Data processing agreement

This data processing agreement ("DPA") is part of the terms of use between Agily AB, Fleminggatan 21, 112 26 Stockholm, Sweden, company registration number 559426-8079 ("Listed Local", "we", "us"), and the agency that uses Listed Local ("you"). It covers the personal data in your workspace, which we process for you. It is the contract that Article 28 of the GDPR and of the UK GDPR requires, and our service provider terms under US state privacy laws. The data processing summary explains it in short. Where they differ, this DPA applies.

An owner or admin of your workspace accepts this DPA for your agency by ticking the box when setting up the workspace or on the billing page. We record who accepted, when, and which version.

1. Words we use

Workspace data: personal data that you, your team or your clients put into your Listed Local workspace, and what the app makes from it for you. Annex 1 lists it.
GDPR: the EU General Data Protection Regulation (2016/679) and, where it applies, the UK GDPR.
Data protection law: the GDPR and any other law on personal data that applies to workspace data, including US state privacy laws.
Subprocessor: a company we use that processes workspace data for us.
"Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" mean what the GDPR says they mean.

2. Roles

You are the controller of workspace data, and we are your processor. If you hold the data as a processor for your own client, we are your subprocessor, and you make sure that your instructions to us match your client's instructions to you.

What this DPA doesn't cover. We are the controller, under our privacy policy, for:

your account: your team members' email addresses, names and roles, invitations, and their sign-in links and sessions
our relationship with you: plans, billing records, usage and spend records, and support conversations
public search observations: scan results, business listings and AI answers, which we keep in a shared history apart from workspace data. Which business you track, for which client and under which search terms is workspace data. What Google Maps and the AI assistants showed for that search is an observation.
leads from our free checker, including leads we introduce to you under our partner terms. Leads your own lead widget collects are workspace data, under this DPA
the visitor key, rate limits and bot check that protect the free checker and your lead widget from abuse

Paddle, the merchant of record, is the independent controller of payment data.

3. Your instructions

We process workspace data only on your documented instructions. Your instructions are these terms and this DPA, the way you set up and use the app (for example adding a client contact, turning on report emails or creating a share link), and other written instructions you send to privacy@listedlocal.io that we agree fall within the service.
If EU or member state law requires us to process workspace data in another way, we tell you before we do, unless that law forbids telling you.
If we think an instruction breaks data protection law, we tell you, and we may hold off carrying it out until you confirm or change it.

4. Your responsibilities

You make sure you may put the data into Listed Local and that the people it is about are told what the law requires, for example that client contacts receive portal sign-in links and report emails in your name.
Don't add special categories of data (such as health data), data about criminal offences, or data about children. Listed Local isn't built for them.
Your instructions must comply with data protection law.

5. Confidentiality

Only the people who run Listed Local can reach workspace data, and only as far as their work needs. Each of them is bound by confidentiality, by contract or by law. Our automated agents get only the access their job needs.

6. Security

We protect workspace data with the technical and organisational measures in Annex 2, as Article 32 of the GDPR requires. We may change the measures as long as the overall protection doesn't fall.

7. Subprocessors

You give us general written authorisation to use the subprocessors on our subprocessors page (Annex 3).
Each subprocessor is bound by a written contract with data protection obligations that, in substance, match the ones in this DPA. We remain responsible to you for how they process workspace data.
Before a new or replacement subprocessor handles workspace data, we update the page and email your workspace's owners and admins at least 30 days in advance.
You may object within those 30 days, on reasonable data protection grounds, by writing to privacy@listedlocal.io. We will try to address the concern. If we can't, you may end the affected service before the change applies, and we refund the fees you prepaid for the unused period.

8. International transfers

Workspace data is stored in the European Union (Stockholm, Sweden). Some subprocessors are based in, or reach data from, other countries. The subprocessors page says where, and which safeguard applies.
When a subprocessor outside the EEA processes workspace data, we rely on an adequacy decision where one exists (for example for Switzerland, or the EU-U.S. Data Privacy Framework for certified US providers). Otherwise we use the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK law applies, or the equivalent mechanism the applicable law provides.
If you are outside the EEA and our making workspace data available to you is a transfer that the GDPR restricts, the Standard Contractual Clauses apply between you and us: Module 4 (processor to controller), or Module 3 (processor to processor) where you hold the data as a processor for your own client. They are incorporated into this DPA by reference: we are the data exporter and you are the data importer, the optional docking clause doesn't apply, and they are governed by Swedish law with disputes decided by the Swedish courts. Annex 1 and Annex 2 give the information their annexes ask for. Where UK law applies to the transfer, the UK International Data Transfer Addendum supplements them.
If the Standard Contractual Clauses conflict with this DPA, the Clauses apply. You can ask us for a copy at privacy@listedlocal.io.

