Data processing agreement (DPA / AVV)

Updated Markdown

A data processing agreement (DPA), called Auftragsverarbeitungsvertrag (AVV) in German, is the contract that governs how ListPlus processes personal data on your behalf under GDPR. It's separate from your subscription terms.

The DPA applies to every plan#

The DPA applies to every plan — Basic and Pro — as part of the user agreement: you do not have to request or sign anything for it to hold. You can read it at listplus.ai/dpa. If your company needs a signed copy, email support@listplus.ai with your company name.

What ListPlus does and doesn't claim#

ListPlus hosts your data in the EU (Frankfurt) and the DPA applies on every plan, but ListPlus itself holds no security certification of its own (no ISO 27001, SOC 2, or similar). Vercel, ListPlus's hosting provider, holds its own ISO 27001:2022 certification and has a SOC 2 Type 2 report — that's Vercel's, not ListPlus's, and covers Vercel's infrastructure. Some processing, such as AI features, is done by subprocessors; outside the EU they work under data processing agreements with Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Enrichment lookups go to data providers: independent controllers that receive only the search key, on your instruction — and some of them name no transfer safeguard. Each is listed at listplus.ai/en/subprocessors, and a workspace owner can switch it off in the workspace policy; see "Where is my data stored?".

This article explains how the DPA applies and what ListPlus does and doesn't claim about it — it is not legal advice. For your own obligations when using contact data (legitimate interest, informing people you've added them, cold-outreach rules), see "Your responsibilities under GDPR."

Related topics: where-is-my-data · subprocessors · gdpr-your-responsibilities.

FAQ#

Does ListPlus offer a DPA / AVV?#

Yes. The data processing agreement (AVV in German) applies to every plan — Basic and Pro — as part of the user agreement, and you can read it at listplus.ai/dpa. You do not have to request it.

How do I request a DPA?#

You don't need to: the DPA applies automatically on every plan and is published at listplus.ai/dpa. For a signed copy, email support@listplus.ai with your company name.

Is a DPA available on the free Basic plan, or only paid plans?#

Every plan, including Basic. The DPA isn't gated by plan: it is part of the user agreement for all customers.

Does ListPlus hold ISO 27001, SOC 2, or similar certifications itself?#

ListPlus doesn't hold a certification in its own name. Its hosting provider, Vercel, holds ISO 27001:2022 and has a SOC 2 Type 2 report for the infrastructure ListPlus runs on. For security questions, email support@listplus.ai. The DPA's Annex 2 describes the technical and organisational measures, including availability, resilience and restore.

Does signing a DPA with ListPlus cover the data providers you use (Prospeo, FullEnrich, and so on)?#

The DPA covers ListPlus as the party you contract with. The data providers behind individual lookups have a dual role (DPA § 2(3)): providers with a data processing agreement (Prospeo, FullEnrich, CompanyEnrich, MillionVerifier, HarvestAPI) process the search key only to answer the query, as ListPlus's further processors; for their own databases every provider is an independent controller, and you receive the data as controller. Providers without such an agreement receive only the search key, on your instruction. They are listed in Annex 3, Part B (listplus.ai/en/subprocessors) with their seat and the transfer safeguard they name — a few name none (Serper, which does not name its company, and the Hacker News search via Algolia) — and a workspace owner can switch each of them off in the workspace policy.

No. This page explains how to get a DPA and what ListPlus does and doesn't claim; it isn't a substitute for legal advice about your own GDPR obligations.

Where else can I read about ListPlus's data handling?#

See the help topics "Where is my data stored?", "Who processes your data (subprocessors)" and "What the AI sees of your data." For anything else, email support@listplus.ai.