Lab Manager Pro
EN/DE

Data Processing Agreement (AVV)

Last Updated: October 30, 2026

1. Purpose and Scope

This Data Processing Agreement / Auftragsverarbeitungsvertrag ("DPA" / "AVV") forms part of the Terms of Service (AGB) between the provider of Lab Manager Pro identified in the Impressum ("Processor") and the customer organization ("Controller" / "Customer"). It implements Art. 28 GDPR (DSGVO) and applicable German law (including BDSG) for processing of personal data in Customer Content.

Account, billing, and marketing data that we process as an independent controller are described in our Privacy Policy and fall outside the processor scope of this AVV.

2. Roles of the Parties

  • Customer is the controller (or a processor acting for its own controllers) of Customer Content uploaded to the workspace.
  • Lab Manager Pro is the processor and processes that data only on documented instructions to provide, secure, support, and improve the Service.

3. Details of Processing (Art. 28(3) GDPR)

  • Subject matter: Hosting and operating a multi-tenant lab operations platform
  • Duration: Term of the subscription plus deletion/backup wind-down and mandatory retention
  • Nature and purpose: Storage, retrieval, transmission, display, backup, logging, and support access
  • Types of personal data: Names, emails, phone numbers, roles, client organization details, and any other personal data Customer elects to upload
  • Data subjects: Customer staff/contractors; Customer's clients and contacts; other individuals whose data Customer stores

4. Instructions

Customer instructs us to process personal data as necessary to provide the Service. We will inform Customer without undue delay if an instruction appears to infringe the GDPR or other Union or Member State data protection provisions, unless law prohibits such notice.

5. Confidentiality

Persons authorized to process personal data are bound to confidentiality (Art. 28(3)(b) GDPR) and receive access only as needed.

6. Security (Art. 32 GDPR / TOMs)

  • Encryption in transit (TLS)
  • Multi-tenant isolation (including PostgreSQL RLS) and role-based access
  • Authentication via Supabase Auth
  • Access controls, audit logging, and secure development practices
  • Infrastructure providers listed as subprocessors

7. Subprocessors (Art. 28(2)–(4) GDPR)

Customer provides general authorization to engage subprocessors. The current list is at Subprocessors. We impose contractual data-protection obligations on subprocessors no less protective in material respects than this AVV.

8. International Transfers (Chapter V GDPR)

Transfers to third countries rely on SCCs, adequacy decisions, or other lawful mechanisms used by our providers. Customer remains responsible for its own lawful basis to upload personal data into the Service.

9. Assistance

Taking into account the nature of processing, we assist Customer — via product features and reasonable support — with data subject requests, security, breach notification, DPIAs, and prior consultation, insofar as feasible for a multi-tenant SaaS.

10. Personal Data Breaches

After becoming aware of a personal data breach affecting Customer Content, we notify Customer without undue delay. Notification is not an admission of fault.

11. Return and Deletion

During the subscription, Customer may export available data. After termination or written request, we delete or return Customer Content within a commercially reasonable period, except backups until rotated and data we must retain by law.

12. Audits (Art. 28(3)(h) GDPR)

Upon reasonable written request (generally at most once per year, or after a material breach / supervisory request), we provide information reasonably necessary to demonstrate compliance. On-site audits of multi-tenant infrastructure require mutual agreement on scope, timing, confidentiality, and cost.

13. Liability and Governing Law

Liability under this AVV follows the Terms (AGB), without limiting mandatory liability under the GDPR. This AVV is governed by the laws of the Federal Republic of Germany.

14. Precedence

For processor personal-data matters, this AVV prevails over the Terms. For all other matters, the Terms prevail.

15. Contact

AVV / privacy inquiries: contact@labmanagerpro.com. Signed PDF versions available on request for enterprise customers.