DPA

Data Processing Addendum

Last updated: April 26, 2026

This Data Processing Addendum ("DPA") supplements the Terms of Service between 3Dview.art, based in Brooklyn, NY (the "Processor") and the Customer (the "Controller") when the Customer's use of the Service involves processing personal data subject to the EU General Data Protection Regulation, the UK GDPR, or comparable laws.

1. Roles

Customer is the data controller for personal data submitted to the Service. 3Dview.artprocesses that data only on Customer's documented instructions.

2. Subject matter & duration

Subject matter: hosting, viewing, annotating, and reviewing 3D product files. Duration: the term of the underlying Terms of Service plus any post-termination retention required by law.

3. Categories of data subjects

  • Customer's personnel and invited collaborators.
  • Any other individuals identified in Customer's 3D model metadata or comments (e.g. names referenced in annotations).

4. Categories of personal data

  • Identifiers: name, email, profile picture URL, user IDs.
  • Workspace-related: role, audit log entries, comment text, mention references.
  • Operational: IP address, user-agent, device type (in server logs).

5. Subprocessors

Customer authorises us to engage the subprocessors listed at /subprocessors. We will give 30 days' notice before adding a new subprocessor; Customer may object on reasonable grounds within that window.

6. Security

We implement and maintain appropriate technical and organisational measures, including encryption in transit and at rest, role-based access control, Postgres Row-Level Security, signed authenticated download URLs, audit logging, and a documented vulnerability disclosure process.

7. Data subject requests

We will assist Customer in responding to data-subject requests. Customer can fulfil most requests directly through the in-product Settings UI (export, delete, correct).

8. Personal data breach

We will notify Customer without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting Customer Personal Data.

9. International transfers

Where personal data is transferred outside the EU/EEA/UK, the parties agree that the European Commission's Standard Contractual Clauses (Module 2 — controller to processor) are incorporated by reference and apply to such transfers.

10. Audit

On reasonable advance notice, Customer may request a copy of our most recent independent security report (when one is available) or, in lieu, a written summary of the security controls in place.

11. Deletion

Within 90 days of termination, we will delete or anonymise Customer Personal Data, except where retention is required by law.

12. Order of precedence

In the event of a conflict between this DPA and the Terms, this DPA controls with respect to the processing of personal data.

For a counter-signed copy on letterhead, contact [email protected].