# Data processing agreement (DPA / AVV)

Source: https://listplus.ai/en/help/data-sources-privacy-legal/dpa-avv
Last updated: 2026-09-25

A data processing agreement (DPA), called Auftragsverarbeitungsvertrag (AVV)
in German, is the contract that governs how ListPlus processes personal
data on your behalf under GDPR. It's separate from your subscription terms.

## Getting a DPA

A DPA is available on request for every plan — Basic, Pro and Premium.
Email support@listplus.ai with your company name and it will be sent to
you to sign. There's no self-service download in the app today.

## What ListPlus does and doesn't claim

ListPlus hosts your data in the EU (Frankfurt) and signs a DPA on request,
but ListPlus itself holds no security certification of its own (no ISO
27001, SOC 2, or similar). Vercel, ListPlus's hosting provider, holds its
own certifications (including SOC 2 Type 2 and ISO 27001:2022) — that's
Vercel's certification, not ListPlus's, and covers Vercel's infrastructure.
Some processing, such as AI features and enrichment lookups, is done by
subprocessors, and transfers are covered by data processing agreements;
see "[Where is my data stored?](https://listplus.ai/en/help/data-sources-privacy-legal/where-is-my-data)".

This article explains where to get a DPA and what ListPlus does and
doesn't claim about it — it is not legal advice. For your own obligations
when using contact data (legitimate interest, informing people you've
added them, cold-outreach rules), see "[Your responsibilities under GDPR](https://listplus.ai/en/help/data-sources-privacy-legal/gdpr-your-responsibilities)."

**Related topics:** where-is-my-data · subprocessors ·
gdpr-your-responsibilities.

## FAQ

### Does ListPlus offer a DPA / AVV?

Yes, a data processing agreement (AVV in German) is available on request for every plan — Basic, Pro and Premium. Email support@listplus.ai to request one.

### How do I request a DPA?

Email support@listplus.ai with your company name; support sends you the document to sign. There's no self-service download inside the app today.

### Is a DPA available on the free Basic plan, or only paid plans?

Every plan, including Basic. The DPA isn't gated by plan — it's available on request whenever you're processing personal data through ListPlus.

### Does ListPlus hold ISO 27001, SOC 2, or similar certifications itself?

ListPlus doesn't hold a certification in its own name. Its hosting provider, Vercel, holds SOC 2 Type 2 and ISO 27001:2022 for the infrastructure ListPlus runs on. For security questions, email security@listplus.ai.

### Does signing a DPA with ListPlus cover the data providers you use (Prospeo, FullEnrich, and so on)?

The DPA covers ListPlus as the party you contract with; the providers behind individual lookups act as subprocessors. See "[Who processes your data (subprocessors)](https://listplus.ai/en/help/data-sources-privacy-legal/subprocessors)" for the categories and named providers, or email support@listplus.ai for the full list with locations.

### Is this page legal advice?

No. This page explains how to get a DPA and what ListPlus does and doesn't claim; it isn't a substitute for legal advice about your own GDPR obligations.

### Where else can I read about ListPlus's data handling?

See the help topics "[Where is my data stored?](https://listplus.ai/en/help/data-sources-privacy-legal/where-is-my-data)", "[Who processes your data (subprocessors)](https://listplus.ai/en/help/data-sources-privacy-legal/subprocessors)" and "[What the AI sees of your data](https://listplus.ai/en/help/working-in-a-list/what-the-ai-sees)." For anything else, email support@listplus.ai.