Data Processing Agreement

1. Roles and scope

When you copy us on a quote you send, or the customer replies to one, the personal data in that correspondence is yours: you decide why and how it is processed. Under the GDPR you are the controller and we are the processor. The same applies to enquiries that reach us from the widget or a connected channel.

This Agreement covers only that processing. Data about your own account and your teammates, which we process for our own purposes, is covered by our Privacy Policy, where we act as controller instead.

2. Correspondence in your name

You instruct us to correspond with your customers in your name. That instruction is limited to what you switch on, and to the following:

• we write only about a quote you sent us, only to the address you sent it to, and only inside the thread that quote already belongs to;
• the schedule and the tone are the ones you approved when your workspace was set up, and you may change or stop them at any time;
• in Review mode nothing is sent until you approve it. In Auto mode messages go out without prior approval and you receive a copy of each one;
• we do not negotiate, agree a price, vary the scope of the work, or give advice that requires a trade qualification. Anything of that kind is passed to you and we stop writing;
• we stop immediately if you write in the thread yourself, if the quote is accepted or withdrawn, or if the recipient asks not to be contacted again.

3. Subject matter, duration, nature and purpose

Nature and subject matter: receiving the quotes you copy to us, reading the job description, amount and dates out of them, scheduling and sending follow-up messages in your name, answering a recipient’s questions from the knowledge base you provide, and recording the outcome and — where the recipient gives one — the reason a quote was declined. Where you use the shared inbox, it also covers hosting, storage, transmission and display of conversations and contact records, delivery of notifications, and — only where you switch them on — AI reply suggestions, autonomous replies and knowledge-base indexing.

Purpose: providing the Lavenity service to you under the Terms of Service, and nothing else. We do not sell personal data, and we do not use the content of your quotes or conversations to train models of our own.

Duration: for as long as your workspace exists, plus the period described in section 10.

4. Categories of data and data subjects

Data subjects are the customers you quote and correspond with, the visitors who contact you, and the teammates who use your workspace. The personal data covers:

• identifiers and contact details — name, email address, phone number where given, and identifiers from connected channels;
• quote and job details — the description of the work, the amount, the dates, and the address of the property where the work is to be done;
• correspondence content — the quote you sent, the messages sent in your name, the recipient’s replies, attachments and internal notes;
• outcome data — whether a quote was accepted or declined, and the reason given for declining;
• technical data — IP address, browser and device information, page URL and timestamps;
• any other personal data you choose to send us by copying us on an email, or through the widget, the API or a connected channel.

5. Our obligations

As your processor we undertake that:

• we process personal data only on your documented instructions — the Terms of Service, this Agreement and the settings you choose in the product together constitute those instructions. If a law requires us to process otherwise, we will tell you before doing so unless that law forbids it;
• everyone we allow to access the data is bound by an obligation of confidentiality;
• we maintain the technical and organisational measures required by Article 32 GDPR — encryption in transit, access control, isolation of the widget, signed tokens and rate limiting;
• we keep a record of every message sent in your name and make it available to you;
• we will tell you if, in our opinion, an instruction from you infringes data protection law.

6. Sub-processors

You give general authorisation for us to engage the sub-processors listed below. Each is bound by data protection obligations no less protective than those in this Agreement, and we remain fully liable to you for their performance.

We will give you notice before adding or replacing a sub-processor. You may object on reasonable data-protection grounds, and if we cannot resolve the objection you may stop using the affected part of the service and terminate it.

• Hetzner Online GmbH (Germany) — hosting, databases and file storage.
• Supabase — authentication of your teammates’ accounts.
• OpenAI — drafting the follow-up messages sent in your name, answering recipients’ questions from your knowledge base, AI reply suggestions and knowledge-base indexing. Engaged only for workspaces that switch AI features on; content sent through its API is not used to train its models.
• Purelymail — delivery of the follow-up messages we send in your name, and of notification and invitation emails.
• Paddle — payment, invoicing and refunds for your subscription. Paddle receives billing data only, never quote or conversation content.

7. International transfers

Hosting, databases and file storage are located in the European Union.

We are established in Ukraine, for which the European Commission has not adopted an adequacy decision, and some sub-processors operate outside the EEA. Those transfers are covered by the European Commission’s Standard Contractual Clauses together with encryption in transit and at rest.

8. Assisting you with data subject rights

If a data subject asks you for access, rectification, erasure, restriction, objection or portability, we will assist you in answering, taking into account the nature of the processing and the information available to us. Write to privacy@lavenity.com and we will act without undue delay and in any case in time for your own one-month deadline.

The product does not currently expose self-service export or erasure of quotes, conversations and contacts, so these requests are carried out by us on your written instruction.

If a data subject approaches us directly about data we hold on your behalf, we will not answer for you — we will tell them to contact you and let you know.

9. Personal data breaches

If we become aware of a personal data breach affecting personal data we process for you, we will notify you without undue delay and in any event within 48 hours of becoming aware. The notice will describe what happened, the categories and approximate number of records concerned, the likely consequences and the measures taken, so that you can meet your own duties under Articles 33 and 34 GDPR.

10. Deletion and return of data

You may instruct us at any time to delete or return the personal data we process for you, and we will do so within 30 days of the request.

When your workspace is closed we delete that personal data within 30 days, except where a law requires us to keep it — billing and tax records being the usual case. Before deletion, and on request, we will return the data in a structured, commonly used, machine-readable format.

Deleted data may persist in encrypted backups until those backups are rotated out of use. We do not restore deleted data from a backup except to recover from an incident.

11. Audits, precedence and changes

On reasonable written request — no more than once a year, unless a supervisory authority requires otherwise or a breach has occurred — we will provide the information needed to demonstrate compliance with Article 28 GDPR, and where that is insufficient we will allow an audit by you or an independent auditor bound by confidentiality, arranged so as not to disrupt the service.

Where this Agreement and the Terms of Service conflict on the processing of personal data on your behalf, this Agreement prevails. We may update it and will give advance notice of material changes; the current version is always on this page.

The English version of this Agreement governs. Translations on the other language editions of this site are provided for convenience only.

Contact

Privacy questions: privacy@lavenity.com

Billing and support: support@lavenity.com