Data processing agreement
This agreement forms part of the terms of service between 3D Attract Ltd, UIC 208368629, 24G General Ivan Kolev St., floor 6, apt. 20, Triaditsa district, 1407 Sofia, Bulgaria (“3D Attract”, the processor) and the customer using the Services (the “Customer”, the controller). It applies whenever 3D Attract processes personal data on the Customer’s behalf. Words such as “personal data”, “processing” and “personal data breach” have the meaning given in the EU General Data Protection Regulation (GDPR).
1. Details of the processing
| Subject matter | Providing the 3D Attract Studio, hosted and embedded configurators, quote requests and managed 3D services under the terms of service. |
|---|---|
| Duration | For as long as 3D Attract provides the Services, and afterwards until deletion as described in section 9. |
| Nature and purpose | Hosting, storing, converting, rendering and displaying the Customer’s content; sending quote requests from configurator visitors to the Customer; counting configurator use anonymously; managing workspace members and invitations; account administration and support. |
| Data subjects | The Customer’s staff and users; people invited to the Customer’s workspaces, including staff of the Customer’s own clients; visitors to the Customer’s configurators who submit a quote request; any people who appear in or are identified by the Customer’s content. |
| Categories of data | Names, email addresses and messages; selected product options; workspace user details, invitations and permissions; delivery records of quote-request emails; technical data such as IP address and browser details used for bot checks and abuse prevention; any personal data the Customer includes in uploaded files (for example names in logos or images, or scans of people). |
| Special categories | None intended. The Customer must not upload special-category data (such as health or biometric data used to identify a person) without first agreeing safeguards with 3D Attract in writing. |
2. Instructions
3D Attract processes the personal data only on the Customer’s documented instructions. The terms of service, this agreement and the Customer’s use and settings in the Services are those instructions. If 3D Attract is required by EU or member-state law to process data otherwise, it will tell the Customer first unless that law forbids it. 3D Attract will tell the Customer if it believes an instruction breaks data protection law.
The Customer is responsible for having a lawful basis for the processing, for giving its data subjects the information the law requires, and for the content it uploads.
If the Customer processes the personal data on behalf of its own client (for example as an agency on the Guru plan), the Customer confirms that its client has authorised it to use 3D Attract, and 3D Attract acts as the Customer’s sub-processor. The Customer remains 3D Attract’s only point of contact and passes on its client’s instructions.
3. Confidentiality
Everyone at 3D Attract who can access the personal data is bound by confidentiality and accesses it only as needed to provide the Services.
4. Security
3D Attract applies the technical and organisational measures in the annex, and may update them as long as the overall level of protection does not go down.
5. Sub-processors
The Customer gives general authorisation for 3D Attract to use sub-processors. The current list is below. 3D Attract will give at least 30 days’ notice before adding or replacing a sub-processor, by email or in the Services, and the Customer may object on reasonable data protection grounds; if no solution is found, the Customer may end the affected Services and receive a refund of prepaid fees for the remaining period. 3D Attract imposes data protection obligations on each sub-processor equivalent to this agreement and remains responsible for them.
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. | Accounts, database, file storage | London, United Kingdom; US company | UK adequacy decision for the stored data; standard contractual clauses for access from the US |
| Vercel Inc. | Hosting, server functions, cookieless visit statistics | EU (Frankfurt) for functions; global edge network; US company | EU–US Data Privacy Framework; standard contractual clauses |
| Plus Five Five, Inc. (Resend) | Email delivery: team invitations and service notices | EU (Ireland) and United States; US company | Standard contractual clauses; EU–US Data Privacy Framework where certified |
| Twenty.com PBC | Customer records (CRM), including emails exchanged with info@ and office@; its AI feature reads emails to recognise unsubscribe requests | EU (Frankfurt, Germany); US company. Its AI feature uses TypeSafe AI, Inc. (United States) | Standard contractual clauses; EU–US Data Privacy Framework where certified |
| Google Ireland Ltd / Google LLC | Business email (Google Workspace); sending quote-request emails from info@3dattract.com (Google Apps Script); earlier enquiry records | EU and other Google locations | EU–US Data Privacy Framework; standard contractual clauses |
| Stripe Payments Europe, Ltd | Payments for custom and managed projects | Ireland (EU) and United States | EU–US Data Privacy Framework; standard contractual clauses |
| Crisp IM SAS | Live chat support | European Union (France) | Not needed (EU) |
| Anthropic Ireland, Limited, with Anthropic, PBC | AI provider behind the AI assistants our team uses for operations, support and development; they may process Customer data when our staff use them for a task, such as a support request or work on a project. Anthropic may not train its models on this data. | United States | Standard contractual clauses (in Anthropic’s data processing addendum) |
| Cloudflare, Inc. | Bot checks (Turnstile) on quote-request forms in published configurators (not yet switched on; customers will be told before it starts) | Global network; US company | EU–US Data Privacy Framework; standard contractual clauses |
Sold through Link, LLC (“Link”, a Stripe company) sells the Standard, Pro and Guru subscriptions as merchant of record. It is not a sub-processor: it processes subscription payment data as an independent controller (see our privacy notice).
