Compliance
The obligations that apply to VerwaltKlar — and how we meet them.
Data protection, AI transparency and platform duties are a precondition for operating VerwaltKlar, not an afterthought. This page sets out the requirements we identified together with legal advice and how we implement them in the product and in the contracts.
Our commitment
No go-live without a completed review.
We implement the data protection, AI and platform duties on this page in full. The pilot only works with real data once that implementation has been legally reviewed and signed off. Compliance is a condition of starting, not something we defer.
Last reviewed: 18 August 2026
Data protection · GDPR
Roles, legal bases and data paths are settled before any real data.
Accountability, consent, retention and access are documented and visible in the product before any real tenant, owner or trade business data is processed.
- 01
Controller and processor
For every processing activity we define where the property manager is the controller and where VerwaltKlar acts as a processor. That determines instructions, information duties and who answers data-subject requests.
- 02
Data processing agreement
A DPA is signed with every property manager before the pilot, together with a current list of subprocessors stating purpose and processing location.
- 03
Consent at account creation
Everyone who creates an account — including tenants and owners — receives the required information at sign-up and gives the required consent. Consent is recorded traceably and can be withdrawn.
- 04
Free text as a data-protection risk
Free-form report text can contain details the case does not need. Input guidance, purpose limitation and minimisation are defined before real reports are processed.
- 05
Retention, deletion and anonymisation
For each data class we define what is stored, for how long, when it is deleted or anonymised, and which legal or technical exceptions apply. Pilot partners receive that schedule in writing before they start.
- 06
Internal access policy
An internal policy sets out which role may access which data, how access is logged, and how rights to access, rectification, export and deletion are handled.
AI use · AI Act
AI prepares. People decide.
AI use is disclosed, bounded and labelled. The basis is Google's published information on models, training and bias, together with our own product boundaries.
- 01
Disclosure wherever AI is involved
Every output a model contributed to is labelled as such in the product — in the guided dialogue, in structuring and in document extraction.
- 02
No automated decision
AI makes no decision with legal effect or cost consequence. Category, cost liability and commissioning are put to people and approved by people.
- 03
Contract analysis is not legal advice
Showing an applicable lease clause is information for review. It is labelled as such in the product and does not replace a legal assessment.
- 04
Disclose model and bias information
We name the models in use, their purpose and the provider's published statements on limits, bias and training, rather than making general quality promises.
- 05
Bounded free-text processing
Free input is used for understanding and structuring, not as a basis for decisions. Unclear results go to human review instead of continuing automatically.
- 06
Keep the record distinguishable
The case history keeps what was prepared distinguishable from what a person reviewed or approved. That record is the basis for traceability and liability questions.
Platform duties · DSA
Once trade businesses are reachable through the platform, platform duties apply.
As soon as property managers find and commission trade businesses through VerwaltKlar, duties under the Digital Services Act arise. They are part of launching, not something handled afterwards.
- 01
Traceability of traders
Before a trade business is listed, its identity and the required details are collected and checked in line with Article 30 DSA. Without those details there is no listing.
- 02
Service-provider due diligence
Beyond identity, we define and periodically re-check the steps for trade registration, insurance and any required evidence.
- 03
Report function for users
Users can report a trade business or a piece of content directly in the product. A report enters a traceable procedure, not a personal inbox.
- 04
Complaints handled as cases
Reports and complaints are handled as their own case with status, handling and outcome, so deadlines and responses can be evidenced.
- 05
Transparent recommendation criteria
Where the platform suggests trade businesses, the criteria are disclosed. Users are given a way to opt out of the recommendation and choose for themselves.
- 06
Provider-written service description
Trade businesses can describe their services in their own free-text field instead of being represented only through categories we define.
How this fits together
How this overview relates to the binding documents.
This page is the public summary of our obligations. They are settled bindingly in contracts, internal policies and the legal review before go-live.
- Accountability, instructions, subprocessors and evidence are settled bindingly in the data processing agreement with each property manager.
- The implementation is legally reviewed and signed off before go-live. Pilot partners receive the corresponding evidence on request.
- The privacy notice and the Impressum are published once the operating entity, its details and legal review are complete.
- Service-specific locations, providers and data paths are stated individually in the security overview.
Work through the compliance requirements together.
For a specific pilot we walk through accountability, consent, retention and platform duties together — with your data protection officer in the room if you want them there.