Data Processing Agreement (DPA)
Effective date: 26 August 2026
Last updated: 26 August 2026
1. Purpose of This Agreement
This Data Processing Agreement, referred to as the “DPA,” governs the processing of personal data by 3D CGI Studio S.L. on behalf of a customer in connection with software development, SaaS, website development, hosting, maintenance, support or other contracted services.
This DPA applies when:
The customer determines the purposes and means of processing personal data;
3D CGI Studio S.L. processes that personal data on the customer’s behalf;
The General Data Protection Regulation or another applicable data-protection law requires a controller–processor agreement.
This DPA forms part of the applicable quotation, statement of work, service agreement, order confirmation or other agreement between the parties, referred to as the “Service Agreement.”
2. Parties
2.1 Controller
The “Controller” is the customer identified in the applicable Service Agreement.
The Controller determines the purposes and means of processing the personal data covered by this DPA.
2.2 Processor
The “Processor” is:
3D CGI Studio S.L.
Ctra. de Churra 55
30007 Murcia
Spain
NIF/VAT ID: B25996109
Email: in**@*********io.com
Telephone: +34 622 578 968
The Processor processes personal data on behalf of the Controller only as necessary to provide the contracted services.
3. Definitions
For the purposes of this DPA:
Applicable Data Protection Law means the General Data Protection Regulation, the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, and any other data-protection law applicable to the processing.
Controller means the party that determines the purposes and means of processing personal data.
Processor means the party that processes personal data on behalf of the Controller.
Data Subject means an identified or identifiable natural person whose personal data are processed.
Personal Data means information relating to an identified or identifiable natural person.
Processing includes collecting, accessing, recording, organising, storing, modifying, retrieving, consulting, using, transmitting, restricting, deleting or otherwise handling personal data.
Personal Data Breach means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.
Subprocessor means another processor engaged by the Processor to process personal data on behalf of the Controller.
Special Category Data means personal data covered by Article 9 of the GDPR, including certain health, biometric, genetic, political, religious, trade-union or sexual-life information.
Services means the services described in the applicable Service Agreement.
Terms not defined in this DPA have the meanings given to them in Applicable Data Protection Law.
4. Scope and Duration
The subject matter, duration, nature and purpose of the processing, together with the categories of personal data and Data Subjects, are described in:
The Service Agreement;
Schedule 1 of this DPA;
The Controller’s documented instructions.
This DPA remains in force for as long as the Processor processes personal data on behalf of the Controller.
The processing will end when:
The Services involving personal data have ended;
The Service Agreement has been terminated;
All personal data have been returned or deleted as required by this DPA;
Applicable law requires continued retention.
5. Controller Obligations
The Controller confirms that:
It has a valid legal basis for the processing;
Personal data have been collected and disclosed lawfully;
Data Subjects have received all required privacy information;
Its instructions comply with Applicable Data Protection Law;
The processing is necessary and proportionate;
It will not instruct the Processor to process personal data unlawfully;
It will not provide unnecessary personal data;
It will identify any special security or regulatory requirements before processing begins;
It will respond to questions concerning the legality of its instructions;
It remains responsible for decisions regarding the purposes and means of processing.
The Controller is responsible for the accuracy, quality and lawfulness of the personal data and for determining whether the Services are appropriate for the intended processing.
6. Processing Instructions
The Processor will process personal data only:
On documented instructions from the Controller;
As necessary to perform the Service Agreement;
As described in this DPA;
As required by applicable law.
The Service Agreement, this DPA, written project instructions, support requests and configuration choices made by the Controller constitute documented instructions.
If the Processor believes that an instruction infringes Applicable Data Protection Law, it will inform the Controller without undue delay and may suspend the affected processing until the instruction is clarified, modified or withdrawn.
If the Processor is legally required to process personal data beyond the Controller’s instructions, the Processor will inform the Controller before processing unless the applicable law prohibits such notice.
The Processor will not:
Sell personal data;
Use personal data for unrelated marketing;
Determine new independent purposes for customer data;
Disclose personal data except as authorised by this DPA, the Controller or applicable law.
7. Confidentiality
The Processor will ensure that persons authorised to process personal data:
Are subject to appropriate confidentiality obligations;
Receive access only where required for their work;
Are informed of relevant data-protection and security responsibilities;
Process personal data only in accordance with authorised instructions.
Confidentiality obligations continue after access ends or the relevant person’s engagement terminates.
8. Security Measures
Taking into account the state of the art, implementation costs, nature and scope of the processing, and the risks to Data Subjects, the Processor will implement appropriate technical and organisational measures designed to protect personal data.
The applicable measures are described in Schedule 2 and may include:
Access controls;
Role-based permissions;
Password and authentication controls;
Encryption in transit;
Encryption at rest where appropriate;
Secure software-development practices;
System and software updates;
Malware and threat protection;
Backup and recovery processes;
Logging and monitoring;
Confidentiality obligations;
Incident-management procedures;
Restrictions on production-data access;
Secure deletion;
Supplier and Subprocessor controls.
