Legal

Data Processing Agreement

Last updated: 15 October 2026

1. About this agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between you, the customer ("you"), and 3D Nova ("3D Nova", "we", "us"). It applies whenever we process personal data on your behalf while providing the Service, and it takes effect automatically when you accept the Terms: nothing needs to be signed. You can print this page or save it as a PDF for your records.

It repeats, in more detail, the customer data terms in section 12 of our Privacy Policy. Where this DPA and the Terms differ on the protection of personal data, this DPA applies.

2. Who does what

You are the controller of the personal data your tours and cards collect and of the personal data in the content you upload. You decide what to collect and why.
We are your processor for that data: we process it only to provide the Service to you.
For your own account details (your login, plan and billing), we are the controller, as described in the Privacy Policy.

3. The processing

Subject and purpose	Hosting and showing your tours and business cards; storing the details visitors type into your lead forms and sending you lead notifications; recording viewing statistics and showing them in your dashboard; giving your team members access to your workspace.
Duration	For as long as you use the Service, and then until the data is deleted as described in section 7 of the Privacy Policy.
Types of personal data	Lead form details (such as name, email, phone number, interest or message, and the tour and scene the form was sent from); viewing statistics (approximate country, device type, time spent, scenes and hotspots opened, not linked to a name); team members' email addresses and roles; and any personal data contained in the photos, scans, text and other content you upload.
People concerned	Visitors to your tours and cards; people shown or named in your content; your team members.

Do not use the Service to collect special categories of personal data (such as health information) or government ID, financial account or card numbers.

4. What we commit to

Your instructions. We process the data only on your documented instructions: these Terms, this DPA, and the way you set up and use the Service. That includes transfers to other countries (section 8). If the law requires us to process it in another way, we tell you first unless the law forbids that. If we believe an instruction breaks data protection law, we tell you.
Confidentiality. Everyone at 3D Nova who can access the data is bound by confidentiality.
Security. We protect the data with the measures in section 10, and we keep them up to date.
Help with requests. We help you answer requests from the people concerned (for example to see, correct or delete their data). Most can be handled directly in your dashboard, for example by deleting or exporting leads.
Help with compliance. Taking into account what we know about the processing, we help you meet your obligations on security, breach notification, data protection impact assessments and consulting a supervisory authority.
Deletion. When you delete data, a tour or your account, we delete the data as described in section 7 of the Privacy Policy, unless the law requires us to keep it. You can export your leads as a file before deleting them.
Showing compliance. We give you the information you reasonably need to show that this DPA is being followed (section 9).

5. Your commitments

You have a lawful reason for collecting the data and for asking us to process it.
You tell the people concerned who you are and how you use their data, for example with your own privacy notice, and you answer their requests.
Your instructions to us comply with the law, and you have every permission needed for the personal data in your content, including from people shown in your photos.

6. Other companies we use (sub-processors)

You authorise us to use the following service providers to process the data. Each is bound by written terms that protect it at least as well as this DPA, and we remain responsible to you for them.

Supabase	Database, sign-in and file storage. The database is hosted in the European Union (Germany).
Cloudflare	Website hosting, content delivery, media storage and security, on a worldwide network.
Resend	Sending lead notification emails to you (United States).
Sentry	Error reports, which can include technical details of a visit (European Union).

Before we add or replace a sub-processor, we update this list and the list in the Privacy Policy at least 14 days in advance. If you object on reasonable data protection grounds, tell us at hello@3dnova.app; if we cannot address your concern, you may stop using the Service and delete your account.

7. Personal data breaches

If we become aware of a breach of security affecting the data, we tell you without undue delay, with the information we have: what happened, the kinds and approximate amount of data and people affected, the likely consequences, and what we have done or plan to do. We add details as we learn them, so you can meet your own obligation to report it.

8. International transfers

Our sub-processors may process the data in countries other than yours, including the United States. Where data protection law requires it, transfers are covered by appropriate safeguards offered by those providers, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

9. Information and audits

On request, we answer reasonable questions about our processing and security in writing. If that is not enough to show compliance, or a supervisory authority requires it, you may have an audit carried out by an independent auditor bound by confidentiality, at your own cost, with at least 30 days' notice, during normal working hours, no more than once a year, and in a way that does not reveal other customers' data or put the Service at risk.

10. Security measures

All connections to the Service are encrypted (HTTPS), and our providers encrypt stored data.
Database rules limit every account to its own data and its team, by role (owner, editor, viewer).
Passwords are never stored in readable form. Keys that can reach all data are kept on our servers only, never in browsers.
Administrative access is limited to a small number of named company accounts.
Uploads are checked and stored in the uploader's own folders; visitor-facing pages are protected against injected code.
Lead notifications go only to the addresses you set for your own tours.
Errors are monitored so problems can be found and fixed quickly.
Deleted data is removed on the schedule in section 7 of the Privacy Policy.

11. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow it. This DPA lasts as long as we process personal data for you, and ends automatically when that processing ends.

12. Contact

Questions about this DPA: hello@3dnova.app.