3D Attract
LEGAL

Data processing agreement

Last updated: 18 October 2026 · GDPR Article 28

This agreement forms part of the terms of service between 3D Attract Ltd (3Д Атракт ЕООД), UIC (ЕИК) 208368629, 24G General Ivan Kolev St., floor 6, apt. 20, Triaditsa district, 1407 Sofia, Bulgaria (“3D Attract”, the processor) and the customer using the Services (the “Customer”, the controller). It applies whenever 3D Attract processes personal data on the Customer’s behalf. Words such as “personal data”, “processing” and “personal data breach” have the meaning given in the EU General Data Protection Regulation (GDPR).

1. Details of the processing

Subject matterProviding the 3D Attract Studio, hosted and embedded configurators, quote requests and managed 3D services under the terms of service.
DurationFor as long as 3D Attract provides the Services, and afterwards until deletion as described in section 9.
Nature and purposeHosting, storing, converting, rendering and displaying the Customer’s content; sending quote requests from configurator visitors to the Customer; account administration and support.
Data subjectsThe Customer’s staff and users; visitors to the Customer’s configurators who submit a quote request; any people who appear in or are identified by the Customer’s content.
Categories of dataNames, email addresses and messages; selected product options; workspace user details; any personal data the Customer includes in uploaded files (for example names in logos or images, or scans of people).
Special categoriesNone intended. The Customer must not upload special-category data (such as health or biometric data used to identify a person) without first agreeing safeguards with 3D Attract in writing.

2. Instructions

3D Attract processes the personal data only on the Customer’s documented instructions. The terms of service, this agreement and the Customer’s use and settings in the Services are those instructions. If 3D Attract is required by EU or member-state law to process data otherwise, it will tell the Customer first unless that law forbids it. 3D Attract will tell the Customer if it believes an instruction breaks data protection law.

The Customer is responsible for having a lawful basis for the processing, for giving its data subjects the information the law requires, and for the content it uploads.

3. Confidentiality

Everyone at 3D Attract who can access the personal data is bound by confidentiality and accesses it only as needed to provide the Services.

4. Security

3D Attract applies the technical and organisational measures in the annex, and may update them as long as the overall level of protection does not go down.

5. Sub-processors

The Customer gives general authorisation for 3D Attract to use sub-processors. The current list is below. 3D Attract will give at least 30 days’ notice before adding or replacing a sub-processor, by email or in the Services, and the Customer may object on reasonable data protection grounds; if no solution is found, the Customer may end the affected Services and receive a refund of prepaid fees for the remaining period. 3D Attract imposes data protection obligations on each sub-processor equivalent to this agreement and remains responsible for them.

Sub-processorServiceLocationTransfer safeguard
Vercel Inc.Hosting and server functionsEU (Frankfurt) for functions; global edge network; US companyEU–US Data Privacy Framework; standard contractual clauses
Supabase Inc.Accounts, database, file storageLondon, United KingdomUK adequacy decision; standard contractual clauses
Google Ireland Ltd / Google LLCBusiness email and enquiry records (Google Workspace)EU and other Google locationsEU–US Data Privacy Framework; standard contractual clauses
Plus Five Five, Inc. (Resend)Email delivery for quote requestsUnited StatesEU–US Data Privacy Framework; standard contractual clauses

6. International transfers

3D Attract transfers personal data outside the European Economic Area only where there is an adequacy decision or appropriate safeguards under Chapter V of the GDPR, such as the standard contractual clauses.

7. Assistance

3D Attract will help the Customer, taking into account the nature of the processing, to respond to data subject requests, and with security, breach notification, data protection impact assessments and consultations with authorities. If a data subject contacts 3D Attract directly about the Customer’s data, 3D Attract will pass the request to the Customer and will not answer it itself unless instructed. Help beyond what the Services already provide may be charged at reasonable rates.

8. Personal data breaches

3D Attract will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data. The notice will describe what happened, the data and people likely affected, the likely consequences and the measures taken or proposed, with further details as they become available.

9. Return and deletion

When the Services end, the Customer can export its content for 30 days. 3D Attract then deletes the personal data, unless EU or member-state law requires it to be kept. Backup copies are overwritten within a further 30 days.

10. Information and audits

3D Attract will make available the information reasonably needed to show compliance with Article 28 GDPR, and will allow audits by the Customer or an independent auditor it appoints, on at least 30 days’ notice, during business hours, no more than once a year (unless there has been a breach or an authority requires it), and subject to confidentiality. Each party bears its own costs.

11. General

If this agreement conflicts with the terms of service, this agreement prevails on data protection matters. The liability limits in the terms of service apply, except where the GDPR does not allow them. This agreement is governed by Bulgarian law. A signed copy is available on request at info@3dattract.com.

Annex: technical and organisational measures