The Controller acknowledges that security measures may evolve over time. The Processor may update the measures provided that the overall level of protection is not materially reduced.
9. Access to Personal Data
The Processor will limit access to personal data to persons who reasonably require access to provide the Services.
Where practical, development and testing should use:
Anonymised data;
Pseudonymised data;
Synthetic test data;
Limited datasets.
The Controller should not provide live production data where representative test data are sufficient.
Credentials must be transferred through an agreed secure channel. Each party is responsible for protecting credentials under its control.
10. Special Category and Highly Sensitive Data
The Controller must not provide Special Category Data, criminal-conviction data, payment-card data, government identification documents or similarly sensitive information unless:
The processing is expressly described in the Service Agreement or Schedule 1;
The Processor has approved the processing in writing;
Appropriate legal grounds and safeguards are in place;
Any additional security requirements have been agreed.
If the Processor receives such information unexpectedly, it may isolate, return or securely delete the information and request further instructions.
11. Subprocessors
The Controller grants the Processor general written authorisation to engage Subprocessors where reasonably necessary to provide the Services.
The Processor will:
Use Subprocessors that provide sufficient data-protection and security assurances;
Enter into a written agreement imposing materially equivalent data-protection obligations;
Limit the Subprocessor’s access to what is necessary;
Remain responsible for the Subprocessor’s performance of its data-protection obligations as required by applicable law;
Maintain a current list of relevant Subprocessors;
Inform the Controller of intended additions or replacements where required.
Relevant Subprocessors may include providers of:
Hosting and cloud infrastructure;
Data storage and backups;
Email and communications;
Project management and collaboration;
File transfer;
Monitoring and security;
Technical support;
Software development;
Content-delivery services.
The initial Subprocessors are identified in Schedule 3, the Service Agreement or a separate Subprocessor List supplied to the Controller.
The Processor will provide reasonable advance notice of a new Subprocessor where the change materially affects the processing.
The Controller may object on reasonable data-protection grounds. The parties will work in good faith to resolve the objection. If no reasonable alternative is available, either party may terminate the affected portion of the Services in accordance with the Service Agreement.
12. International Transfers
The Processor will not transfer personal data outside the European Economic Area, or permit access from outside the European Economic Area, unless an applicable legal transfer mechanism is in place.
Such mechanisms may include:
An adequacy decision adopted by the European Commission;
The EU–US Data Privacy Framework where the recipient is validly certified;
Standard Contractual Clauses approved by the European Commission;
Binding Corporate Rules;
Another legally permitted safeguard or exception.
Where the Standard Contractual Clauses are required, the parties agree to incorporate the applicable modules into this DPA.
Where 3D CGI Studio S.L. acts as a processor and a non-EEA recipient acts as a Subprocessor, the controller-to-processor or processor-to-processor module will be selected as appropriate.
The Processor will implement supplementary safeguards where reasonably required following an assessment of the transfer.
The Controller authorises transfers described in the applicable Service Agreement, Schedule 3 or Subprocessor List, subject to the required legal safeguards.
13. Data Subject Requests
If the Processor receives a request from a Data Subject concerning personal data processed on behalf of the Controller, the Processor will:
Notify the Controller without undue delay;
Not respond substantively unless authorised by the Controller or required by law;
Provide reasonable assistance where technically and operationally possible.
Requests may include access, correction, deletion, restriction, portability or objection.
The Controller remains responsible for:
Verifying the Data Subject’s identity;
Determining whether the request is valid;
Responding within the applicable statutory period;
Providing the legal response.
Where assistance requires substantial work beyond the normal Services, reasonable fees may apply if permitted by law and agreed with the Controller.
14. Personal Data Breaches
The Processor will notify the Controller without undue delay after becoming aware of a confirmed Personal Data Breach affecting personal data processed under this DPA.
Where information is available, the notification will include:
A description of the nature of the breach;
The categories of affected personal data;
The categories and approximate number of affected Data Subjects;
The likely consequences;
Measures taken or proposed;
Contact information for follow-up;
Information reasonably required for the Controller’s assessment.
Information may be provided in phases where complete details are not immediately available.
The Processor will take reasonable steps to:
Contain the breach;
Investigate its cause;
Mitigate reasonably foreseeable harm;
Prevent a recurrence;
Preserve relevant evidence.
The Controller is responsible for determining whether notification to a supervisory authority or affected Data Subjects is required.
A breach notification by the Processor does not constitute an admission of fault or liability.
15. Data Protection Impact Assessments
The Processor will provide reasonable assistance where the Controller is required to conduct:
A data-protection impact assessment;
A risk assessment;
Prior consultation with a supervisory authority.
