DATA PROCESSING AGREEMENT (DPA)
Annex to the ValidAR End User Licence Agreement Article 28 of Regulation (EU) 2016/679 · Spanish Organic Law 3/2018
1. Parties and purpose
1.1. This Data Processing Agreement (the "DPA") governs the processing of Personal Data that KABUNIK, S.L., with registered office at Calle Cuenca, núm. 13, 08980 Sant Feliu de Llobregat (Barcelona), Spain and NIF B88736350 (the "Licensor" or "Processor"), carries out on behalf of the Customer (the "Controller") under the ValidAR End User Licence Agreement (the "EULA").
1.2. This DPA develops Section 14C of the EULA and forms an integral part of it. Terms defined in the EULA retain their meaning here.
1.3. It is entered into for the purposes of Article 28(3) of the GDPR. In the event of conflict between this DPA and the EULA on data protection matters, this DPA shall prevail.
1.4. This DPA must be executed before any Personal Data is processed through the Software, in accordance with Section 14C.1 of the EULA.
2. Subject matter, duration, nature and purpose of processing
2.1. The subject matter is the provision of the Software and Support described in the EULA and the applicable Order.
2.2. The duration coincides with the Utilization Term, extending only as necessary to fulfil the deletion or return obligations in clause 9.
2.3. The nature and purpose of the processing, as well as the type of Personal Data and categories of data subjects, are described in Annex A.
2.4. The Processor shall not process Personal Data for its own purposes, save in its capacity as controller in respect of the data indicated in Section 14A.1 of the EULA (account registration, licensing, invoicing and service communications), which fall outside the scope of this DPA.
3. Documented instructions
3.1. The Processor shall process Personal Data solely on documented instructions from the Controller, including with regard to international transfers, unless required to do so by Union or Member State law; in such a case, it shall inform the Controller of that legal requirement before processing, unless legally prohibited on important grounds of public interest.
3.2. The following constitute documented instructions of the Controller: the EULA, this DPA, the Order, the configuration the Controller establishes in the Software's administration panel, and any additional instructions issued in writing.
3.3. If the Processor considers that an instruction infringes data protection law, it shall inform the Controller immediately and may suspend its execution until the Controller confirms, amends or withdraws it.
4. Controller obligations
4.1. The Controller warrants that it has a lawful basis for the processing of the Personal Data it enters, or causes to be entered, into the Software, and that it has made all required disclosures to data subjects.
4.2. The Controller shall not submit Prohibited Data to the Software, on the terms of Section 6.(j) of the EULA.
4.3. The Controller is responsible for the accuracy, quality and lawfulness of the Personal Data and for the means by which it obtained them.
4.4. The Controller shall configure the profiles and permissions of its Authorized Users in accordance with the principle of least privilege, and shall review those assignments when organisational changes occur.
5. Confidentiality
5.1. The Processor warrants that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
5.2. Access is limited to personnel who need it to provide the Software and Support, and is withdrawn when it ceases to be necessary.
6. Security of processing
6.1. The Processor shall implement the appropriate technical and organisational measures required by Article 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of data subjects.
6.2. The measures in force as at the date hereof are set out in Annex C. The Processor may update them provided they do not reduce the level of security.
6.3. The Processor shall notify the Controller of any material change to the measures in Annex C with reasonable notice.
7. Sub-processors
7.1. The Controller grants general authorisation for the Processor to engage the sub-processors listed in Annex B.
7.2. The Processor shall impose on each sub-processor, by contract, data protection obligations equivalent to those in this DPA, and shall remain fully liable to the Controller for their acts and omissions.
7.3. The Processor shall inform the Controller of any addition or replacement of a sub-processor at least thirty (30) days in advance. The Controller may object on reasonable data protection grounds within that period; if the parties do not resolve the objection within thirty (30) days, the Controller may terminate the affected service without penalty.
