CuePutzData processing agreement (DPA)
Translation. This English text is provided for convenience. Only the German version is legally binding: Auftragsverarbeitungsvertrag (AVV).
Version of November 2026
This agreement under Art. 28 GDPR governs how Lumen Emotive processes the data customers enter in CuePutz. It is deemed agreed upon registration; the customer's name and address are taken from the registration.
§ 1 Parties and subject matter
Between the customer (company as registered) ("Controller") and Takudzwa Gilbert Musesani, Lumen Emotive, Frauenstraße 33, 89073 Ulm, Germany ("Processor").
The Processor provides the Controller with the CuePutz software (contract: the CuePutz terms in the version agreed, "Main Contract"). In doing so, the Processor processes personal data on behalf of the Controller. This agreement applies to all such processing and takes precedence over the Main Contract in case of conflict.
This agreement is concluded with the Main Contract, including by confirmation during registration or by email.
§ 2 Nature, purpose and duration of processing
Purpose: scheduling, assigning, carrying out and checking cleans between guest stays in the Controller's holiday flats.
Nature: storing, displaying, transmitting (notifications, emails), syncing with booking calendars (iCal), deleting.
| Data subjects | Categories of data |
|---|---|
| Cleaners and staff of the Controller | Name, email, phone (optional), language, role, login data, assigned cleans, start and finish times, ticked checklist items, photos of the flat, reported damage, door-code access log, devices for push notifications, app error reports |
| Guests of the Controller | Stay periods and booking titles from the calendars (Airbnb, Booking.com); no names or contact details unless the calendars themselves contain them |
| Contact persons of the Controller | Name, email, phone |
No special categories of data under Art. 9 GDPR are processed. Photos should show only the flat; the Controller instructs its cleaners accordingly.
Duration: for the term of the Main Contract. Proof photos are deleted automatically after the period set by the Controller (default 90 days after the clean is approved).
§ 3 Obligations of the Processor
The Processor:
- processes the data only on documented instructions from the Controller (§ 4), including with regard to transfers to third countries, unless required to do so by law; in that case it informs the Controller beforehand where permitted;
- does not use the data for its own purposes, in particular not for advertising, profiling or training AI models;
- commits all persons with access to confidentiality;
- takes the technical and organisational measures under Art. 32 GDPR (Annex, § 6) and keeps them up to date;
- uses sub-processors only in accordance with § 5;
- assists the Controller with data subject requests (access, rectification, erasure, etc.) and with the obligations under Art. 32 to 36 GDPR;
- deletes or returns the data after the end of the contract (§ 7);
- provides all information needed to demonstrate these obligations and allows audits (§ 7).
The Processor has not appointed a data protection officer, as it is not required to. Contact for data protection: info@cueputz.de.
§ 4 Instructions, Controller's obligations, data breaches
Instructions: the instructions follow from this agreement, the Main Contract and the use of the software (e.g. creating, changing or deleting data). The Controller gives further instructions in text form to info@cueputz.de. If the Processor considers an instruction unlawful, it says so without delay and may suspend it until clarified.
Controller: the Controller is responsible for the lawfulness of the processing, in particular for informing its cleaners about the processing (Art. 13 GDPR). CuePutz provides a privacy notice in the app that the Controller may use for this.
Data breaches: the Processor notifies the Controller of any personal data breach without undue delay, at the latest within 48 hours of becoming aware of it, with the information under Art. 33(3) GDPR as far as known. It immediately takes measures to limit the damage.
§ 5 Sub-processors
The Controller agrees to the use of these sub-processors:
| Provider | Service | Data | Location | Basis for third country |
|---|---|---|---|---|
| Supabase Inc. | Database, sign-in, file storage (photos), server functions | All data under § 2 | Servers in Frankfurt (EU) | EU Standard Contractual Clauses (Supabase DPA) |
| Netlify, Inc. | Delivering the app (website) | IP addresses, technical access data | USA / global CDN | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Plus Five Five, Inc. ("Resend") | Sending invitation and sign-in emails | Name, email address | USA | Standard Contractual Clauses |
| GitHub, Inc. | Storing the weekly, encrypted database backups | All data under § 2 except photos, encrypted only (GitHub cannot read it) | USA | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Heinlein Hosting GmbH (mailbox.org), Berlin | Email inbox for support requests | Content of the Controller's emails | Germany | – |
Push notifications are delivered through the push service of the respective device (Apple, Google, Mozilla). The content is end-to-end encrypted; these services see only the device address.
Changes: the Processor informs the Controller by email at least 30 days in advance of new or replaced sub-processors. The Controller may object on important data protection grounds; if no agreement is reached, it may terminate the Main Contract as of the date of the change. The Processor contractually binds every sub-processor to the same level of protection.
§ 6 Technical and organisational measures (Annex)
| Area | Measure in CuePutz |
|---|---|
| Separation of customers | Every record belongs to exactly one company; the database only allows access to the own company's data (Row Level Security). Automated tests check this with every change (125 checks). |
| Access control | Sign-in with a personal account; accounts with admin rights only with two-factor sign-in; passwords at least 10 characters, known breached passwords are rejected. |
| Authorisation control | Roles: cleaners see only their own cleans; door codes only on the day of the clean, every access is logged. The platform operator sees no customer data in the app. |
| Encryption | All connections via HTTPS/TLS; calendar links stored encrypted (Vault); push content end-to-end encrypted. |
| Availability | Weekly, encrypted database backup, kept for 90 days; the key is held only by the Provider, not by GitHub. In addition, a backup before every change to the database structure. |
| Data minimisation | Photos deleted automatically after the period chosen by the customer; error reports after 90 days; registration requests after 180 days. |
| Resilience | Rate limits (e.g. registrations per hour); error reports with notification. |
| Organisation | Access to server credentials only by the owner; commitment to confidentiality for future staff. |
§ 7 Audits, deletion, liability, final provisions
Audits: the Controller may check compliance with this agreement, primarily through information and documents. On-site audits after notice of at least 14 days, during business hours, at most once a year, unless there is a specific reason. Each party bears its own costs of the audit.
Deletion and return: after the end of the contract, the Processor provides the Controller on request with an export of its data within 30 days (CSV/JSON, photos as files). It then deletes all data, at the latest 30 days after the end of the contract. Backup copies are deleted as they expire, at the latest after 90 days. Statutory retention obligations (e.g. invoices) remain unaffected.
Liability: Art. 82 GDPR applies. Otherwise, the liability rules of the Main Contract apply.
Final provisions: changes must be made in text form. If a provision is invalid, the rest remains valid. German law applies; the place of jurisdiction is Ulm, Germany, where legally permissible.