← Back to Levamio Review Agent

Data Processing Agreement (DPA) pursuant to Art. 28 GDPR – "Levamio Review Agent"

between the user of the service "Levamio Review Agent" (German name: "Levamio Bewertungs-Agent") as per registration – controller, hereinafter the "Client" –

and NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, DIEZ License No. 67837, represented by Tassilo Peter Seitz, email: [email protected], data protection: [email protected] – processor, hereinafter the "Contractor" –

1. Subject matter and duration

1.1 The subject matter is the processing of personal data by the Contractor in the provision of the software service "Levamio Review Agent" (hereinafter the "Service") under the Contractor's Terms ("Main Contract"). The Service supports the Client in fairly asking its customers for reviews and in replying to reviews.

1.2 The term corresponds to that of the Main Contract, including the trial period. Obligations under section 9 continue beyond the end of the contract.

2. Nature, purpose, types of data, data subjects

2.1 Nature of the processing: collection (manual entry, CSV import, pasting of reviews, retrieval from the Client's Google Business Profile once offered), storage, matching (verification of the legal basis and the suppression list), use (creation and dispatch of review requests, creation of reply drafts, optionally with AI), transmission (email dispatch; publication of approved replies via the Google Business Profile interface), counting (visits to the links, first click per request), logging, deletion.

2.2 Purpose: provision of the Service under the Main Contract, in particular review requests by email to contacts with a documented legal basis, management of unsubscribes, QR codes and links, reply drafts with approval, analytics and export for the Client.

2.3 Types of data:

• contact data of the Client's customers: name, email address, language, country;
• evidence data: legal basis, date and source of consent or date of the purchase/service and notice of the right to object, unsubscribe status, time of the last request;
• communication data: recipient, language, status and time of the requests, identifier of the dispatch service, time of the first click;
• review data: display name of the author, stars, text, date, language, existing reply, automatically detected flags;
• reply drafts: text, origin, approval and publication;
• aggregated visit counts per QR code/link and day (without personal reference).

Special categories under Art. 9 GDPR are not the subject of the processing. The Client does not enter health data or comparable data into the customer list or free-text fields. Review texts that authors have published publicly with a health context are processed by the Service only insofar as the Client pastes or retrieves them in order to reply to them.

2.4 Data subjects: customers and prospective customers of the Client (recipients of review requests), authors of reviews about the Client.

3. Instructions

3.1 The Contractor processes the data only on documented instructions from the Client, including with regard to transfers to third countries, unless it is required to do so by Union or Member State law; in that case it informs the Client in advance, insofar as permitted.

3.2 Instructions are the Main Contract, this Agreement as well as the Client's settings and actions in the Service (e.g. import, dispatch, approval, publication, deletion). Further instructions in text form to [email protected].

3.3 If the Contractor considers an instruction to be unlawful, it informs the Client without undue delay and may suspend its execution until it is confirmed or amended.

3.4 Unsubscribes by data subjects constitute instructions of the Client: the Contractor implements every unsubscribe declared via the unsubscribe link immediately and permanently for the Client (suppression list, hash value of the address only) and maintains it even if the same address is imported later.

4. Obligations of the Client

4.1 The Client is responsible for the lawfulness of the processing, in particular for the legal basis of each review request (consent or the conditions of a statutory exception), for informing data subjects pursuant to Art. 13 and 14 GDPR and for compliance with professional confidentiality obligations.

4.2 The Client informs the Contractor without undue delay of errors or irregularities.

5. Obligations of the Contractor

5.1 Confidentiality: use only of persons who have committed themselves to confidentiality (Art. 28(3)(b) GDPR).

5.2 Security: technical and organisational measures pursuant to Art. 32 GDPR in accordance with Annex 1; further development without falling below the level of protection.

5.3 Data subject rights: assistance to the Client (Art. 12–23 GDPR). The Contractor forwards direct requests from data subjects without undue delay; it implements unsubscribes in accordance with section 3.4.

5.4 Art. 32–36 GDPR: assistance with security, notifications, data protection impact assessment and prior consultation.

5.5 Personal data breaches: notification to the Client without undue delay, where possible within 48 hours, by email to the account address with the information pursuant to Art. 33(3) GDPR, insofar as available.

5.6 Evidence pursuant to section 8; record of processing activities pursuant to Art. 30(2) GDPR.

5.7 No use of the data for own purposes, in particular not for training AI models and not for advertising. The Client instructs the Contractor to generate from the processed data anonymised metrics that cannot be traced back either to the Client or to data subjects; the Contractor may use these to improve the Service.

5.8 Abuse prevention: The Contractor processes reports from recipients ("sender unknown") as an independent controller to protect its dispatch channel and may provisionally block the Client's dispatch in the event of accumulated reports (Terms section 4.5).

6. Sub-processors

6.1 The Client approves the sub-processors listed in Annex 2 (general written authorisation, Art. 28(2) GDPR).

6.2 The Contractor informs the Client by email at least 30 days before engaging or replacing a sub-processor. The Client may object within 14 days for an important reason relating to data protection law; if no agreement is reached, either party may terminate the Main Contract with effect from the time of the change.

6.3 The Contractor imposes equivalent obligations on sub-processors (Art. 28(4) GDPR) and is liable for their compliance.

6.4 Ancillary services such as telecommunications do not constitute sub-processing. Google (Business Profile) and other review platforms are contractual partners of the Client; the Contractor accesses Google only with the Client's authorisation.

7. Transfers to third countries

7.1 The Contractor is established in the United Arab Emirates; there is no adequacy decision for that country. The data is stored with sub-processors (Annex 2); the Contractor accesses it from the UAE.