9. Requests from people

If someone asks us about workspace data, we pass the request to you without undue delay and don't answer it ourselves unless you tell us to.
You can handle most requests in the app: change a client's name, remove a portal contact, turn off report emails or revoke a share link.
The app archives clients, locations, keywords and prospect searches instead of deleting them, so their history stays in your reports. If a request means one of them must be deleted, write to privacy@listedlocal.io and we delete it within 15 days.
If you need a copy of the workspace data about a person, for example to answer an access request, ask us and we send it to you within 15 days in a common format.

10. Helping with your other obligations

Taking into account how we process the data and the information we have, we help you with:

security, through the measures in Annex 2
personal data breaches, as section 11 describes
data protection impact assessments and prior consultations with a supervisory authority, by giving you the information about our processing that you reasonably need

11. Personal data breaches

If we become aware of a personal data breach that affects workspace data, we tell your workspace's owners and admins by email without undue delay, and in any case within 48 hours of confirming it.
We tell you what we know: what happened, which kinds of data and roughly how many people and records are affected, the likely consequences, what we have done and will do about it, and who to contact. If we don't know everything yet, we tell you what we can and update you as we learn more.
We contain the breach and take reasonable steps to limit its effects. Notifying a supervisory authority or the people affected is your decision as controller. We don't contact your clients or their contacts about a breach without your agreement, unless the law requires it.
Telling you about a breach is not an admission of fault.

12. When the service ends

The service ends when your paid plan ends and isn't renewed, or when you ask us to close your workspace. A workspace that never had a paid plan ends 60 days after it was created, so it is deleted 90 days after creation.
You then have 30 days to export your data. In that time you can still read your reports and the portal and download prospect lists, and on request we send you a copy of the workspace data in a common format within 15 days.
After those 30 days we delete the workspace data from the live system within 30 days. Copies in backups are deleted when the backups expire. We keep data longer only where EU or member state law requires it.
If you want us to delete sooner, tell us. On request we confirm the deletion in writing.
Public search observations aren't workspace data and stay in our shared history.

13. Information and audits

We make available the information needed to show that we meet our obligations under this DPA: this DPA, the subprocessors page, Annex 2 and answers to reasonable security questionnaires.
If that isn't enough, or a supervisory authority requires it, you may audit our processing of workspace data yourself or through an independent auditor bound by confidentiality. Audits take place once a year at most (more often only after a breach or when an authority requires it), with 30 days' notice, at your own cost, and in a way that doesn't expose other customers' data or weaken our security.

14. US state privacy laws

This section applies where the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) or another US state privacy law covers workspace data. Under those laws you are the "business" or "controller" and we are your "service provider" or "processor".

Business purposes. You disclose workspace data to us only for these limited and specified business purposes: running the scheduled ranking scans, AI visibility checks and prospect searches you set up; building and hosting your white-label reports, share links and client portal; running your lead widget's free checks and keeping the leads it collects for you; sending the portal sign-in links, weekly report emails and new-lead emails you turn on; answering your support requests; and keeping Listed Local secure and working.
What we don't do. We don't sell or share workspace data, as the CCPA defines those words. We don't retain, use or disclose it for any purpose other than those business purposes, including any other commercial purpose, or outside our direct business relationship with you, except as the CCPA and its regulations permit. We don't combine it with personal information we receive from others or collect ourselves, except as they permit. The public search observations behind your reports (section 2) are publicly available information that we collect ourselves; we keep them apart from workspace data and don't add workspace data to them.
What we do. We comply with the CCPA and its regulations as they apply to us, and give workspace data the same level of privacy protection they require of you. We help you with consumer requests (section 9). We tell you about subprocessors and bind them by written contract to these terms (section 7).
Your rights. You may take reasonable and appropriate steps to make sure we use workspace data in a way that is consistent with your obligations (section 13). On notice, you may take reasonable and appropriate steps to stop and remediate any unauthorised use, for example by asking us to confirm in writing that we have deleted data.
If we can't comply. We tell you if we decide that we can no longer meet our obligations under the CCPA and its regulations.
Certification. We certify that we understand the restrictions in this section and will comply with them.

Under other US state privacy laws, this DPA's terms on instructions, confidentiality, subprocessors, deletion or return, information and audits are the processor contract those laws require.

15. Other countries

Where another country's data protection law applies to workspace data, for example in Canada, India or Australia, the roles and duties in this DPA apply in the same way, whatever that law calls them.

16. Liability

Liability under this DPA follows the limits in the terms of use, except where the law doesn't allow a limit.

17. Term, changes and precedence

This DPA applies from when you accept it until we have deleted the workspace data under section 12.
We may change this DPA. We update the date at the top, and for changes that affect you we email your workspace's owners and admins at least 30 days before they apply. We won't lower the protection of workspace data unless the law requires it. If you don't agree with a change, cancel or close your workspace before it applies.
For workspace data, this DPA prevails over the terms of use. The governing law and courts are those in the terms of use.

