Data processing agreement
Processing agreement between each customer and Vizator for the data of visitors to its websites, under Article 28 of the GDPR. It is part of the Terms of service and is accepted with them.
Last updated:
Parties and subject matter
When the customer publishes the Vizator viewer on its websites, the customer is the controller of its visitors’ data and Vizator (Arturo Guasp Vicedo, tax ID 21798350P) is the processor: it processes them only on the customer’s behalf and to provide the contracted service.
Nature, purpose and duration
Automated processing to display the viewer and its features, provide the customer with usage analytics for its integrations and keep the service secure and working properly. Vizator does not use this data for its own purposes, does not sell it and does not disclose it to third parties except to the sub-processors listed.
It lasts as long as the service contract.
Types of data and data subjects
Data subjects: people who visit the customer’s websites and open the viewer.
Data: truncated IP address (its last part is removed before storing it), a pseudonymous identifier that changes every month, approximate location derived from the IP (country, region and city), browser, operating system and device type, the page the viewer is opened from and interactions with it (finishes chosen, options, augmented reality). No special categories of data are processed.
The viewer uses no cookies and stores no personal data in the visitor’s browser; it only notes, for a few minutes and in session storage, if the viewer’s files did not respond, so it can load the fallback copy (see the Cookie policy). The full IP is only used in memory, at the time of the visit, to derive the approximate location and the identifier.
Customer’s instructions
Vizator processes the data only on the customer’s documented instructions, which are this agreement, the Terms of service and the settings the customer chooses in its dashboard. If it considers that an instruction infringes data protection law, it will inform the customer immediately.
Confidentiality and security
The people authorized to process the data are bound by confidentiality.
Vizator applies the Article 32 GDPR measures appropriate to the risk: encrypted connections, per-user and per-company access control, pseudonymization and truncation of visitors’ IP addresses, separation of each customer’s data, activity logs and hosting backups.
Sub-processors
The customer gives Vizator general authorization to rely on these sub-processors: Hostinger (hosting of the service, in the European Union), Cloudflare (delivery network for the viewer’s files) and Backblaze (encrypted backups of the database, kept for 6 months, and a fallback copy of the viewer’s files, used if the main delivery network fails; storage in the European Union). The approximate location is calculated on Vizator’s own servers with a local database, without sending the IP to anyone. Vizator imposes on each of them data protection obligations equivalent to this agreement and is responsible for their compliance.
Vizator will notify the customer of any new or changed sub-processor at least 30 days in advance, so it can object on justified grounds; if no agreement is reached, the customer may terminate the contract.
International transfers
If a sub-processor processes data outside the European Economic Area, it does so with the safeguards of Chapter V of the GDPR, such as an adequacy decision (for example, the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.
Assistance to the customer
Vizator helps the customer, as far as possible and taking into account the nature of the processing, to respond to data subjects’ requests (access, erasure, objection and other rights) and to meet its obligations on security, breach notification, impact assessments and prior consultation (Articles 32 to 36 GDPR). If a data subject contacts Vizator, it will forward the request to the customer.
Security breaches
Vizator will notify the customer, without undue delay and within 48 hours of becoming aware of it, of any security breach affecting its data, with the information available so the customer can meet its notification obligation.
End of the agreement
When the contract ends, Vizator deletes the data or, if the customer asks beforehand, returns it in a structured format, and deletes existing copies, except for what must be kept by law. While the contract lasts, analytics events are kept for the contracted analytics history (12 months, unless an Enterprise contract sets another period) plus one month, and then deleted.
Information and audits
Vizator makes available to the customer the information needed to demonstrate compliance with this agreement and allows for and contributes to audits carried out by the customer, or an auditor it authorizes, with reasonable notice. Vizator keeps the record of processing activities required by Article 30(2) GDPR.
Customer’s obligations
The customer warrants that it has a legal basis for the processing and informs the visitors to its websites about the use of the viewer in its privacy policy.
Suggested text it can include: "This website uses the Vizator 3D viewer (Arturo Guasp Vicedo, Valencia, Spain) to show our products. To do so, Vizator processes technical data about your visit on our behalf —truncated IP address, approximate location, device type and interactions with the viewer— to provide the viewer and measure its use. It uses no cookies. The data is kept for a maximum of 13 months, or the period agreed with Vizator if different."