7.1a For transfers to the Contractor to which Chapter V GDPR applies, the parties agree, upon conclusion of this Agreement, on the Standard Contractual Clauses of the EU Commission (Implementing Decision (EU) 2021/914), Module 2, which are incorporated into this Agreement by reference; the Client is the data exporter, the Contractor the data importer. Clause 7 does not apply; Clause 9 Option 2 (time period in accordance with section 6.2); the option in Clause 11 does not apply; Clause 13: the supervisory authority competent for the Client; Clause 17 Option 1: law of the Federal Republic of Germany; Clause 18: courts of the Federal Republic of Germany. Annex I results from the registration and section 2, Annex II from Annex 1, Annex III from Annex 2. The Clauses prevail in accordance with section 11.2.

7.2 Transfers to sub-processors in third countries take place only under the conditions of Art. 44 et seq. GDPR (e.g. EU-US Data Privacy Framework or Standard Contractual Clauses Module 3).

8. Audit rights

8.1 Evidence is provided primarily by self-disclosures, the current Annex 1 as well as certificates and audit reports of the sub-processors.

8.2 In addition, audits after notification (at least 30 days), no more than once per calendar year except where there is a specific reason, primarily as document-based or remote audits. For audits going beyond section 8.1, the Contractor may request reasonable reimbursement of expenses unless the audit reveals a material breach. Audits by supervisory authorities remain unaffected.

9. Deletion and return

9.1 The Client can at any time export the processed data itself (JSON, customer list as CSV), delete individual contacts and reviews, and delete everything with "Delete account and company". After the end of the contract (end of a cancelled subscription or end of the trial period without a booked subscription), an export option is available for 30 days; approximately 7 days before deletion the Contractor sends a reminder by email and thereafter deletes all processed data including copies, unless there is an obligation to store it under Union or Member State law.

9.1a During the term, the Service automatically deletes request logs and click counters after 24 months and discarded reply drafts after 90 days. The suppression list of unsubscribes (hash values only) remains in place until the end of the contract so that unsubscribes remain effective.

9.2 Backups at sub-processors are deleted as part of the regular rotation, generally after 30 days at the latest (Cloudflare D1 Time Travel).

9.3 The Contractor confirms the deletion in text form upon request.

10. Liability

Art. 82 GDPR applies to liability towards data subjects. As between the parties, the provisions of the Main Contract apply, unless Art. 82 GDPR mandatorily provides otherwise.

11. Final provisions

11.1 Amendments require text form. Incorporation takes place electronically upon acceptance of the Terms.

11.2 In the event of conflicts, this Agreement prevails over the Main Contract insofar as the protection of personal data is concerned; the Standard Contractual Clauses (section 7.1a) prevail over both.

11.3 Invalid provisions do not affect the remainder of the Agreement.

11.4 This Agreement is governed by the law of the Federal Republic of Germany. The place of jurisdiction is determined by the Main Contract, unless the Standard Contractual Clauses or the GDPR mandatorily provide otherwise.

---

Annex 1 – Technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Physical access: no own data centres; physical security at Cloudflare (certified data centres according to the provider).
• System access: admin access to Cloudflare, Resend, Stripe, Anthropic, Google Cloud only with strong password and two-factor authentication; personal accounts.
• Data access (application): passwordless sign-in via single-use link (15 minutes, only SHA-256 hash stored) after bot check; session identifier only as hash, HttpOnly, SameSite=Lax, Secure cookie; origin check against cross-site request forgery; rate limits with hashed IP/email addresses; admin functions only for designated addresses.
• Separation: every functional table carries the company ID, every query filters by it; company ID only from the session membership; automated tests including static analysis of all queries.
• Encryption: TLS; Google refresh tokens AES-GCM encrypted (key only as a secret of the runtime environment); links in review requests contain random tokens, stored only as hash.
• Minimisation: click counters without IP address, without cookies, aggregated per day; neither author names nor email addresses sent to the AI provider; logs without content.

Integrity

• Transfer control: dispatch only via Resend with an idempotency key per request; fixed sender format "<Name> via Levamio"; verification of legal basis, country rule, suppression list and 180-day interval immediately before each dispatch; dispatch only after confirmation of the reply-to address and with sender details; dispatch limits per plan; unsubscribe and report link in every request (incl. one-click unsubscribe pursuant to RFC 8058) with automatic blocking in the event of accumulated reports; redirects only to known review platforms (no open redirect); global emergency stop; kill switch (code + configuration) for dispatch to end customers.
• Input control: request log with legal basis at the time of dispatch; approval of replies with timestamp, person and checksum – any change invalidates the approval.
• Content guardrails: filters against review gating, incentives and links in request texts; filters against contact details, links and (for medical practices) health information in replies; notices on sensitive content in reviews.

Availability and resilience

• Distributed infrastructure of Cloudflare; Cloudflare D1 database with point-in-time recovery.

Review

• Automated tests (Vitest) and end-to-end test with every change; type checking and linting; annual review of this Annex.
• Privacy-friendly default settings: existing-customer exception off by default; for countries not configured, only QR code/link; dispatch to end customers only simulated until enabled.
• Deletion: export and complete deletion by the Client; automatic deletion periods in the daily job (sign-in links, sessions, rate limits after 24 hours, request logs and click counters after 24 months, discarded drafts after 90 days, processed data 30 days after the end of the contract).

Annex 2 – Sub-processors (as of 21 October 2026)

Not sub-processors for processed data: Stripe (only the Client's billing data); Google and other review platforms (contractual partners of the Client, section 6.4).

As of: 21 October 2026