18. Contact

Agily AB, Fleminggatan 21, 112 26 Stockholm, Sweden, company registration number 559426-8079. Data protection questions: privacy@listedlocal.io.

Annex 1: Details of the processing

Item	Details
Subject matter	Providing Listed Local to your agency under the terms of use
Duration	From your acceptance until the workspace data is deleted (section 12)
Nature	Storing, organising and showing workspace data in the app, your reports, the client portal and your lead widget; running the free checks your lead widget offers and storing the details visitors send you; sending business names, search terms and map coordinates to our search-data provider; sending emails; support; deletion
Purposes	The business purposes in section 14
Frequency	Continuous while you use Listed Local
Data subjects	People at your clients, or others, whom you add as client contacts (portal users and report email recipients). Your clients, and the owners of businesses you track or find through prospect searches, where a business name or listing identifies a person, such as a sole trader. Visitors to your website who use your lead widget and send you their details. Your team members, only as far as workspace records show which of them created a share link or ran a prospect search.
Special categories	None. You agree not to add any.
Location	European Union (Stockholm, Sweden), and the subprocessors in Annex 3
Supervisory authority (for the Standard Contractual Clauses)	The Swedish Authority for Privacy Protection (IMY)

Personal data

Category	What we hold
Clients	The name you give each client
Client contacts	Email address; when they last signed in to the portal; whether they get weekly report emails; when the last one was sent, and the email being sent while it is retried; their sign-in links and portal sessions, stored only as hashes with their expiry times; and, if they unsubscribe, their address on your workspace's opt-out list, so the emails don't start again
Tracked locations	The business you track, the name you give it, its grid settings, search terms and scan schedule, the links to the scans and AI answers run for it, and the share links you create (with their tokens, which team member created each, and whether it is revoked)
Prospect searches	The category and city searched, the businesses found (name, address, website, rating, number of reviews, whether the profile is claimed), their scores and share links, and which team member ran the search
Widget leads	The visitor's name, email address and, if given, phone number; the business, city and search term they checked, and the market; the consent text they saw, which names your agency and links your privacy policy, with its version; when they sent it; and when the email to your team went out
Widget checks	When each check on your lead widget ran and which scan it started. The scan's results are a public search observation, outside this DPA
Branding	Your brand name, colour, logo and custom domain, and your lead widget's settings (whether it is on, your privacy policy link and the message visitors see)
Emails	The content of the portal sign-in emails, weekly report emails and new-lead emails we send for you

Retention. Workspace data is kept while your workspace exists, then deleted as section 12 describes. Sign-in links and portal sessions are deleted within two weeks of expiring. Archived clients, locations, keywords and prospect searches are kept until you ask us to delete them or the workspace is deleted. The opt-out list is deleted with the workspace. Widget leads are deleted 24 months after they arrive, or sooner if you ask us or the workspace is deleted.

Annex 2: Security measures

Customers kept apart. Row-level security in the database. Every request from an agency member runs as a restricted database role that sees one workspace, and client-portal contacts and share links run as roles that see one client or one report. Column permissions stop members from changing plans, limits and acceptance records, and a record in one workspace can't be linked to another workspace's records.
No public database access. The database's public API roles have no access to these tables. Only our server connects, and the database functions that touch money and limits can be called only by our server.
Sign-in. No passwords. Sign-in links are single-use and expire after 20 minutes. Sign-in links and session tokens are stored only as SHA-256 hashes. Sessions end after 30 days at most, can be revoked, and use secure, HTTP-only cookies. Requests for sign-in links are rate-limited, and agency sign-in has a bot check.
Share links. Long random tokens that you can revoke. A share link can read only its own report.
Encryption. The website, app, client portal and share links are served only over HTTPS (TLS 1.2 or 1.3), on our domain and on custom domains. Our server connects to the database over TLS. Our database provider encrypts stored data (AES-256).
Location. The database and our server functions run in the European Union (Stockholm, Sweden).
Secrets. Keys and passwords live in our providers' secret stores, never in code. Automated checks on code changes run without production secrets.
Access. Only the people who run Listed Local can reach production data. Our automated agents get only the access their job needs. Our internal tools (chat, issues, code reviews) carry record ids, never names or email addresses.
Limits on misuse. Every action that changes data or sends email must come from a page we serve. The emails a workspace can send to other people are limited per workspace and per recipient.
Retention. Expired sign-in links and sessions are deleted automatically.
Incidents and recovery. A written incident procedure: contain first (revoke sessions, rotate keys, stop the affected service), then record, fix and review. Exposure of personal data is our highest severity. Backup and restore steps are written down.

Annex 3: Subprocessors

The service providers on our subprocessors page, as updated under section 7.