The agreement for personal data

Version 2026-11-12, effective 2026-11-12. A signed order form or agreement prevails where it differs. Questions: [email protected].

1. Parties and scope

This addendum is part of the agreement between the customer ("you", the controller) and REALTY.TM GROUP sp. z o.o., ul. Bpa Albina Małysiaka 26/15, 30-389 Kraków, Poland ("Outlevo", the processor). The agreement is the terms, the terms for pay per meeting or a signed order form. It applies from the day you accept them, to all personal data Outlevo processes for you to provide the service ("customer data"), under the GDPR, the UK GDPR, the Swiss FADP, the California Consumer Privacy Act as amended (CCPA) and the other privacy laws that apply to it.

It does not cover what Outlevo does as a controller for its own purposes (accounts, billing, sign-in, support, and visitors to outlevo.com). Roles says which is which. If you use Outlevo for your own clients (an agency), you are a processor for them, Outlevo is your subprocessor, and you confirm that you may give these instructions. The terms of this addendum then apply between you and Outlevo as processor and subprocessor.

2. What is processed, and for how long

The subject matter, nature, purpose, kinds of data and people, and duration are in Annex I. Outlevo processes customer data until the agreement ends and then until it is deleted as section 9 says.

3. Instructions

Outlevo processes customer data only on your documented instructions: this addendum, the agreement, and what you set in the service (the policies you approve, the campaigns you start, the integrations you connect). Outlevo tells you if it believes an instruction breaks the law, and may pause it until you confirm. Outlevo may also process where the law requires it, and then tells you first unless the law forbids that.

4. People and confidentiality

Outlevo lets only the people who need customer data to run the service reach it, and each is bound by a duty of confidentiality. Staff access to your data is time-limited and shown in your activity feed.

5. Security

Outlevo applies the technical and organisational measures in Annex II, and may change them as long as the protection does not fall.

6. Subprocessors

You give Outlevo a general authorisation to use the subprocessors in Annex III. Outlevo has a written contract with each that carries the same data protection duties as this addendum, and stays responsible for them.

We publish the subprocessor list on this page, and the changes already announced under Upcoming changes. We email the workspace owner at least 30 days before a new subprocessor starts processing customer personal data, with a link to object. The owner may object within 14 days on reasonable data protection grounds. If we cannot resolve it, the owner may stop using the affected service or close the workspace.

7. Help with your own duties

Outlevo helps you answer requests from the people concerned: a request that reaches Outlevo about customer data is passed to you without undue delay, or handled as the data protection page says when the person writes to Outlevo directly, and the person is told it is handled for the controller. Outlevo also helps you, with what it holds, with security duties, data protection impact assessments and consulting a supervisory authority.

8. Personal data breach

If we become aware of a personal data breach affecting your data, we tell the workspace owner by email without undue delay and in any case within 72 hours, with what we know: what happened, the data concerned, the likely consequences, the measures taken and who to contact. We send updates by email as we learn more.

9. Return and deletion

Before you close a workspace you can export your accounts, contacts and leads. When you close it you can ask, in the app, for its personal data to be deleted; after it is closed you can ask in writing, from the workspace owner's address. We delete it within 30 days of the request, after a wait of up to 7 days in which the owner can cancel. We keep what the law requires: invoices and billing records, the one-way hashes on the suppression list, and the log of who approved and changed what. Without a request it is not deleted on a timer. Deleted records can remain in database backups held by Supabase until they expire there under Supabase's own schedule.

Closing a workspace stops all sending and disconnects its integrations, but its data stays until deletion is requested. On a deletion or objection request, we delete the records we hold for that address and keep only a one-way hash of the address on a suppression list, so the person is never contacted again.

10. Audits

We answer reasonable security questionnaires. Once a year, or after a personal data breach, you may audit the measures that protect your data: with 30 days' notice, in business hours, under confidentiality, limited to your data and at your cost, remotely where that is enough. We hold no third-party audit report today.

11. International transfers

Outlevo's own servers are in Frankfurt, Germany and its database is in Ireland. Annex III shows where each subprocessor processes data. Some vendors below process data outside the EEA, the UK and Switzerland, mostly in the United States. For each of them we rely on the vendor's own transfer terms (the EU-US Data Privacy Framework where it is certified, otherwise the EU standard contractual clauses with the UK and Swiss additions). Between you and us, the data processing addendum sets out the transfer terms.

Outlevo is established in the European Union, so data that reaches it from within the EEA needs no transfer mechanism. The standard contractual clauses below apply to the extent a transfer needs them, for example where you are outside the EEA, the UK and Switzerland and your processing is covered by those laws, and for the chain of subprocessors.

12. EU standard contractual clauses

The standard contractual clauses of Commission Implementing Decision (EU) 2021/914 are incorporated by reference. Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor for your own clients. You are the "data exporter" and Outlevo is the "data importer". The choices the clauses leave open are:

Where the clauses and this addendum differ, the clauses win. Liability between the parties is limited as the terms say, except where the clauses or the law do not allow it, and the rights of the people concerned under clause 12 stay whole.

13. UK addendum

For a transfer that is subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) is incorporated by reference. Table 1: the parties and their details are in Annex I. Table 2: the Approved EU SCCs are those in section 12, modules two and three, with the docking clause, option 2 for subprocessors and a 30-day notice, and without the optional clause 11 wording. Table 3: the annexes are Annex I, II and III below. Table 4: the exporter may end the addendum as its section 19 provides; the importer may not. The law is that of England and Wales, and its courts hear disputes about the addendum.

14. Switzerland

For a transfer that is subject to the Swiss Federal Act on Data Protection, the clauses in section 12 apply as the Swiss Federal Data Protection and Information Commissioner (FDPIC) has said they may, with these changes: references to the GDPR mean the FADP, to a Member State and the EU mean Switzerland, and to the supervisory authority the FDPIC; people in Switzerland may sue in the courts of Switzerland under clause 18(c); and where the FADP alone applies, clause 17 is Swiss law and clause 18(b) the courts of Switzerland.

15. California and other US state laws

For personal information that the CCPA covers, Outlevo is your service provider. It processes that information only to provide the service as the agreement describes (the business purpose in Annex I); it does not sell it or share it for cross-context behavioural advertising; it does not keep, use or disclose it outside its direct business relationship with you or for any other purpose; and it does not combine it with personal information it gets elsewhere, except as the law allows for the service. Outlevo gives the same level of privacy protection the CCPA requires, tells you if it can no longer meet its duties, and lets you take reasonable steps to confirm its use is consistent with yours and to stop and fix an unauthorised use. A subcontractor is bound in writing by the same terms. The same terms apply to the privacy laws of other US states that call for service-provider or processor terms. Outlevo does not receive customer data as payment for the service.

16. Order, changes and contact

If they differ, the standard contractual clauses win over this addendum, and this addendum over the rest of the agreement. Outlevo may change this addendum as the terms allow for changes, and a change that lowers the protection of customer data needs your written consent. A countersigned copy: write to [email protected]. A security matter: [email protected].