The Data Processing Agreement under Art. 28 GDPR defines how we process data on your behalf as processor. You can access the current version in your account at any time.
For livestep usage, a RoPA entry for market and competitor analysis plus target-group and persona development is typically appropriate if you use these functions. Adapt wording and detail level to your company and data categories.
Data subjects assert their rights towards you as controller. Where a request concerns data stored on our platform, we support you in providing structured information or implementing deletions technically, within contractual scope and your instructions.
The legal basis depends on your specific use case - not on technology alone. The most common cases under Art. 6(1) GDPR are:
After account cancellation, your data is deleted completely and irrevocably within 30 days. You receive confirmation in advance.
Yes. livestep uses subservice providers, especially AWS for hosting and infrastructure and AI providers for model processing - all within the EU. A current list of subprocessors is documented in the DPA.
A DPIA is usually required when highly sensitive data is processed or systematic profiling occurs. For typical livestep use - market analysis and anonymized target-group development - a DPIA is usually not required. We recommend an individual review by your data protection officer.