8. Data subject rights
8.1. Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures so that it can respond to requests for the exercise of the rights in Articles 15 to 22 of the GDPR.
8.2. The Software provides the Controller with consultation, rectification, export and deletion functions enabling it to handle most such requests itself.
8.3. If the Processor receives a data subject request directly relating to data processed on the Controller's behalf, it shall forward it without undue delay and shall not respond on its own account, save where legally obliged.
9. Deletion or return of data
9.1. On termination of the Utilization Term, and at the Controller's choice, the Processor shall delete or return all Personal Data processed on its behalf.
9.2. The Controller has thirty (30) calendar days from termination to export the Customer Content using the Software's functions. After that period, absent instructions to the contrary, the Processor shall proceed to deletion.
9.3. The Processor may retain the data in encrypted backups for a period not exceeding a further thirty (30) days, during which they remain subject to this DPA, and shall delete existing copies unless Union or Spanish law requires their retention.
9.4. The Processor shall certify deletion in writing at the Controller's request.
10. Notification of security breaches
10.1. The Processor shall notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware of a security breach affecting Personal Data processed on its behalf.
10.2. The notification shall include, to the extent available: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and contact details for further information.
10.3. The Processor shall assist the Controller in complying with its notification obligations to the AEPD and, where applicable, to data subjects.
10.4. Notification to the Controller does not constitute an admission of liability by the Processor.
11. Assistance with impact assessments
11.1. The Processor shall reasonably assist the Controller in carrying out data protection impact assessments (Article 35 of the GDPR) and in prior consultations with the supervisory authority (Article 36), providing the information on the processing available to it.
12. Information and audits
12.1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28 of the GDPR.
12.2. The Controller may carry out audits, including inspections, itself or through an independent auditor bound by confidentiality, on reasonable notice of at least thirty (30) days, during business hours and without unduly disrupting the Processor's activity, once a year unless there is good cause or the supervisory authority so requires.
12.3. The Processor may satisfy these obligations by providing certifications or independent audit reports from its infrastructure sub-processors, where they reasonably cover the scope requested.
13. International transfers
13.1. The Controller acknowledges and expressly authorises that processing takes place on the hosting sub-processor's infrastructure in the United States, as detailed in Annex B.
13.2. Such transfers rely on the safeguards in Chapter V of the GDPR, and specifically on the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, controller-to-processor module, which are incorporated by reference into this DPA, as well as on the sub-processor's certification under the EU-U.S. Data Privacy Framework where applicable.
13.3. The Processor has carried out a transfer impact assessment and applies the supplementary measures described in Annex C. It shall provide the Controller with the information necessary for its own assessment on request.
13.4. If a decision of the European Commission, the Court of Justice or the supervisory authority invalidates the transfer mechanism used, the parties shall negotiate an alternative mechanism in good faith. Failing that, the Controller may terminate the affected service without penalty.
14. Liability
14.1. Liability under this DPA is governed by Section 18 of the EULA, without prejudice to the fact that liability for Personal Data breaches constitutes an Excluded Claim from those limits, to the extent required by applicable law.
14.2. Nothing in this DPA limits the rights of data subjects or the powers of the supervisory authority.
15. Term
15.1. This DPA takes effect on the same date as the EULA and remains in force for as long as the Processor processes Personal Data on the Controller's behalf.
15.2. The confidentiality, security and deletion obligations survive termination.
ANNEX A — DESCRIPTION OF THE PROCESSING
Article 28(3) of the GDPR
| Subject matter | Provision of the ValidAR software for assisted validation of steel structures using augmented reality, and the associated Support. |
|---|---|
| Duration | The Utilization Term, plus the export and deletion periods in clause 9. |
| Nature | Collection, recording, structuring, storage, retrieval, disclosure by transmission, comparison and erasure, by automated means. |
| Purpose | Authenticating users; managing licences, seats and device activation; running the inspection and validation workflow; generating and retaining validation records; diagnosing incidents and ensuring the security and stability of the service; providing Support. |
Categories of data subjects
- Authorized Users of the Controller: inspection and quality personnel, fitters, engineering office and administrators.
