This data processing agreement is part of the ArtInAR terms of use and applies to every store that uses ArtInAR. A countersigned copy is available on request at [email protected].
1. Parties
- The Controller: the store owner who uses ArtInAR.
- The Processor: Roesware, trading as ArtInAR, De Stuwdam 69K, Amersfoort, the Netherlands, Chamber of Commerce (KvK) 63316250, contact [email protected].
The Controller uses ArtInAR under the terms of use (the "Agreement"). Where ArtInAR processes personal data on the Controller's behalf, this agreement applies and meets Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). If this agreement and the Agreement conflict on personal data, this agreement wins.
For the store owner's own account data (name, email, billing), Roesware is an independent controller under the privacy policy, and this agreement does not apply.
2. Subject, purpose and duration
ArtInAR processes personal data only to show the Controller's artworks in 3D and augmented reality, and to report how often those previews are opened.
- Nature of the processing: collecting, storing, counting and deleting visit records when someone opens a preview page through the store's button, QR code or short link. Counts from the store's product pages (the button seen, 3D or AR opened, an artwork bought after a 3D view, with the line price) arrive without any visitor details and are only added to totals per artwork and day.
- Purpose: showing the preview and giving the Controller visit statistics. Nothing else.
- Duration: for as long as the Agreement runs. Visit records are kept for as long as the artwork stays in ArtInAR and are deleted with it.
The Processor processes personal data only on the Controller's documented instructions. The Agreement, this agreement and the Controller's settings in ArtInAR are those instructions. If an instruction would break the GDPR, the Processor tells the Controller straight away.
3. Data and data subjects
The only data subjects are visitors to the Controller's preview pages.
| Data | Why | Kept for |
|---|---|---|
| IP address | Counting visits, filtering out bots | As long as the artwork is in ArtInAR |
| Browser type (user agent) | Counting visits, filtering out bots | As long as the artwork is in ArtInAR |
| Referring page | Showing where visits come from | As long as the artwork is in ArtInAR |
| Time of the visit | Visit statistics | As long as the artwork is in ArtInAR |
| Technical cookies | Making the page work | The browser session |
No special categories of personal data are processed. ArtInAR receives no camera images, room images, spatial maps or other environmental data. The augmented-reality view runs entirely in the phone's own viewer (AR Quick Look on iOS, Scene Viewer or the browser's WebXR mode on Android). No advertising or tracking cookies are set on preview pages.
4. Processor obligations
The Processor:
- processes personal data only for the purpose in section 2, and never for its own purposes, for profiling, for AI training or for sale;
- makes sure that everyone who can access the data is bound to confidentiality. At the date of this agreement, that is only the founder of Roesware;
- takes the security measures in section 5;
- uses sub-processors only as set out in section 6;
- helps the Controller, as far as it reasonably can, to answer requests from data subjects (access, correction, deletion, objection, restriction, portability). The Processor forwards any such request it receives to the Controller within 5 working days;
- helps the Controller with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the information available to the Processor;
- makes available all information needed to show compliance with Article 28 GDPR (see section 9).
5. Security measures
The Processor takes these technical and organisational measures (Article 32 GDPR):
- Encryption in transit: all traffic to artinar.app and to the store uses HTTPS (TLS).
- Encryption at rest: store access keys (WooCommerce keys, Shopify tokens) are stored encrypted with AES-256.
- Access control: only the founder of Roesware can access the servers, the database and the admin panel. Store owners only see their own store.
- Least privilege towards the store: ArtInAR only reads products, categories and the dimension setting, and only writes its own
art_in_ar_*product fields and product webhooks. It never reads orders or customers. - Signed webhooks: webhooks from the store are checked against a secret unique to each store.
- Hosting in the EU: application server and file storage are in the EU (see section 6).
- Monitoring: errors and unusual activity are logged and monitored.
6. Sub-processors
The Controller gives general permission for the sub-processors below. Each one is bound by a written agreement with data protection obligations at least as strict as these.
| Sub-processor | What it does | Location |
|---|---|---|
| Virtual server provider, managed with Laravel Forge | Hosting of the application and database | EU |
| Amazon Web Services (S3) | Storage of product photos and 3D models | Frankfurt, Germany |
| Cloudflare | Network, security and delivery of artinar.app | Global network, EU data centres for EU visitors |
| Laravel Nightwatch | Monitoring of errors and performance | United States |
| Fonts and the 3D viewer software loaded on preview pages | United States |
The Processor tells the Controller at least 30 days before adding or replacing a sub-processor. The Controller can object on reasonable data protection grounds within that period. If the parties cannot agree, the Controller can end the Agreement without cost. The Processor remains liable to the Controller for its sub-processors.
7. International transfers
Personal data is processed in the European Economic Area wherever possible. Where a sub-processor in section 6 processes data outside the EEA, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses (2021/914). The Processor does not transfer personal data outside the EEA in any other way without the Controller's prior written permission.
8. Personal data breaches
The Processor tells the Controller without undue delay, and at most 48 hours after becoming aware of it, about any personal data breach that affects the Controller's data. The notice says, as far as known: what happened, which data and roughly how many data subjects are affected, the likely consequences, and the measures taken or proposed. The Processor keeps the Controller informed and helps the Controller notify the supervisory authority and data subjects where required.
9. Audits, deletion, liability and law
Audits. The Processor answers the Controller's reasonable written questions about compliance within 30 days. If that is not enough, the Controller may have an independent auditor, bound to confidentiality, carry out an audit once a year, with at least 30 days' notice. The Controller bears the cost, unless the audit finds a material breach by the Processor.
Deletion and return. When the Agreement ends, or on the Controller's request, the Processor deletes all personal data processed for the Controller within 30 days, unless the law requires it to keep the data. On request, the Processor first provides the visit records in a common format (CSV).
Liability. Each party's liability under this agreement follows the limits in the Agreement, except where the GDPR does not allow those limits.
Duration and law. This agreement runs for as long as the Processor processes personal data for the Controller. Dutch law applies. Disputes go to the competent court in Midden-Nederland.