Data processing agreement (AVV)

Version 2026-10-04 · Updated 2026-10-04

Version 2026-10-04 · Updated 2026-10-04

Parties, subject and duration

The controller is the user identified by the Immovaro account insofar as that user determines the purposes and means of processing third-party personal data. The processor is Denis Panic at the address below. The processor handles this data for the agreed portfolio, rental and analysis functions. The operator acts separately as controller for its own account, security and legal evidence data. This agreement applies for the duration of commissioned processing and forms part of the usage contract. Document uploads are not included in the currently activated processing scope.

Nature, purpose, data and data subjects

Processing serves storage, association, display and calculation of property and rental analyses requested by the controller. It includes collection, organisation, storage, retrieval, modification and erasure of structured data. Data subjects may include tenants, counterparties and loan participants. Data categories are names or descriptions, contact details and property, rental, contract and financial information entered by the controller. The controller limits entries to necessary data. GDPR Article 9 special categories and Article 10 criminal conviction data are outside the agreed scope.

Instructions and controller duties

Processing follows documented instructions from the agreed service scope and lawful additional instructions. You are responsible for legal grounds, accuracy and information duties. The operator informs you if an instruction is believed to infringe privacy law. Legally compelled processing is disclosed beforehand where permitted.

Technical and organisational measures

The processor safeguards confidentiality, integrity, availability and resilience through risk-appropriate measures. These include server-side account and portfolio ownership checks for each access, a separate Immovaro identity service, a dedicated database and role, encrypted transport in production, operator access restricted to authorised persons and purpose-limited logs without passwords or document contents. Authorised persons are bound to confidentiality. Backup procedures, restore tests and regular effectiveness reviews must be established and documented before production use. Erasures and access blocks must be reapplied after restoration. Measures may evolve without lowering the agreed protection level.

Authorised subprocessors

The controller authorises Contabo GmbH, Welfenstraße 22, 81541 Munich, for VPS hosting of the application, database and Keycloak, and STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, for domain/DNS and email services to the extent needed. No external document storage provider is commissioned. Additional or replacement subprocessors are announced at least thirty days before planned use, including service and processing location. The controller may object on substantiated data protection grounds. The new provider does not perform the affected processing until the objection is resolved; if no suitable alternative is agreed, the affected processing arrangement may end. Equivalent data protection duties are imposed on subprocessors; the processor remains responsible for their compliance.

Assistance and incidents

Within the agreed scope, the operator assists with data-subject rights, security, breaches, necessary impact assessments and authority consultations. Known breaches of data processed on your behalf are reported to you without undue delay with available details. Third-party requests are not independently answered without clarifying responsibility.

Return and deletion

At the end of processing, personal data is returned or deleted according to your lawful choice, including existing copies, unless statutory retention applies. The processor must document the return route, erasure procedure and backup cycles before production use and provides the information applicable to the arrangement on request. During necessary retention, data remains protected for its specific purpose and is not made available for active use. Verified erasures and account blocks must be reapplied after restoration from backups.

Evidence and audits

The operator supplies information needed to demonstrate duties and permits legally required audits within reasonable coordinated arrangements. Audits also protect other accounts, confidential infrastructure and credentials. Statutory audit rights are not categorically refused.

Processing locations and third-country transfers

The application, database and Keycloak run on the Contabo VPS in Frankfurt am Main, Germany. STRATO provides domain/DNS and email services; contractual processing locations depend on the booked STRATO service. Processing and transfers take place only within documented instructions. A transfer to a third country or international organisation requires a documented instruction or legal obligation and a lawful basis under GDPR Chapter V. On request, the processor provides information about applicable processing locations and any transfer safeguards.

Operator and controller

Denis Panic

Fuchshofstr. 45

71638 Ludwigsburg