Last updated: 11 October 2026
This is a translation for convenience. The German version is legally binding.
1. Parties and conclusion
This agreement applies between the customer as controller and fdmedia GmbH, Altrottstr. 31, 69190 Walldorf, Germany, as processor (“we”). It is part of our terms of service (the “main contract”) and is concluded with them at registration. Organizations that registered before this agreement was published are offered it by email; for them it applies once the owner accepts it. We provide a signed copy on request at support@livetickr.io.
Terms such as “personal data”, “processing” or “personal data breach” have the meaning given to them by the General Data Protection Regulation (GDPR). Where it conflicts with the main contract, this agreement prevails on matters of personal data protection.
2. Subject matter, nature and purpose
We process personal data on the customer’s behalf to provide Livetickr to them under the main contract: the web application, the apps, the WordPress plugin and the delivery of their tickers to their readers. This includes storing, displaying and delivering the content, managing their team’s access, sending the application’s emails, the audience statistics of their tickers and protecting the services against misuse.
The processing lasts as long as the main contract, plus the time until deletion under section 10.
3. Types of data and data subjects
The customer’s team members
Name, email address, role in the organization and the workspaces, author profile details (such as profile picture, short bio and links to social networks), login data (password only as a hash, two-factor authentication, passkeys), the attribution of entries to their authors, and technical usage data such as times and IP addresses of access.
People in the content
Personal data the customer publishes or uploads in their tickers, such as names, quotes and pictures of people they report on. What exactly that is, the customer alone decides.
Readers of the tickers
When an embedded ticker is requested: IP address, browser identifier, requested address and time, for delivery and protection against attacks. For the audience statistics: a value formed from these details anew every day, used only so that a reader, their votes and reactions are not counted twice on the same day and to show how many people are reading right now, and deleted within two days at the latest. Also the country, and device type, browser and operating system in broad categories, time spent, clicks, reactions and votes. The statistics store neither IP addresses nor the full browser identifier, and the embed sets no cookies.
We process special categories of personal data under Art. 9 GDPR only if the customer includes them in their content.
4. Instructions
We process the data only on the customer’s documented instructions. The instructions are set out in the main contract and this agreement; the customer gives further ones by using and configuring Livetickr, for example by publishing or deleting content, or by email. If we consider an instruction unlawful, we tell the customer without delay. If a legal obligation requires us to process data otherwise, we inform the customer beforehand unless the law prohibits it.
5. Confidentiality
Everyone at our end with access to the data is bound to confidentiality or subject to a statutory duty of secrecy. They access data only as far as their task requires.
6. Security of processing
We take the technical and organisational measures under Art. 32 GDPR described in the annex. We may develop them further as long as the level of protection does not fall.
7. Subprocessors
The customer gives us general authorisation to use subprocessors. The current ones are listed on the subprocessors page. We conclude a contract with each that imposes at least the obligations of this agreement on them. We are liable to the customer for their acts as for our own.
We announce a new or replaced subprocessor to the owner of the organization by email at least four weeks in advance. The customer may object for an important reason relating to data protection. If we find no solution, they may terminate the main contract as of the date of the change; we refund the paid amount for the unused period pro rata.
We transfer data to countries outside the European Economic Area only where the requirements of Art. 44 et seq. GDPR are met, for example through an adequacy decision or the European Commission’s standard contractual clauses.
8. Assisting the customer
We assist the customer with appropriate measures in fulfilling data subjects’ rights (access, rectification, erasure, restriction, data portability, objection). The customer can do much of this themselves in Livetickr; otherwise we help on request. If a data subject contacts us with such a request, we refer them to the customer and inform the customer.
We also assist them with the security of processing, notifications to the supervisory authority and communications to data subjects, a data protection impact assessment and a prior consultation (Art. 32 to 36 GDPR), each with the information available to us.
9. Personal data breaches
If we become aware of a breach affecting the customer’s personal data, we inform the owner of the organization by email without undue delay, where possible within 48 hours. The notification includes, as far as known, the nature of the breach, the data and people concerned, the likely consequences and the measures taken. What is not known at first, we provide later.
10. End of processing
When the main contract ends, we return or delete the personal data, at the customer’s choice. If they want it returned, they tell us by email to support@livetickr.io before the contract ends or within 30 days after; we then provide their content, their team members’ data and their statistics in a common, machine-readable format and delete them afterwards. Otherwise we delete the data after these 30 days have passed, usually within a further 30 days. This does not apply where a legal obligation requires us to keep it. Backups are overwritten in their usual cycle.
11. Evidence and audits
On request, we provide the customer with the information they need to demonstrate compliance with this agreement. We allow audits, including inspections, after timely notice, usually four weeks, during business hours and without disrupting operations or the confidentiality of other customers. The customer may also appoint an auditor bound to confidentiality who is not a competitor of ours. We may charge a reasonable amount for on-site audits that were not prompted by a breach on our part.
12. Liability and final provisions
Liability is governed by Art. 82 GDPR and otherwise by the rules of the main contract. The law and place of jurisdiction of the main contract apply to this agreement. This agreement is available in German and English; the German version prevails. If we change it, section 18 of the main contract applies.
Annex: technical and organisational measures
Location and infrastructure
- The application and its database run in a data centre in Frankfurt am Main; uploaded images are stored in a storage region in Germany (see subprocessors).
- Our hosting providers’ data centres are physically secured against unauthorised entry.
Encryption
- All connections to the application, the API and the embed are encrypted with TLS.
- The connection between the application and its database is encrypted.
- We store passwords only as a hash.
Access
- Login with a password, optionally two-factor authentication and passkeys; confirmed email address; limits on repeated login attempts.
- Roles and permissions within an organization (owner, admins, members) and the assignment to workspaces determine who sees and changes which content.
- Different customers’ data is logically separated in the application.
- Only people at our end who need it for their task have access to the production systems, with personal accounts.
Protection against attacks and failures
- A web application firewall checks requests to the application for known attack patterns and limits excessive requests.
- Errors and failures are monitored; IP addresses are removed before transfer, for readers also the browser identifier and the referring page.
- The database is backed up regularly.
Data minimisation
- The embed sets no cookies. The audience statistics work with a value that changes daily instead of IP addresses, deleted within two days at the latest, and store devices, browsers and operating systems only in broad categories.
- By default, readers load embedded third-party content only after consenting; the customer can turn this off for their workspace.
- When images are uploaded, we remove embedded metadata such as location details.
Deletion and organisation
- Deleted content and images are also removed from storage; accounts are deleted on request.
- We select new subprocessors by their level of protection and conclude data processing agreements with them.