Data Processing Agreement (DPA)

1. Subject matter and order of precedence

1.1 This Data Processing Agreement specifies the data protection obligations of the Parties under Art. 28 GDPR in connection with the services provided by the processor to the controller within the framework of ImmoVision.

1.2 This DPA applies to all activities in which the processor processes personal data on behalf of the controller.

1.3 This DPA supplements the main contract existing between the Parties on the use of ImmoVision, including any tariffs, offers, service descriptions, enterprise agreements, white-label agreements or other project-related agreements.

1.4 In the event of contradictions between this DPA and the main contract, the provisions of this DPA shall take precedence with regard to the processing on behalf.

2. Roles of the Parties

2.1 The controller is responsible for the lawfulness of the processing of personal data, in particular for:

• the existence of a legal basis,
• safeguarding the rights of data subjects,
• fulfilling information obligations,
• the admissibility of the data transmitted to the processor,
• the lawfulness of any recordings, transcriptions or AI-supported evaluations, insofar as these are initiated by the controller.

2.2 The processor processes personal data exclusively on behalf of the controller, within the framework of the documented instructions and for the purposes described in this DPA.

2.3 This DPA does not cover processing in which the processor is itself the controller or is otherwise independently responsible under data protection law. This applies in particular to:

• the establishment, performance and billing of the contractual relationship with the controller,
• its own receivables management,
• evidentiary, documentation and statutory retention obligations,
• ensuring the security, integrity, stability and abuse prevention of its own systems,
• the pursuit of its own legal claims or defence against claims,
• legally mandatory disclosures,
• its own compliance, audit, security and governance purposes,
• the processing of its own invoice, contract, wallet or payment data outside the actual processing on behalf.

3. Nature, purpose and scope of the processing

3.1 The nature, purpose and subject matter of the processing, the categories of personal data and the categories of data subjects result from this DPA, the main contract and in particular from Annex 1.

3.2 The processor processes personal data in particular for the provision and performance of the contractually owed SaaS services of ImmoVision, in particular in connection with:

• lead capture and lead processing,
• CRM, dashboard and workflow functions,
• exposé, microsite and property enquiries,
• user accounts, teams, role and permission management,
• appointment and communication functions,
• media, exposé, microsite, property and content management,
• AI-supported functions, insofar as these are used on behalf of the controller for its data,
• transcription, summarisation, structuring and workflow processes,
• hosting, storage, provision, processing and technical output of the controller's content and data,
• billing-relevant usage events, insofar as these concern data or operations processed on behalf.

3.3 The processor processes personal data only to the extent necessary for the provision of the agreed services.

4. Controller's right to issue instructions

4.1 The processor processes personal data exclusively on documented instructions from the controller, unless it is required to carry out processing by Union law or the law of a Member State. In such a case, the processor shall inform the controller of these legal requirements before processing, unless the law in question prohibits such information on important grounds of public interest.

4.2 The controller's instructions are initially determined by this DPA, the main contract, the service description and other expressly incorporated contractual documents.

4.3 Individual instructions from the controller require at least text form, unless another form is necessary for reasons of urgency. Oral instructions must be confirmed in text form without undue delay.

4.4 If the processor is of the opinion that an instruction infringes data protection law, it shall inform the controller thereof without undue delay. The processor is entitled to suspend the execution of the instruction concerned until it is confirmed or amended by the controller.

5. Confidentiality and access restriction

5.1 The processor ensures that the persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2 The processor ensures that access to personal data is only granted to such persons as require this data to fulfil the contractually owed services.

5.3 The processor takes appropriate organisational measures to restrict responsibilities, roles and access rights internally in an appropriate manner.

6. Technical and organisational measures

6.1 Pursuant to Art. 32 GDPR, the processor takes appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

6.2 The technical and organisational measures in place at the time of conclusion of the contract are set out in Annex 2 to this DPA.

6.3 The processor is entitled to further develop or adapt technical and organisational measures or to replace them with equivalent measures, provided that the contractually agreed level of protection is not undercut.

6.4 Contracts pursuant to Art. 28(4) GDPR are in place with all hosting, infrastructure, AI and communication service providers acting on behalf (see Annex 3). The Cloud Data Processing Addendum applies to Google Cloud and the Data Protection Addendum applies to Microsoft.

6.5 AI functions are operated in EU regions (Google Vertex AI: EU region, Frankfurt, Netherlands; Microsoft Azure OpenAI: EU region). Personal data of the controller is not used to train AI models either by the processor or — according to their contractual terms — by the AI providers.

