Data Processing Agreement

1. Parties and roles

This agreement is part of the Terms of Service between the customer ("Customer", controller / business) and ListVivid SIA, registration [registration number], [registered address], Latvia ("ListVivid", "we") (processor / service provider). It applies to personal information ListVivid processes for the Customer through the service ("Customer Personal Data").

2. Subject matter, duration, nature and purpose

Subject matter: hosting the Customer's listing websites, tours, seller previews and marketing kits, delivering inquiries, counting visits and drafting listing copy with AI. Duration: as long as the Customer uses the service, plus the deletion periods in section 9. Nature: collection, storage, display, transmission, deletion.

3. Data and data subjects

• Buyers and other people who send inquiries: name, email, phone, message, preferred tour date, consent record, page and time.
• Visitors of listing websites: a daily hash of IP address and browser, kept for 2 days.
• The Customer's agents and staff shown on listings: name, licence details, contact details, headshot, brokerage.
• People incidentally appearing in listing content (photos, notes, MLS sheets).

No special categories of data are intended; the Customer will not upload them.

4. Instructions and confidentiality

ListVivid processes Customer Personal Data only on the Customer's documented instructions — these Terms, this agreement and the Customer's use of the product — and tells the Customer if it believes an instruction breaks the law. Everyone with access is bound by confidentiality.

5. Security

ListVivid maintains the technical and organisational measures in Annex A and keeps them up to date.

6. Sub-processors

The Customer authorises the sub-processors listed at /subprocessors. ListVivid gives at least 30 days' notice of a new sub-processor by email; the Customer may object on reasonable grounds and, if no solution is found, end the affected service with a pro-rated refund. Each sub-processor is bound by data-protection terms at least as protective as these, and ListVivid remains responsible for them.

7. Assistance

ListVivid helps the Customer answer requests from individuals (the product lets the Customer delete inquiries and export or delete the workspace; requests sent to us are forwarded within 5 business days) and with security, breach notification, impact assessments and consultations, taking into account the nature of the processing.

8. Personal data breaches

ListVivid notifies the Customer without undue delay, and aims to do so within 48 hours, after becoming aware of a breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations.

9. Deletion and return

Inquiries are deleted 24 months after they arrive. When the Customer deletes a listing or the workspace, the related Customer Personal Data is deleted from the live systems at once and from backups as they are overwritten. Before deleting, the Customer can export the workspace in the product.

10. Audits

ListVivid makes available the information needed to show compliance with this agreement and answers reasonable written audit questions once a year, or after a breach.

11. International transfers

Where Customer Personal Data is transferred out of the European Economic Area, the transfer relies on the EU–US Data Privacy Framework for certified recipients or on the European Commission's standard contractual clauses, which are incorporated by reference with ListVivid as data exporter or importer as the case requires. [Module selection to be confirmed with counsel.]

12. US state privacy laws (CCPA and others)

• ListVivid is a service provider (California) and a processor (Virginia, Colorado, Connecticut, Texas, Oregon and similar laws).
• It will not sell or share Customer Personal Data, or retain, use or disclose it outside the direct business relationship and the business purposes in section 2.
• It will not combine Customer Personal Data with personal information it receives from other sources, except as those laws permit.
• It provides the same level of privacy protection the laws require, notifies the Customer if it can no longer meet its obligations, and lets the Customer take reasonable steps to stop and remediate unauthorised use.
• Sub-processors are bound by written contracts with the same obligations.

Annex A — technical and organisational measures

• Encryption in transit (HTTPS/TLS) everywhere; providers encrypt stored data at rest.
• Tenant isolation in the database: row-level security on every table, scoped to the user's workspace; the privileged key is used only on the server after the user's access was checked.
• Least privilege: anonymous visitors have no database access; sensitive operations run as audited server functions.
• Photos are decoded and re-encoded from raw pixels, so location and camera metadata never survive; hidden addresses never leave the server.
• Seller preview tokens are stored only as SHA-256 digests and expire after 7 days.
• Spam and abuse controls: Cloudflare Turnstile verified on the server, honeypot field, rate and cost limits.
• CRM deliveries go only to public HTTPS addresses checked against private networks, without redirects, and are signed.
• Automatic deletion: inquiries after the retention period, visit hashes after 2 days.
• Security headers (HSTS, nosniff, referrer policy, frame protection on signed-in pages); automated tests for access rules on every change.