# Data processing agreement (DPA / AVV)

Source: https://listplus.ai/en/help/data-sources-privacy-legal/dpa-avv
Last updated: 2026-10-11

A data processing agreement (DPA), called Auftragsverarbeitungsvertrag (AVV)
in German, is the contract that governs how ListPlus processes personal
data on your behalf under GDPR. It's separate from your subscription terms.

## The DPA applies to every plan

The DPA applies to every plan — Basic, Pro and Premium — as part of the
user agreement: you do not have to request or sign anything for it to
hold. You can read it at listplus.ai/dpa. If your company needs a signed
copy, email support@listplus.ai with your company name.

## What ListPlus does and doesn't claim

ListPlus hosts your data in the EU (Frankfurt) and the DPA applies on every plan,
but ListPlus itself holds no security certification of its own (no ISO
27001, SOC 2, or similar). Vercel, ListPlus's hosting provider, holds its
own certifications (including SOC 2 Type 2 and ISO 27001:2022) — that's
Vercel's certification, not ListPlus's, and covers Vercel's infrastructure.
Some processing, such as AI features and enrichment lookups, is done by
subprocessors, and transfers are covered by data processing agreements;
see "[Where is my data stored?](https://listplus.ai/en/help/data-sources-privacy-legal/where-is-my-data)".

This article explains how the DPA applies and what ListPlus does and
doesn't claim about it — it is not legal advice. For your own obligations
when using contact data (legitimate interest, informing people you've
added them, cold-outreach rules), see "[Your responsibilities under GDPR](https://listplus.ai/en/help/data-sources-privacy-legal/gdpr-your-responsibilities)."

**Related topics:** where-is-my-data · subprocessors ·
gdpr-your-responsibilities.

## FAQ

### Does ListPlus offer a DPA / AVV?

Yes. The data processing agreement (AVV in German) applies to every plan — Basic, Pro and Premium — as part of the user agreement, and you can read it at listplus.ai/dpa. You do not have to request it.

### How do I request a DPA?

You don't need to: the DPA applies automatically on every plan and is published at listplus.ai/dpa. For a signed copy, email support@listplus.ai with your company name.

### Is a DPA available on the free Basic plan, or only paid plans?

Every plan, including Basic. The DPA isn't gated by plan: it is part of the user agreement for all customers.

### Does ListPlus hold ISO 27001, SOC 2, or similar certifications itself?

ListPlus doesn't hold a certification in its own name. Its hosting provider, Vercel, holds SOC 2 Type 2 and ISO 27001:2022 for the infrastructure ListPlus runs on. For security questions, email security@listplus.ai.

### Does signing a DPA with ListPlus cover the data providers you use (Prospeo, FullEnrich, and so on)?

The DPA covers ListPlus as the party you contract with; the providers behind individual lookups act as subprocessors. See "[Who processes your data (subprocessors)](https://listplus.ai/en/help/data-sources-privacy-legal/subprocessors)" for the categories and named providers, or email support@listplus.ai for the full list with locations.

### Is this page legal advice?

No. This page explains how to get a DPA and what ListPlus does and doesn't claim; it isn't a substitute for legal advice about your own GDPR obligations.

### Where else can I read about ListPlus's data handling?

See the help topics "[Where is my data stored?](https://listplus.ai/en/help/data-sources-privacy-legal/where-is-my-data)", "[Who processes your data (subprocessors)](https://listplus.ai/en/help/data-sources-privacy-legal/subprocessors)" and "[What the AI sees of your data](https://listplus.ai/en/help/working-in-a-list/what-the-ai-sees)." For anything else, email support@listplus.ai.