The assistance will be limited to information available to the Processor concerning the Services and its processing activities.
Substantial assistance outside the agreed Services may be subject to reasonable additional fees.
16. Records and Regulatory Cooperation
The Processor will maintain records required by applicable law concerning processing performed on behalf of controllers.
The Processor will reasonably cooperate with the Controller and competent supervisory authorities regarding the processing covered by this DPA.
Each party is responsible for its own regulatory obligations.
17. Audit and Compliance Information
The Processor will make available information reasonably necessary to demonstrate compliance with Article 28 of the GDPR.
The Controller may request a reasonable audit where:
Required by a competent authority;
A material security incident has affected the Controller’s personal data;
Reasonable evidence indicates material non-compliance;
Applicable law requires an audit.
Before requesting an on-site audit, the Controller should first review available documentation, certifications, questionnaires and remote evidence.
Audits must:
Be conducted during normal business hours;
Be arranged with reasonable advance notice;
Avoid unreasonable disruption;
Protect other customers’ information;
Be conducted by qualified persons subject to confidentiality;
Be limited to systems and information relevant to the Controller.
The Controller bears its audit costs. If an audit reveals material non-compliance by the Processor, the Processor will bear reasonable remediation costs attributable to that non-compliance.
18. Return and Deletion of Personal Data
At the end of the Services involving personal data, the Processor will, at the Controller’s choice and subject to technical feasibility:
Return the relevant personal data;
Make the data available for export;
Securely delete the personal data.
The Processor may retain personal data where required by applicable law. Retained information will remain protected and will not be processed for another purpose.
Personal data may remain temporarily in routine backup systems until overwritten according to the Processor’s backup-retention cycle. During that period, the data will remain protected and isolated from ordinary business use.
The Controller must request any required export before the Service Agreement ends or within the agreed post-termination period.
19. Notification and Contact
Data-protection communications concerning this DPA should be sent to:
3D CGI Studio S.L.
Ctra. de Churra 55
30007 Murcia
Spain
Email: in**@*********io.com
Telephone: +34 622 578 968
The Controller’s data-protection contact will be the contact identified in the Service Agreement or Schedule 1.
Each party must notify the other party if its relevant contact details change.
20. Liability
Liability arising under this DPA is subject to the limitations and exclusions in the Service Agreement, except where such limitations are prohibited by Applicable Data Protection Law.
Nothing in this DPA limits:
Data Subjects’ statutory rights;
A supervisory authority’s powers;
Liability that cannot lawfully be limited;
Either party’s responsibility for its own infringement of Applicable Data Protection Law.
Each party is responsible for damage caused by its processing to the extent specified by applicable law.
21. Priority and Conflict
If there is a conflict concerning personal-data processing, the following order of precedence applies:
Mandatory Applicable Data Protection Law;
Applicable Standard Contractual Clauses;
This DPA;
The Service Agreement;
Other project documents.
Except for the data-protection provisions addressed by this DPA, the Service Agreement remains unchanged.
22. Governing Law and Jurisdiction
Unless the Service Agreement provides otherwise, this DPA is governed by Spanish law.
For business-to-business agreements, the courts of Murcia, Spain have jurisdiction, subject to any mandatory jurisdiction requirements in Applicable Data Protection Law or applicable Standard Contractual Clauses.
23. Amendments
The Processor may update this standard DPA where reasonably necessary to:
Comply with changes in applicable law;
Adopt new regulatory clauses;
Reflect changes to the Services;
Improve data-protection provisions.
An update will not materially reduce the protection of personal data.
Material changes affecting an active Service Agreement will be communicated to the Controller. Project-specific changes require written agreement where legally necessary.
24. Acceptance
This DPA becomes binding when:
It is signed by both parties;
The Service Agreement expressly incorporates it;
The Controller accepts a quotation or order that references it;
The parties otherwise agree to it electronically or in writing.
Electronic acceptance and electronic signatures are permitted.
Schedule 1: Details of Processing
This Schedule must be completed in the Service Agreement, statement of work or project documentation.
1. Controller
Legal name: To be identified in the Service Agreement
Registered address: To be identified in the Service Agreement
Contact person: To be identified in the Service Agreement
Data-protection contact: To be identified in the Service Agreement
2. Processor
3D CGI Studio S.L.
Ctra. de Churra 55
30007 Murcia
Spain
Email: in**@*********io.com
3. Subject Matter
The processing of personal data necessary to provide the software development, SaaS, website development, hosting, maintenance, support, migration, integration or other services described in the Service Agreement.
4. Duration
For the duration of the Service Agreement and any agreed transition, support, backup or deletion period.
