LEGAL
Data Processing Agreement
English convenience translation of Lizio’s data processing agreement
This Data Processing Agreement (the “DPA”) forms part of and supplements the Lizio Terms of Service (the “Terms”) between Lizio Rolli, Seestrasse 137B, 8800 Thalwil, Switzerland (“Lizio”) and the Customer. Terms defined in the Terms have the same meaning here. Where this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
This DPA is accepted together with the Terms and requires no separate signature. Where a Customer requires a countersigned copy, it may request one at contact@lizio.io.
1. Roles of the parties
For personal data contained in Customer Data, the Customer acts as controller and Lizio acts as processor.
Lizio acts as an independent controller for account registration, authentication, billing administration, security, support, website operation, service communications, marketing preferences and its legal and business records. This DPA does not govern that processing, which is described in the Privacy Notice.
The Customer is responsible for ensuring that its processing has a valid legal basis, that required notices have been given to the individuals concerned, and that its instructions to Lizio comply with applicable data protection law.
2. Applicable law
“Applicable Data Protection Law” means Regulation (EU) 2016/679 (the “GDPR”), the Swiss Federal Act on Data Protection (“FADP”), the UK GDPR where relevant, and any other data protection law applicable to a party’s processing under this DPA.
3. Scope of processing
Lizio processes personal data only on the Customer’s documented instructions, including as to international transfers, unless required to do otherwise by law to which Lizio is subject. Where such a legal requirement applies, Lizio will inform the Customer before processing unless that law prohibits it.
The Terms, this DPA, the configuration of the Service and the Customer’s use of the Service through its ordinary functions together constitute the Customer’s documented instructions.
If Lizio considers that an instruction infringes Applicable Data Protection Law, it will inform the Customer without undue delay.
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
4. Confidentiality
Lizio ensures that persons authorised to process personal data under this DPA are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and that access is limited to what each person needs to perform the Service.
5. Security
Lizio implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing.
The measures in place at the effective date of this DPA are described in Annex 2. Lizio may update those measures over time provided the level of security is not reduced.
The Customer is responsible for the security of its own accounts, including credential hygiene, role assignment within its Organization, and the accuracy of reminder recipients it configures.
6. Sub-processors
The Customer gives Lizio general written authorisation to engage sub-processors. The sub-processors engaged at the effective date of this DPA are listed in Annex 3.
Lizio imposes on each sub-processor data protection obligations materially equivalent to those in this DPA, and remains fully liable to the Customer for the performance of that sub-processor’s obligations.
Lizio will give the Customer at least thirty (30) days’ notice before adding or replacing a sub-processor, by email to the Organization Owner or by updating Annex 3 with a dated notice. The Customer may object on reasonable data protection grounds within fifteen (15) days of that notice. The parties will discuss the objection in good faith; if no resolution is reached, the Customer may terminate the affected Subscription without penalty, with a pro-rata refund of any prepaid unused fees.
Lizio may replace a sub-processor with shorter notice, or without prior notice, where required to address an urgent security risk, a provider failure or a legal requirement. Lizio will inform the Customer as soon as reasonably practicable.
7. International transfers
Lizio is established in Switzerland. Switzerland benefits from a European Commission adequacy decision, so transfers of personal data from the EEA to Lizio require no additional safeguard.
Sub-processors may process personal data in Switzerland, the European Economic Area, the United Kingdom, the United States or other countries identified in Annex 3.
Where personal data is transferred to a country that does not benefit from an adequacy decision, Lizio ensures an appropriate transfer mechanism is in place. Depending on the recipient, this may be an adequacy decision, a recognised certification framework, the European Commission’s Standard Contractual Clauses (adapted for Swiss law where appropriate), or another lawful transfer mechanism, together with any supplementary technical and contractual measures required.
Information about the safeguards applying to a specific sub-processor may be requested at contact@lizio.io, subject to the protection of confidential and security-sensitive information.
8. Assistance with data subject rights
Taking into account the nature of the processing, Lizio assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests to exercise data subject rights.
The Service provides functions allowing the Customer to access, correct, export and delete personal data within its Organization. Where a request cannot be satisfied through those functions, Lizio provides reasonable additional assistance.
If Lizio receives a request directly from a data subject relating to Customer Data, it will not respond to the substance of the request but will refer the data subject to the Customer and inform the Customer without undue delay.
9. Personal data breaches
Lizio notifies the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Customer Data.
The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information is not all available at once, it may be provided in phases without further undue delay.
Lizio assists the Customer in meeting its own notification obligations to supervisory authorities and data subjects.
Notification of a breach is not an acknowledgement of fault or liability.
10. Data protection impact assessments
Taking into account the nature of processing and the information available to it, Lizio provides reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities under Articles 35 and 36 GDPR.
11. Deletion and return
The Customer may export Customer Data through the Service at any time during the Subscription.
On termination or expiry, Lizio deletes or returns Customer Data in accordance with the retention rules in the Terms and the Privacy Notice. In summary:
Where Organization deletion is requested, a 30-day scheduled-deletion period applies. After that period the Organization becomes inaccessible and Customer Data is removed from active systems, subject to a limited additional period for periodic manual review.
Where no deletion is requested, dormant Organization Data may be retained for up to twelve (12) months after paid access ends to permit reactivation or an authorised export, and may then be permanently deleted.
Restricted safety copies and ordinary backups persist until they expire through their normal retention cycle and are not used for ordinary business purposes.