- Persons incidentally appearing in photographs an Authorized User deliberately captures as part of an inspection report.
Types of Personal Data
| Identification and account | Name and surname, work email address, organisation, user profile and permissions. |
|---|---|
| Device technical data | Technical Device identifier, model, operating system version, application version. |
| Usage and diagnostic data | Session logs, application events, performance and tracking metrics, errors and technical data on Device positioning during validation sessions. |
| Inspection content | Photographs deliberately captured by the Authorized User, validation reports, annotations and data associated with the inspected assemblies, including the identity of the person validating and the time of validation. |
Processing excluded
No special categories of data under Article 9 of the GDPR, precise user geolocation data, or children's data are processed. Data are not used for advertising, for tracking across third-party apps or sites, or for profiling with legal effects.
The images captured continuously for augmented reality tracking are processed on the Device itself and are neither transmitted to nor stored on the Processor's infrastructure. Only the photographs the Authorized User deliberately chooses to capture are retained.
Retention periods
| Account and user data | For as long as the subscription is active and the user remains registered. |
|---|---|
| Inspection content | For the Utilization Term, plus the periods in clause 9. |
| Telemetry and diagnostic logs | A maximum of 90 days, unless retention is necessary to investigate a specific incident. |
ANNEX B — AUTHORISED SUB-PROCESSORS
| Sub-processor | Service | Data processed | Location |
|---|---|---|---|
| Google Ireland Limited / Google LLC — Google Cloud Platform and Firebase | Hosting, database, file storage, server functions and service analytics | All categories in Annex A | European Union (europe-west1, Belgium) |
| Google Ireland Limited / Google LLC — Firebase Authentication | User authentication | Identification and account data | United States (no region selection available) |
| Ingaria | Management and control of licences and user seats | Identification and account | European Union |
| Visometry GmbH | Issuance and validation of per-Device technical tracking licences | Device technical data | Germany |
Note on location. The Processor's database, file storage, server functions and analytical store are deployed in the europe-west1 (Belgium, European Union) region.
Authentication is the sole exception: Firebase Authentication offers no region selection and is provided from the United States. It affects only access credentials — email address, user identifier and password verifier — not inspection content. See clause 13.
ANNEX C — TECHNICAL AND ORGANISATIONAL MEASURES
Article 32 of the GDPR
Access control
- Named authentication of each Authorized User. Credentials are personal and non-transferable.
- Isolation by organisation: the user's membership of their organisation travels inside the authentication token itself, and the database and file storage access rules check it on every operation. A user cannot access another organisation's data, even knowing its identifier.
- Role-based control within each organisation, according to the contracted profiles.
- Periodic review of permissions and withdrawal of the Processor's personnel access when it ceases to be necessary.
Encryption
- Encryption in transit (TLS) on all communications between Devices, the web application and the infrastructure.
- Encryption at rest of the database, file storage and backups, applied by the infrastructure sub-processor.
Logging and traceability
- Access and operation logging on the infrastructure, retained by the hosting sub-processor.
- Each validation is recorded with author, time and the drawing revision used, allowing reconstruction of who did what and when.
Minimisation
- Tracking images are processed on the Device and are not transmitted.
- IP identifiers used to rate-limit requests are stored hashed, not in the clear.
- Diagnostic telemetry is disableable by the Controller's administrator, save for the minimum indispensable for licence compliance.
Availability and resilience
- Infrastructure managed with redundancy and backups by the hosting sub-processor.
- Ability for the Controller to export the Customer Content at any time during the Utilization Term.
Organisational
- Processor personnel access limited to the minimum necessary and subject to a duty of confidentiality.
- Assessment of sub-processors before engagement and contractual obligations equivalent to those in this DPA.