5. Nature and Purpose of Processing
Depending on the Services, processing may include:
Accessing customer systems;
Collecting and importing data;
Hosting and storing data;
Organising and structuring data;
Developing and testing software;
Migrating data;
Troubleshooting and support;
Maintaining databases;
Creating backups;
Transmitting data;
Restricting, exporting or deleting data.
Only the processing required for the specific project is authorised.
6. Categories of Data Subjects
Depending on the project, Data Subjects may include:
Controller employees;
Contractors;
Customers and prospective customers;
Members;
Users;
Suppliers;
Business contacts;
Website visitors;
Portal users;
Other persons whose data are entered into the relevant system.
The applicable categories must be confirmed in the project documentation.
7. Categories of Personal Data
Depending on the project, personal data may include:
Names;
Business contact details;
Email addresses;
Telephone numbers;
Postal addresses;
Account and user identifiers;
Organisational information;
Job titles and roles;
Authentication and access records;
Communications;
Uploaded documents;
Support information;
Transaction and project records;
Technical logs;
IP addresses and device information;
Other data expressly identified in the project documentation.
8. Special Category Data
Special Category Data are not authorised unless expressly identified and approved in the Service Agreement or an additional written instruction.
9. Processing Frequency
Processing may occur continuously, periodically or on request for the duration of the Services, depending on the project.
10. Retention and Deletion
Personal data will be retained for the duration of the Services and deleted or returned following termination, subject to:
The Controller’s instructions;
Agreed backup cycles;
Technical limitations;
Mandatory legal-retention requirements;
The specific retention provisions in the Service Agreement.
Schedule 2: Technical and Organisational Measures
The measures applied to a specific project will reflect the nature of the Services and the risks associated with the processing.
1. Access Control
Measures may include:
Individual user accounts;
Role-based access;
Least-privilege permissions;
Strong password requirements;
Multi-factor authentication where supported and appropriate;
Regular access reviews;
Prompt removal of unnecessary access;
Restrictions on administrative privileges.
2. Confidentiality
Measures may include:
Contractual confidentiality obligations;
Confidentiality provisions for personnel and contractors;
Access limited to authorised persons;
Data-protection and security awareness;
Restrictions on downloading or copying production data.
3. Encryption and Transmission
Measures may include:
HTTPS/TLS encryption for data transmitted over public networks;
Encrypted administrative connections;
Encryption at rest where appropriate and supported;
Secure credential-transfer procedures;
Avoidance of unencrypted sensitive-data transmission.
4. System Security
Measures may include:
Secure configuration;
Supported software versions;
Security updates and patches;
Malware protection;
Firewalls and hosting-provider security controls;
Vulnerability remediation;
Separation of development and production environments where appropriate.
5. Secure Development
Measures may include:
Source-code access restrictions;
Version control;
Code review where appropriate;
Input validation;
Authentication and authorisation controls;
Dependency management;
Testing before production deployment;
Avoidance of live personal data in development where possible;
Logging without unnecessary personal data.
6. Availability and Recovery
Measures may include:
Appropriate backups;
Backup-access restrictions;
Recovery procedures;
Hosting redundancy where included in the Services;
Incident-response procedures;
Monitoring of critical systems where included.
No backup, hosting or monitoring obligation exists unless included in the Service Agreement.
7. Logging and Monitoring
Measures may include:
Administrative-access logging;
Application and security logs;
Error monitoring;
Review of suspicious activity;
Appropriate log-retention limits;
Protection of logs against unauthorised alteration.
8. Data Minimisation
Measures may include:
Processing only necessary data;
Limiting fields and imports;
Using test or synthetic data;
Pseudonymisation where appropriate;
Avoiding unnecessary copies;
Limiting retention periods.
9. Incident Management
Measures may include:
Internal incident reporting;
Investigation procedures;
Containment and remediation;
Notification escalation;
Preservation of relevant evidence;
Post-incident corrective action.
10. Deletion and Disposal
Measures may include:
Secure account deletion;
Database deletion or anonymisation;
Controlled removal of project files;
Expiry of backup copies through normal retention cycles;
Secure disposal of storage media where applicable.
11. Subprocessor Management
Measures may include:
Supplier assessment;
Contractual data-protection terms;
Access restrictions;
Review of security information;
International-transfer safeguards;
Monitoring of material service changes.
12. Review of Measures
Technical and organisational measures may be reviewed and updated according to:
Changes in risk;
Changes in technology;
Changes in the Services;
Security incidents;
Legal or regulatory developments.
Schedule 3: Approved Subprocessors
The Processor will identify the Subprocessors relevant to each project in:
The Service Agreement;
The applicable statement of work;
An attached Subprocessor List;
A maintained online Subprocessor List referenced by the Service Agreement.
The list should contain:
Subprocessor name;
Service provided;
Processing location;
Categories of personal data;
Transfer mechanism where applicable.
Only Subprocessors relevant to the applicable Services are authorised.
English 
Español 
Deutsch