customer itself; approval workflows with separate roles for entry and approval.
• The Provider accesses the Customer’s data only through its owner, only to the extent necessary and only (a) at the Customer’s request or with its knowledge for support, (b) to resolve faults and to defend against security incidents, or (c) on the basis of a legal obligation; in case (b) the Customer is informed afterwards if content of its data was viewed. Changes made through the administration interface are logged.

Separation control

• Tenant separation: every record belongs to exactly one company, access is restricted to the user’s own company; files are stored separately per company.
• Separate environments for production and testing (staging).

Pseudonymisation and encryption

• Secrets in the database – in particular API keys, passwords and tokens of connected services under clause 10 – are stored with field-level encryption.
• Encrypted transmission between browser or app and server (TLS).
• Backups are stored on the server readable only by the system administrator and, when they leave the server, transferred only in encrypted form (SSH).
• Push notifications are transmitted end-to-end encrypted (RFC 8291).

2.2 Integrity (Art. 32(1)(b) GDPR)

• Input control: audit log per company with time, acting person and subject of the change; stock movements are kept in a journal that cannot be changed afterwards.
• Transfer control through exclusively encrypted transmission.
• Automated scanning of the software components used for known vulnerabilities in the delivery process, with a documented exception procedure.
• Duplicate checks and rule-based checks in document processing.

2.3 Availability and resilience (Art. 32(1)(b) and (c) GDPR)

• Daily database backup; every backup is checked for readability and given a checksum. Retention on the server 14 days; additionally a backup before every deployment of a new version and regular server images by the hosting provider.
• Documented restore procedure with regular restore tests.
• Error tracking and operational monitoring on the Provider’s own infrastructure (Annex 3).

2.4 Procedures for regular testing, assessment and evaluation (Art. 32(1)(d) GDPR)

• Documented procedures for security incidents, for rotating credentials and for recurring security tasks including log reviews.
• Record of processing activities as processor (Art. 30(2) GDPR) and deletion concept.
• Privacy-friendly defaults: functions that transmit data to third parties are switched off until the Customer activates them (clause 10).
• Automatic retention periods: the text of sent emails and messages is deleted after 90 days, the recognised full text of documents after 180 days and AI assistant conversations 365 days after the last activity.

2.5 Processor control

• Subprocessors are engaged only under a contract pursuant to Art. 28(4) GDPR and are listed publicly with their place of processing (subprocessors).
• The Customer’s instructions are documented (clause 2(3)).

Annex 3 – Subprocessors

As of 2026-10-22. The Provider records changes made under the procedure of clause 6 here and at lavesy.de/en/subprocessors, where announced changes are also listed. For transfers by further processors of the hosting provider see clause 11(2).

Self-hosted services (no third party involved): error tracking (GlitchTip) as part of this processing; outside this agreement the website analytics (Umami) and the feedback function (Quackback, clause 1(7) no. 6). All run on the server named above.

Not subprocessors under this agreement: the payment provider Stripe, which the Provider uses as controller to bill the Main Contract (clause 1(7) no. 1), and the services connected by the Customer under clause 10.

Annex 4 – Contacts

The Provider has not appointed a data protection officer because the requirements for a mandatory appointment under Art. 37 GDPR and Section 38 BDSG are not met.