DATA PROCESSING AGREEMENT

1. Definitions

In this DPA, the following terms have the meanings set forth below:

Term	Definition
Controller	The natural or legal person that determines the purposes and means of the processing of Personal Data (i.e., the Customer)
Processor	The natural or legal person that processes Personal Data on behalf of the Controller (i.e., ImmersiveLogic Lda)
Personal Data	Any information relating to an identified or identifiable natural person, as uploaded to or processed through the Service, including but not limited to names, email addresses, IP addresses, coordinates, and metadata contained in point cloud files
Data Subject	An identified or identifiable natural person to whom Personal Data relates
Sub-processor	Any third party appointed by ImmersiveLogic to process Personal Data on behalf of the Controller
Data Protection Laws	All applicable laws and regulations relating to the processing of Personal Data, including GDPR, CCPA, and any successor legislation
Supervisory Authority	An independent public authority established by an EU Member State pursuant to GDPR Article 51

2. Scope and Application

2.1 Application of DPA

This DPA applies where:

• The Customer uploads or processes Personal Data through the Service
• The Customer acts as a Controller with respect to such Personal Data
• ImmersiveLogic processes such Personal Data on behalf of the Customer

2.2 Roles and Responsibilities

The parties acknowledge and agree that:

• The Customer is the Controller and determines the purposes and means of processing Personal Data
• ImmersiveLogic is the Processor and processes Personal Data solely on behalf of and according to the Customer's documented instructions
• The Customer is responsible for ensuring that its instructions comply with Data Protection Laws

2.3 Precedence

In the event of any conflict or inconsistency between this DPA and the Terms of Service, this DPA shall prevail with respect to the processing of Personal Data.

3. Processing of Personal Data

3.1 Processor's Obligations

ImmersiveLogic shall:

• Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to third countries or international organizations, unless required to do so by EU or Member State law
• Ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Section 5
• Assist the Controller in responding to Data Subject requests, as described in Section 4
• Notify the Controller without undue delay after becoming aware of a Personal Data Breach, as described in Section 6
• Make available to the Controller all information necessary to demonstrate compliance with GDPR Article 28
• Delete or return all Personal Data to the Controller after the end of the provision of services, as described in Section 8

3.2 Controller's Instructions

The Controller instructs Viizor to process Personal Data for the following purposes:

• Storing and displaying point cloud files uploaded by the Controller
• Processing point cloud data to generate derivative formats required for visualization
• Enabling project management, versioning, and collaboration features
• Generating measurement tools, analysis results, and annotations
• Providing customer support and technical assistance
• Maintaining backups and disaster recovery

3.3 Details of Processing

Parameter	Description
Nature of Processing	Storage, retrieval, conversion, display, analysis, and transmission of point cloud data and associated metadata
Purpose of Processing	Provision of the Viizor platform for 3D point cloud visualization, analysis, and collaboration
Duration of Processing	For the term of the Customer's subscription plus 30 days for backup retention
Types of Personal Data	Names, email addresses, IP addresses, geospatial coordinates, timestamps, user identifiers, metadata embedded in point cloud files (e.g., GPS coordinates, photographer information)
Categories of Data Subjects	The Controller's employees, contractors, clients, collaborators, and any individuals whose Personal Data is contained in uploaded point cloud files

4. Data Subject Rights

4.1 Assistance with Data Subject Requests

ImmersiveLogic shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to Data Subject requests to exercise their rights under Data Protection Laws, including:

• Right of Access (GDPR Art. 15): Providing access to Personal Data
• Right to Rectification (GDPR Art. 16): Correcting inaccurate Personal Data
• Right to Erasure (GDPR Art. 17): Deleting Personal Data
• Right to Restriction (GDPR Art. 18): Restricting processing of Personal Data
• Right to Data Portability (GDPR Art. 20): Exporting Personal Data in machine-readable format
• Right to Object (GDPR Art. 21): Objecting to certain types of processing

4.2 Request Handling

If Viizor receives a Data Subject request directly:

• ImmersiveLogic will promptly notify the Controller of the request
• ImmersiveLogic will not respond to the Data Subject directly without the Controller's prior authorization
• The Controller remains responsible for responding to the Data Subject

4.3 Assistance Fees

ImmersiveLogic's assistance with Data Subject requests is included in the Service fees. For requests requiring extraordinary measures beyond normal Service functionality, ImmersiveLogic may charge reasonable fees based on time and resources expended.

