Data processing summary for agencies
This page summarises how Listed Local handles your clients' data, from the moment you set up a workspace. The full data processing agreement (DPA) is part of our terms of use and prevails over this summary.
Who is responsible for what
You are the controller, and we are your processor, for data you put into your workspace:
- your clients' names and the locations you track for them
- contact details of client staff you add, for example who receives a report
- client-portal users you invite
- your reports, prospect searches and white-label branding
- leads your lead widget collects on your website
We process that data only to provide Listed Local to you, on your documented instructions.
We are the controller for:
- Public search observations. Scan results, business listings and AI answers are shared across Listed Local and kept apart from workspace data. Any customer scanning the same business and search term sees the same observations. We collect them under our own legitimate interests, as our privacy policy describes.
- Your account, including your team members' logins and our relationship with you.
- Leads we pass to you. When a business owner on our free checker asks to be matched with a specialist and we introduce them to you, you receive the lead as an independent controller, under our partner terms. You then answer for your own use of it.
Paddle is the merchant of record and the independent controller of payment data.
What we process for you
| Item | Details |
|---|---|
| Purpose | Running scheduled scans, building reports, hosting the client portal and the lead widget, the AI visibility add-on, support |
| Data subjects | Your clients' staff and other client contacts (portal users and report recipients); people a client or business name identifies, such as sole traders; visitors who send their details through your lead widget; your staff, only where workspace records show who created a share link or ran a search |
| Personal data | Client names, contact email addresses, portal sign-in and report email records, the businesses you track or find, widget leads (name, email, an optional phone number and the business they checked, deleted after 24 months), your branding |
| Special categories | None. Please don't add health or other sensitive data. |
| Duration | While you have a workspace, plus the return and deletion period below |
Where the data is
Workspace data is stored in the European Union (Stockholm, Sweden). Our subprocessors, and where they process data, are on the subprocessors page. Transfers out of the EEA or the UK rely on an adequacy decision where one exists (for example for Switzerland, or the EU-U.S. Data Privacy Framework for certified US providers), or on the Standard Contractual Clauses and the UK International Data Transfer Addendum.
Subprocessors
You authorise the subprocessors on that page. We give you at least 30 days' notice by email before adding or replacing one that handles workspace data. If you object on reasonable data protection grounds and we can't address the concern, you may end the affected service and get a refund of prepaid fees for the unused period. Each subprocessor is bound by data protection terms at least as protective as ours.
Security
- Encryption in transit; the database is hosted with a provider that encrypts data at rest.
- Row-level security on every table, so one workspace can't read another's data.
- Database functions that touch money and limits can be called only by our server.
- Secrets live in our hosting provider's encrypted settings, never in code.
- Access to production data is limited to the people who run Listed Local. Our automated agents get only the access their job needs.
- Everyone with access is bound by confidentiality.
Helping you meet your obligations
- Requests from people. If someone asks us directly about data in your workspace, we pass the request to you and don't answer it ourselves unless you tell us to. We help you answer requests you receive.
- Breaches. We tell you without undue delay, and in any case within 48 hours of confirming a breach that affects your workspace data, with what we know and what we are doing. We update you as we learn more.
- Impact assessments. We give you the information you reasonably need for a data protection impact assessment or a consultation with an authority.
When your subscription ends
You have 30 days to export your data. After that we delete workspace data from the live system within 30 days, and from backups when they expire, unless the law requires us to keep it. Public search observations are not workspace data and stay in our shared history.
Audits
We answer reasonable security questionnaires and provide documentation of our measures. If that isn't enough, you may audit once a year, with 30 days' notice, at your own cost, under confidentiality, and in a way that doesn't expose other customers' data.
Your instructions
The DPA and your use of Listed Local's settings are your instructions. If we think an instruction breaks data protection law, we tell you and may refuse to carry it out.
Liability
Liability under the DPA follows the limits in the terms of use, except where the law doesn't allow a limit.
Contact
Agily AB, Fleminggatan 21, 112 26 Stockholm, Sweden, company registration number 559426-8079. Data protection questions: privacy@listedlocal.io.