This list was last changed on 1 November 2026, when Anthropic was added. Twenty, Crisp and Link process only 3D Attract’s own customer, support and billing data and are listed for transparency; Cloudflare Turnstile will not be used until 30 days after we notify customers. To be told about changes, email info@3dattract.com with the subject “Sub-processor updates”. We also email the owner of every workspace at least 30 days before a change.
6. International transfers
3D Attract transfers personal data outside the European Economic Area only where there is an adequacy decision or appropriate safeguards under Chapter V of the GDPR, such as the standard contractual clauses. 3D Attract transfers personal data outside the EEA only on the Customer’s documented instructions, which include using the sub-processors listed in section 5.
Customers outside the EEA, UK and Switzerland
If the Customer is established outside the EEA and receives personal data from 3D Attract, the standard contractual clauses adopted by the European Commission (Decision 2021/914), Module 4 (processor to controller), are incorporated into this agreement, with this agreement providing the details required by their annexes; the clauses’ optional clause 7 applies, clause 17 chooses Bulgarian law and clause 18 chooses the courts of Sofia. Where the UK GDPR or the Swiss Federal Act on Data Protection applies, references in this agreement to the GDPR include those laws, and references to EU or member-state law include UK or Swiss law.
US state privacy laws
Where the California Consumer Privacy Act or a similar US state law applies, 3D Attract is the Customer’s service provider or processor. 3D Attract will not sell or share the personal data, keep, use or disclose it outside the direct business relationship or for any purpose other than providing the Services, or combine it with personal data from other sources except as that law allows. 3D Attract will tell the Customer if it can no longer meet these obligations, and certifies that it understands them.
7. Assistance
3D Attract will help the Customer, taking into account the nature of the processing, to respond to data subject requests, and with security, breach notification, data protection impact assessments and consultations with authorities. If a data subject contacts 3D Attract directly about the Customer’s data, 3D Attract will pass the request to the Customer and will not answer it itself unless instructed. Help beyond what the Services already provide may be charged at reasonable rates.
8. Personal data breaches
3D Attract will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data. The notice will describe what happened, the data and people likely affected, the likely consequences and the measures taken or proposed, with further details as they become available.
9. Return and deletion
When the Services end, the Customer can export its content for 30 days. 3D Attract then deletes the personal data, and in any case within 90 days of the end of the Services, unless EU or member-state law requires it to be kept. Backup copies are overwritten within a further 30 days. On request, 3D Attract confirms the deletion in writing.
10. Information and audits
3D Attract will make available the information reasonably needed to show compliance with Article 28 GDPR, and will allow audits by the Customer or an independent auditor it appoints, on at least 30 days’ notice, during business hours, no more than once a year (unless there has been a breach or an authority requires it), and subject to confidentiality. Each party bears its own costs.
11. General
If this agreement conflicts with the terms of service, this agreement prevails on data protection matters. The liability limits in the terms of service apply, except where the GDPR does not allow them. This agreement is governed by Bulgarian law. A signed copy is available on request at info@3dattract.com.
Annex: technical and organisational measures
- Encryption: all connections use HTTPS/TLS. Our hosting and database providers encrypt stored data.
- Access control: least-privilege access for staff; per-account database access rules (row-level security) so customers can only reach their own data; staff accounts protected with two-factor authentication where available.
- Separation: test and production data are kept apart; secrets are stored only in the hosting provider’s encrypted settings.
- Integrity: signed requests between our services, input validation, rate limits and spam protection on forms.
- Availability: managed hosting with provider backups; changes are reviewed and tested before release.
- Minimisation: configurator usage statistics are anonymous counts without cookies; quote-request emails are sent from info@3dattract.com through Google Workspace, and their delivery records hold only one-way codes (hashes) and the delivery status, with no email text or email addresses, for up to 30 days.
- People: confidentiality obligations for everyone with access; access removed promptly when no longer needed.
- Incidents: a documented process to assess, contain and report breaches within the time limits above.