5. Security Measures

5.1 Technical and Organizational Measures

Viizor implements the following technical and organizational measures to ensure a level of security appropriate to the risk:

Technical Measures:

• Encryption: Data in transit encrypted using TLS 1.2 or higher; sensitive data at rest encrypted using industry-standard algorithms
• Access Controls: Role-based access control (RBAC), multi-factor authentication for administrative access, JWT-based session management
• Network Security: Firewalls, intrusion detection and prevention systems (IDS/IPS), DDoS protection
• Logging and Monitoring: Security event logging, real-time monitoring of suspicious activities, automated alerting
• Vulnerability Management: Regular security assessments, patch management, penetration testing
• Backup and Recovery: Automated backups with encryption, disaster recovery procedures, tested recovery processes

Organizational Measures:

• Access Management: Principle of least privilege, access reviews, immediate revocation upon termination
• Personnel Security: Background checks for employees with access to Personal Data, confidentiality agreements, security training
• Incident Response: Security incident response plan, designated security team, breach notification procedures
• Physical Security: Physical access controls to data centers (where applicable), visitor management, surveillance systems
• Policies and Procedures: Information security policy, data retention and deletion policy, change management procedures

5.2 Security Updates

Viizor regularly reviews and updates security measures to maintain compliance with industry standards and address emerging threats.

6. Personal Data Breaches

6.1 Notification to Controller

In the event of a Personal Data Breach, ImmersiveLogic shall notify the Controller without undue delay after becoming aware of the breach; this is separate from the Controller’s applicable 72-hour supervisory-authority notification deadline.

6.2 Breach Information

ImmersiveLogic's notification shall include, to the extent possible:

• A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records concerned
• The name and contact details of ImmersiveLogic's data protection officer or other contact point
• A description of the likely consequences of the Personal Data Breach
• A description of measures taken or proposed to address the breach and mitigate its adverse effects

6.3 Cooperation

ImmersiveLogic shall cooperate with the Controller and provide reasonable assistance in connection with the Controller's handling of a Personal Data Breach, including:

• Investigating the breach
• Providing information for breach notifications to Data Subjects and Supervisory Authorities
• Implementing remedial measures

6.4 Controller's Obligations

The Controller remains responsible for complying with GDPR breach notification requirements, including notifying the relevant Supervisory Authority and affected Data Subjects where required.

7. Sub-processors

7.1 Authorization

The Controller authorizes Viizor to engage Sub-processors to process Personal Data, subject to the requirements of this Section.

7.2 Current Sub-processors

Viizor currently engages the following Sub-processors:

Sub-processor	Service Provided	Location
Supabase, Inc.	Database hosting and authentication services	United States
Cloudflare, Inc.	Object storage (R2) and content delivery	United States / EU (customer selectable)
OpenAI, L.L.C.	AI-powered analysis features (optional)	United States

An up-to-date list of Sub-processors is maintained at: viizor.app/legal/sub-processors.html

7.3 Sub-processor Obligations

ImmersiveLogic shall:

• Impose data protection obligations on Sub-processors that are materially the same as those imposed on ImmersiveLogic under this DPA
• Ensure Sub-processors provide sufficient guarantees to implement appropriate technical and organizational measures
• Remain fully liable to the Controller for the performance of Sub-processors

7.4 Changes to Sub-processors

ImmersiveLogic shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors by:

• Updating the Sub-processor list at viizor.app/legal/sub-processors.html
• Sending email notification to the Controller's registered email address

The Controller may object to such changes within 30 days of notification. If the Controller objects and Viizor cannot accommodate the objection, either party may terminate the affected portion of the Service.

8. International Data Transfers

8.1 Transfers Outside EEA

Personal Data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, which may not provide equivalent data protection as the laws of the EEA.

8.2 Transfer Mechanisms

Viizor ensures that international transfers of Personal Data are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs): Viizor implements the European Commission's Standard Contractual Clauses (Decision 2021/914) for transfers to third countries
• Adequacy Decisions: Transfers to countries recognized by the European Commission as providing adequate data protection
• Binding Corporate Rules: Where applicable, transfers within corporate groups subject to BCRs approved by Supervisory Authorities

8.3 Sub-processor Transfers

Sub-processors located outside the EEA are subject to the same transfer mechanisms. The Controller's authorization of Sub-processors includes authorization of international transfers necessary for their services.

