Data Processing Agreement

Last updated: 29 March 2026

Plain English: This DPA is for business customers who need to document how CaveLivre processes data on their behalf. Most individual users don't need to read this — the Privacy Policy covers personal use.

1. Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Controller") and Brendan Maguire operating CaveLivre ("Processor") and applies where you use CaveLivre to process personal data on behalf of your organisation.

2. Roles

For the purposes of GDPR and the Australian Privacy Act:

You are the Data Controller — you determine the purposes and means of processing.
We are the Data Processor — we process data only on your documented instructions.

3. Processing details

Item	Detail
Subject matter	Wine cellar management and tasting records
Duration	For the term of the subscription
Nature of processing	Storage, retrieval, display, AI-assisted analysis
Types of personal data	User names, email addresses, tasting notes, photos
Categories of data subjects	Your employees or members who use the app

4. Processor obligations

We will:

Process personal data only on your documented instructions
Ensure staff authorised to process data are bound by confidentiality
Implement appropriate technical and organisational security measures (see Security page)
Assist you in responding to data subject rights requests
Delete or return all personal data upon termination
Provide information necessary to demonstrate compliance

5. Sub-processors

We use the following sub-processors (see Privacy Policy §4 for details):

Hetzner Online GmbH — server hosting (Helsinki, EU)
Cloudflare, Inc. — network security (USA, SCCs)
Anthropic, PBC — AI features (USA, SCCs)
Resend Inc. — transactional email (USA, SCCs)

We will notify you of any intended changes to sub-processors with at least 14 days' notice.

6. International transfers

Data is stored in Helsinki, Finland (EU). Transfers to US-based sub-processors are governed by EU Standard Contractual Clauses. For Australian transfers, we comply with APP 8 (cross-border disclosure obligations).

7. Security incidents

We will notify you of any personal data breach without undue delay and within 72 hours of becoming aware of it, to enable you to meet your GDPR notification obligations.

8. Contact

To execute a signed DPA or for enterprise data processing enquiries: [email protected]