Lizio may retain personal data where and for as long as required by law. In particular, minimised reminder-delivery, configuration, audit and security metadata may be retained for up to five (5) years after the relevant event where reasonably needed to address disputes, demonstrate actions taken or defend legal claims; deletion-audit records may be retained for up to five (5) years after completion of deletion; and accounting, payment and tax records are retained for the period required by law, generally up to ten (10) years under Swiss rules. A legal hold or active proceeding may require longer retention.
12. Audits and information
Lizio makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.
The Customer will normally satisfy this right by requesting documentation, security descriptions and answers to a reasonable questionnaire. An on-site inspection requires at least thirty (30) days’ written notice, may take place no more than once in any twelve-month period except following a personal data breach or a supervisory authority requirement, must occur during business hours, must not unreasonably disrupt the Service, and is subject to confidentiality obligations. The auditor must not be a competitor of Lizio.
The Customer bears its own costs and Lizio’s reasonable costs for any on-site inspection.
13. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms, to the extent permitted by Applicable Data Protection Law. Nothing in this DPA limits a data subject’s rights.
14. Term
This DPA takes effect when the Customer accepts the Terms and continues for as long as Lizio processes personal data on the Customer’s behalf. Clauses that by their nature should survive do so.
15. Changes to this DPA
Lizio may update this DPA where required by law, by a supervisory authority, or to reflect changes to the Service, provided the change does not materially reduce the Customer’s protections. Material changes will be notified in accordance with the change process in the Terms. The current version and its effective date are published at lizio.io/dpa.
16. Governing law and jurisdiction
This DPA is governed by the substantive laws of Switzerland, without regard to conflict-of-laws rules. The courts at Lizio’s registered seat have exclusive jurisdiction, subject to any jurisdiction that cannot validly be excluded under mandatory law.
17. Language
This DPA is drafted and issued primarily in French, which is the governing language. Translations, including this English version, are provided for convenience only and have no independent legal effect. In case of any conflict, ambiguity or divergence between a translation and the French version, the French version prevails.
Annex 1 — Details of the processing
Subject matter. Provision of the Lizio lease portfolio management service as described in the Terms.
Duration. The term of the Subscription, plus the retention periods described in clause 11.
Nature and purpose. Hosting, storage, organisation, retrieval, display, export and deletion of Customer Data; user authentication and access control; generation and delivery of deadline reminders; document storage and retrieval; reporting and analysis within the Customer’s Organization; provision of support.
Categories of data subjects
The Customer’s users of the Service (Owners, Admins, members)
Individuals named in lease records, including tenant and landlord representatives, signatories and contacts
Individuals named in documents uploaded by the Customer
Recipients of reminders configured by the Customer
Types of personal data
Account and identity data: name, business email address, password credentials in protected form, account identifiers, role within the Organization, language preference, authentication information
Customer Data: property and counterparty information, contract dates and clauses, reminder settings, contact details, uploaded files, notes and exports, and any other personal data the Customer chooses to enter in lease, location, action and reminder records
Document content: any personal data contained in files the Customer uploads
Reminder and communication data: recipients, delivery addresses, reminder configuration, sending attempts, provider responses, delivery status and related audit metadata
Technical and security data: IP address, device and browser information, session and authentication events, timestamps, diagnostic logs and security alerts
Sensitive data. The Service is not designed for and does not require health, biometric or other special categories of personal data under Article 9 GDPR, or data relating to criminal convictions and offences. Where a Customer chooses to submit such data, the Customer is responsible for determining that the submission is necessary, lawful and appropriately protected.
Annex 2 — Technical and organisational measures
Access control
Row-level security enforced at the database layer so that each Organization’s data is isolated
Role-based access control within each Organization
Lizio operates as a single-operator business; access to production systems is limited to the operator
Storage and transmission
Encryption in transit using TLS
Encryption at rest for the database and file storage
Uploaded documents and location images served through short-lived signed URLs rather than public links
Application security
Content Security Policy enforced
Automated bot and abuse protection on authentication and contact endpoints
Server-side enforcement of plan limits and billing state
Availability and resilience
Managed database backups
Hosting on managed infrastructure with provider-level redundancy
Data location
Primary database, authentication and file storage hosted in the European Union (AWS eu-west-1, Ireland)
Organisational
Any person or contractor granted access in future is bound by written confidentiality obligations before access is given
Audit trails for reminder delivery and deletion events
Automated database security advisory checks run after every change affecting views, access policies or database functions
Schema, access-policy and server-function changes are applied and verified on a separate development project before reaching production
Development and production run as fully separate database projects with separate credentials
Annex 3 — Sub-processors
Supabase Pte. Ltd.
Database, authentication, file storage
European Union (AWS eu-west-1, Ireland)
Vercel Inc.
Application hosting and delivery
European Union (Paris, eu-west-3)
AhaSend B.V.
Transactional email delivery
Netherlands
Cloudflare, Inc.
Bot protection (Turnstile)
Global edge network
AI-assisted features. The Terms and Privacy Notice describe optional AI-assisted extraction from lease documents. That feature is not active and no AI provider is engaged as a sub-processor. No Customer Data is transmitted to any AI provider. If the feature is activated, the provider will be added to this Annex and notified in accordance with clause 6 before any Customer Data is processed by it.
Not sub-processors. Stripe acts as an independent controller for payment processing and is not engaged by Lizio as a sub-processor. Its processing is described in its own privacy documentation.
The current list is published at lizio.io/dpa. Customers may subscribe to change notifications by writing to contact@lizio.io.
Document details
Provider: Lizio Rolli, Swiss sole proprietorship
Address: Seestrasse 137B, 8800 Thalwil, Switzerland
Data protection contact: contact@lizio.io
Version: 1.0
Effective date: 1 September 2026
Covered services: www.lizio.io and app.lizio.io