6.6 The processor provides the controller with functions enabling it to fulfil its obligations as deployer under the AI Act (Regulation (EU) 2024/1689), in particular: switching AI functions on and off per agency and per person, notice of AI interaction for assistants, labelling of AI-generated or AI-modified images and videos, confirmation and record per AI image before publication, and a short training course on AI literacy with documentation.

7. Processor's obligations to provide assistance

7.1 Within reasonable limits, the processor assists the controller in fulfilling requests from data subjects under Chapter III GDPR, insofar as the controller cannot fulfil its obligations itself with reasonable effort.

7.2 Taking into account the nature of the processing and the information available to it, the processor assists the controller in complying with the obligations under Art. 32 to 36 GDPR, in particular in connection with:

• security of processing,
• notification of personal data breaches,
• data protection impact assessments,
• prior consultations with supervisory authorities.

7.3 Insofar as the controller is obliged to provide information to data subjects and is dependent on information from the processor for this purpose, the processor will provide this information within reasonable limits.

8. Notification of personal data breaches

8.1 The processor informs the controller without undue delay as soon as it becomes aware of a personal data breach affecting data that it processes on behalf of the controller.

8.2 The notification is made with the information available to the processor, in particular, where possible, regarding:

• the nature of the breach,
• the categories of data concerned,
• the groups of persons concerned,
• the likely consequences,
• remedial measures already taken or proposed.

8.3 Within reasonable limits, the processor will assist the controller in the further investigation and handling of the incident.

9. Sub-processors

9.1 The controller grants the processor general authorisation to engage further processors (sub-processors), provided that the requirements of this DPA and of Art. 28 GDPR are complied with.

9.2 The sub-processors engaged at the time of conclusion of the contract are set out in Annex 3.

9.3 The processor will inform the controller in text form of any intended changes concerning the addition or replacement of sub-processors.

9.4 The controller may object to such changes in text form for good cause under data protection law within 14 calendar days of receipt of the information.

9.5 If the controller does not object in due time, the change is deemed approved.

9.6 If the controller objects in due time and the processor is unable to continue providing the services without the sub-processor concerned, or unable to do so on reasonable terms, the processor may restrict the service concerned or terminate the main contract or the affected part of the services with reasonable notice.

9.7 The processor will only engage sub-processors on the basis of a contract that imposes on them essentially the same data protection obligations as are provided for in this DPA.

10. Processing in third countries

10.1 Personal data is only processed outside the European Union or the European Economic Area insofar as this is provided for in the contract, instructed by the controller or permissible under data protection law.

10.2 Insofar as the processor or a sub-processor processes data outside the EEA, the processor ensures that there is a permissible basis for this under data protection law, in particular an adequacy decision or appropriate safeguards.

10.3 Transfers to third countries only take place via the sub-processors named in Annex 3 and on the basis stated there (adequacy decision, in particular the EU-U.S. Data Privacy Framework, or EU Standard Contractual Clauses). Hosting, database and file storage are located in Germany, AI processing in EU regions.

10.4 For controllers in Turkey, processing in the EU constitutes a transfer abroad pursuant to Art. 9 of Law No. 6698 (KVKK). Where necessary, the Parties conclude for this purpose the standard contracts published by the Turkish data protection authority; notification to the authority is the responsibility of the transferring party.

11. Evidence and audit rights

11.1 Upon request, the processor makes available to the controller the information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR.

11.2 After reasonable prior notice and taking into account the confidentiality and security interests of the processor, the controller is entitled to carry out audits or inspections or to have them carried out by independent auditors bound to confidentiality.

11.3 Audits must be limited to the necessary extent and must not unreasonably impair the processor's business operations.

11.4 The processor may also fulfil evidentiary obligations by means of suitable current evidence, certifications, audit reports, attestations, security documentation or comparable documents, insofar as these are sufficient for an appropriate review.

11.5 Insofar as the effort of an audit or of assistance exceeds the usual and legally owed extent, the processor may demand reasonable remuneration for this, provided that it informs the controller of this in advance.

12. Return and deletion after the end of the contract

12.1 After termination of the contractual services, the processor will, at the controller's choice, either delete or return the personal data processed on behalf, unless there is a legal obligation to store it.

12.2 Statutory retention obligations, legitimate evidentiary interests and technically necessary backup and recovery cycles remain unaffected. In these cases, the data concerned is blocked for other purposes and only retained to the extent legally required.

12.3 Before the end of the contract, the controller can create a complete export of its data (Office settings → Data & contract; download available for 24 hours). It is responsible for exporting its data in good time.

13. Liability and relationship to the main contract

13.1 The main contract additionally applies to the liability of the Parties, insofar as this DPA does not contain a more specific provision and insofar as this is permissible under data protection law.

