Data processing agreement (DPA / AVV)
A data processing agreement (DPA), called Auftragsverarbeitungsvertrag (AVV) in German, is the contract that governs how ListPlus processes personal data on your behalf under GDPR. It's separate from your subscription terms.
Getting a DPA#
A DPA is available on request for every plan — Basic, Pro and Premium. Email support@listplus.ai with your company name and it will be sent to you to sign. There's no self-service download in the app today.
What ListPlus does and doesn't claim#
ListPlus hosts your data in the EU (Frankfurt) and signs a DPA on request, but ListPlus itself holds no security certification of its own (no ISO 27001, SOC 2, or similar). Vercel, ListPlus's hosting provider, holds its own certifications (including SOC 2 Type 2 and ISO 27001:2022) — that's Vercel's certification, not ListPlus's, and covers Vercel's infrastructure. Some processing, such as AI features and enrichment lookups, is done by subprocessors, and transfers are covered by data processing agreements; see "Where is my data stored?".
This article explains where to get a DPA and what ListPlus does and doesn't claim about it — it is not legal advice. For your own obligations when using contact data (legitimate interest, informing people you've added them, cold-outreach rules), see "Your responsibilities under GDPR."
Related topics: where-is-my-data · subprocessors · gdpr-your-responsibilities.
FAQ#
Does ListPlus offer a DPA / AVV?#
Yes, a data processing agreement (AVV in German) is available on request for every plan — Basic, Pro and Premium. Email support@listplus.ai to request one.
How do I request a DPA?#
Email support@listplus.ai with your company name; support sends you the document to sign. There's no self-service download inside the app today.
Is a DPA available on the free Basic plan, or only paid plans?#
Every plan, including Basic. The DPA isn't gated by plan — it's available on request whenever you're processing personal data through ListPlus.
Does ListPlus hold ISO 27001, SOC 2, or similar certifications itself?#
ListPlus doesn't hold a certification in its own name. Its hosting provider, Vercel, holds SOC 2 Type 2 and ISO 27001:2022 for the infrastructure ListPlus runs on. For security questions, email security@listplus.ai.
Does signing a DPA with ListPlus cover the data providers you use (Prospeo, FullEnrich, and so on)?#
The DPA covers ListPlus as the party you contract with; the providers behind individual lookups act as subprocessors. See "Who processes your data (subprocessors)" for the categories and named providers, or email support@listplus.ai for the full list with locations.
Is this page legal advice?#
No. This page explains how to get a DPA and what ListPlus does and doesn't claim; it isn't a substitute for legal advice about your own GDPR obligations.
Where else can I read about ListPlus's data handling?#
See the help topics "Where is my data stored?", "Who processes your data (subprocessors)" and "What the AI sees of your data." For anything else, email support@listplus.ai.