9. Audits and Compliance

9.1 Audit Rights

The Controller has the right to audit ImmersiveLogic's compliance with this DPA, subject to the following conditions:

• Audits may be conducted no more than once per year unless a Personal Data Breach or Supervisory Authority request requires additional audits
• The Controller shall provide at least 30 days' advance written notice
• Audits shall be conducted during normal business hours and in a manner that does not unreasonably interfere with ImmersiveLogic's operations
• The Controller shall bear all costs associated with audits unless the audit reveals material non-compliance

9.2 Information Requests

ImmersiveLogic shall make available to the Controller information necessary to demonstrate compliance with GDPR Article 28, including:

• Descriptions of technical and organizational security measures
• Certifications, audit reports, or assessments (subject to confidentiality obligations)
• Evidence of Sub-processor compliance

9.3 Third-Party Audits

At the Controller's request and expense, ImmersiveLogic shall allow audits by an independent third-party auditor mutually agreed upon by the parties.

10. Data Retention and Deletion

10.1 Retention Period

Viizor retains Personal Data for the duration of the Customer's subscription plus 30 days for backup retention, unless:

• The Controller requests deletion earlier
• Longer retention is required by law
• Specific data categories have different retention periods as specified in the Privacy Policy

10.2 Deletion or Return

Upon termination of the Service or upon the Controller's request, ImmersiveLogic shall, at the Controller's choice:

• Delete: Securely delete all Personal Data from production systems and backups within 30 days
• Return: Provide the Controller with a copy of Personal Data in a commonly used machine-readable format

10.3 Exceptions

ImmersiveLogic may retain Personal Data to the extent required by EU or Member State law, and only for the duration and purposes required by such law. ImmersiveLogic shall inform the Controller of any legal requirements preventing deletion or return.

10.4 Certification of Deletion

Upon request, ImmersiveLogic shall provide written certification of deletion or return of Personal Data.

11. Liability and Indemnification

11.1 Limitation of Liability

Each party's liability under this DPA shall be subject to the limitations of liability set forth in the Terms of Service.

11.2 GDPR Article 82 Liability

The parties acknowledge that under GDPR Article 82:

• Any person who has suffered material or non-material damage as a result of an infringement of GDPR has the right to receive compensation
• ImmersiveLogic shall be liable for damage caused by processing only where it has not complied with GDPR obligations specifically directed to processors or has acted outside or contrary to lawful instructions of the Controller
• ImmersiveLogic shall be exempt from liability if it proves it is not in any way responsible for the event giving rise to the damage

11.3 Indemnification

ImmersiveLogic shall indemnify and hold harmless the Controller from any claims, fines, or penalties imposed by Supervisory Authorities arising from ImmersiveLogic's breach of this DPA or Data Protection Laws, except to the extent caused by the Controller's instructions or actions.

12. Term and Termination

12.1 Term

This DPA takes effect on the Effective Date and continues until termination of the Terms of Service or until all Personal Data has been deleted or returned, whichever is later.

12.2 Termination

Either party may terminate this DPA:

• If the other party materially breaches this DPA and fails to remedy the breach within 30 days of written notice
• Upon termination of the Terms of Service

12.3 Effect of Termination

Upon termination, ImmersiveLogic shall delete or return all Personal Data as described in Section 10, and all provisions of this DPA that by their nature should survive termination shall survive.

13. General Provisions

13.1 Amendments

ImmersiveLogic may update this DPA from time to time to reflect changes in Data Protection Laws, Supervisory Authority guidance, or industry best practices. Material changes will be notified to the Controller with at least 30 days' advance notice.

13.2 Governing Law

This DPA is governed by the same law as the Terms of Service. To the extent of any conflict between this DPA and Data Protection Laws, Data Protection Laws shall prevail.

13.3 Severability

If any provision of this DPA is found invalid or unenforceable, the remaining provisions shall remain in full force and effect.

13.4 Order of Precedence

In the event of any conflict between this DPA and the Terms of Service with respect to processing of Personal Data, this DPA shall prevail.

13.5 Contact Information

For questions or concerns regarding this DPA, contact us at:

ImmersiveLogic Lda
NIPC: 519172701
Avenida Dr. Carlos Pinto Ferreira, nº 88, 1º Esq
4480-665 Vila do Conde, Portugal

Data Protection Contact:
Email: hello@viizor.app
Subject Line: Data Processing Agreement Inquiry