13.2 Statutory liability provisions, in particular under Art. 82 GDPR, remain unaffected.

14. Final provisions

14.1 Amendments and additions to this DPA require at least text form, unless a stricter form is prescribed by law.

14.2 Should individual provisions of this DPA be or become invalid in whole or in part, the validity of the remaining provisions remains unaffected.

14.3 In all other respects, the provisions of the main contract apply.

14.4 This DPA enters into force upon conclusion of the main contract or upon commencement of the processing on behalf.

Annex 1 – Description of the processing

1. Subject matter of the processing

Provision and performance of the SaaS services of ImmoVision booked by the controller.

2. Nature of the processing

Collection, recording, storage, organisation, structuring, sorting, retrieval, use, disclosure by transmission in the course of providing the services, making available, alignment, combination, restriction, erasure and destruction of personal data, insofar as this is necessary for the contractually agreed services.

3. Purpose of the processing

Processing of the controller's personal data for the provision of ImmoVision, in particular for:

• lead capture and lead processing,
• CRM, dashboard and workflow functions,
• exposé and microsite management,
• property and media management,
• user accounts and role management,
• appointment and communication functions,
• AI-supported functions, insofar as these are used on behalf of the controller,
• image processing, virtual staging and media outputs,
• transcription, summarisation and workflow processes,
• technical storage, hosting, output and management of customer content and data,
• billing-relevant usage events, insofar as these concern data or operations processed on behalf,
• AI assistants on exposés, microsites and WhatsApp as well as voice functions (dictation, voice command, call evaluation),
• records (consents, AI image records, audit log).

4. Categories of data subjects

Depending on use, in particular:

• prospects,
• customers of the controller,
• users and employees of the controller,
• contact persons,
• owners and sellers,
• visitors to exposés and microsites who submit enquiries or use assistants,
• other parties to recorded telephone calls (after consent),
• other persons whose data the controller processes within the platform.

5. Categories of personal data

Depending on use, in particular:

• master data,
• contact data,
• communication data,
• property and case data,
• user account data,
• role and permission data,
• appointment and status data,
• content from forms, exposés, microsites or CRM entries,
• uploaded media and associated metadata,
• audio content, transcripts and structured information derived from them, insofar as the corresponding functions are used,
• technical usage and log data, insofar as these serve the provision on behalf of the controller.

6. Special categories of personal data

Processing of special categories of personal data within the meaning of Art. 9 GDPR is generally not intended. Insofar as the controller nevertheless processes or uploads such data, it remains responsible for their admissibility and any special protection requirements.

7. Duration of the processing

For the term of the main contract. Periods that the platform applies automatically (e.g. conversation histories of the AI assistant 90 days, call recordings as specified by the agency, microsite statistics 90 days, search requests 180 days after the last activity) are stated in the privacy policy. Thereafter, return or deletion in accordance with clause 12.

Annex 2 – Technical and organisational measures (TOMs)

The processor implements appropriate technical and organisational measures pursuant to Art. 32 GDPR. These include in particular, where relevant in each case:

• physical access control to server, hosting and administration environments,
• system access control through authentication and authorisation concepts,
• data access control according to the role and permission principle,
• transport encryption,
• password hashing and secure authentication procedures,
• logging of security-relevant events,
• data backup and recovery concepts,
• separation of tenants and roles, insofar as provided for by the system,
• measures to ensure confidentiality, integrity, availability and resilience,
• procedures for regularly testing, assessing and evaluating the effectiveness of the security measures,
• processes for handling security incidents and personal data breaches,
• restriction of administrative access,
• secure development, maintenance and updating of the systems used,
• careful selection and contractual commitment of sub-processors.

Insofar as hosting services are provided via Hetzner, the TOMs agreed with Hetzner and the current technical documentation of the product used apply in addition.

For Google Cloud / Vertex AI and Microsoft Azure OpenAI, the contractually agreed security measures of the providers (Google Cloud Data Processing Addendum, Microsoft Data Protection Addendum) apply in addition.

Annex 3 – Sub-processors

The sub-processors engaged at the time of conclusion of the contract, with service, location and basis for third-country transfers, are listed on the “Sub-processors” page; this page forms part of this annex. In summary:

Service providers or processing operations in which ImmoVision or the respective third-party provider is an independent controller are not deemed sub-processors within the framework of this DPA, in particular in the following areas: establishment, performance and billing of the contractual relationship, payment processing, fraud prevention, own compliance and legal purposes, own security and abuse prevention purposes. This may in particular concern Stripe, insofar as Stripe acts as an independent controller in connection with payment processing, fraud prevention or regulatory obligations.