Konfigrator — Data Processing Addendum

This Addendum forms part of the Konfigrator Terms between ATTICCA REALITIES, S.L. ("Atticca") and the Client identified by the contracting account/order. It governs personal data Atticca processes on that Client's behalf ("Client Personal Data"). The Client is controller and Atticca processor for those operations. If the Client acts for another controller, it must have authority to appoint Atticca as subprocessor and relay lawful instructions.

This Addendum does not govern Atticca's independent processing of common account identity, its own billing, administration or other purposes explained in its Privacy Policy. Each party remains responsible for the roles it actually performs. "Personal data", "processing", "controller", "processor" and "personal data breach" have their GDPR meanings. Applicable data protection law prevails, followed by binding transfer safeguards, this Addendum and then other contract terms.

The subject is operation of the Client's published configurators. Processing comprises receipt, storage, organisation, display, retrieval, account association, export and deletion of configurations and related data. It continues during service delivery and the agreed retention, retrieval and backup periods.

Data subjects are visitors, Customers and authorised Client contacts whose information is included in Client-controlled records. Data comprises email, visitor/account identifiers, Client associations, saved selections/configurations, timestamps, necessary technical metadata and personal data incidentally included in uploaded Content. Special-category data and criminal-conviction information are not intended; the Client must not instruct their processing without a separate lawful arrangement and appropriate safeguards.

The Terms, this Addendum, the Client's authorised settings and verified service requests constitute documented instructions. Atticca processes Client Personal Data only on those instructions, including for international transfers, unless binding law requires otherwise. In that case Atticca informs the Client before processing unless legally prohibited. Atticca promptly informs the Client if an instruction appears to infringe applicable data protection law and may pause that instruction while it is resolved.

The Client determines and documents lawful purposes, legal bases and information given to Customers, maintains accurate public identity/contact details, and ensures its instructions are lawful. Atticca does not sell Client Personal Data, use it for unrelated advertising or train AI models with it, and does not authorise providers to train AI with it.

Atticca restricts processing to authorised people bound by confidentiality and access appropriate to their work. It maintains measures appropriate to the risk and reviews them when material risks or processing change. At minimum its service controls must cover:

Unique authorised accounts, least-privilege access, timely removal of permissions and multifactor authentication for privileged administration.

Tenant separation and access checks covering APIs, database records and files, including visitor-to-account ownership transitions.

Encrypted transport, protection of credentials/secrets and restriction of administrative access.

Risk-based updates, vulnerability handling and incident response responsibilities.

Seven-day database backup rotation, proportionate recovery arrangements and reapplication of deletion records after restoration. Database backups must not be represented as model/file backups.

Retention/deletion controls and access restrictions on legally retained records.

Review of access and appropriate testing of security measures, with records sufficient to support compliance.

These obligations are contractual commitments, not a claim of a particular certification. Atticca may improve measures without materially reducing protection during the processing.

The Client grants general written authorisation for subprocessors used to deliver the agreed service. The initial infrastructure services are Vercel, for application hosting/delivery, and Supabase, for database, storage and authentication-related processing. Entity, function and provider information is set out in the service-provider register accompanying this Addendum. The Supabase primary project region is Ireland; international operational processing is governed by section 5.

Atticca must also include any email/support provider that actually receives Client Personal Data on the Client's behalf in that register before processing starts. Suppliers used solely for Atticca's own controller activities, such as collecting its subscription fees, do not become Client subprocessors merely by appearing in Atticca's Privacy Policy.

Atticca gives at least 30 days' advance notice of an intended new or replacement direct subprocessor, stating identity, function and relevant locations. The Client may object on reasonable data-protection grounds within that notice period. The parties seek a workable solution. If none is available, the Client may terminate the affected processing before the new provider receives its data, with return/deletion assistance and refund of unused prepaid fees for the affected service.

Atticca imposes equivalent data-protection duties by binding contract and remains responsible to the Client for a subprocessor's performance of those duties. Atticca provides the current register and relevant compliance information on request at hello@atticca.io.

Atticca may transfer Client Personal Data only consistently with documented instructions and applicable transfer law. Where required, it implements an adequacy-based route or appropriate safeguards, including the relevant European Commission Standard Contractual Clauses, and assesses supplementary measures. It provides information about the mechanism, recipients and locations and copies of relevant safeguards on request, subject to proportionate confidentiality protections. No clause in these Terms replaces safeguards that must actually be concluded and maintained.

Atticca promptly forwards requests concerning Client-controlled data and assists the Client with access, correction, erasure, restriction, portability and objection, taking account of the processing and available information. It does not answer on the Client's behalf beyond authorised instructions or legal requirements.

Atticca assists with the Client's obligations concerning security, breach assessment/notification, impact assessments and prior regulatory consultation, to the extent relevant to its services and available information.

On becoming aware of a personal data breach affecting Client Personal Data, Atticca notifies the Client without undue delay. Initial notice is not postponed until all facts are known. It supplies known information on the nature and scope, affected records/persons where possible, likely consequences, mitigation and contact, with follow-up information as it becomes available. The Client remains responsible for its controller notifications; Atticca meets its own direct legal obligations.

At the Client's choice, Atticca returns Client Personal Data in the usable formats described in the Terms and deletes it, or deletes it directly, after the service ends, unless binding law requires retention. Instructions to delete accounts/models and the agreed retention rules apply during the relationship as well.

Ordinary plan reductions retain excess models/configurations for six months for recovery. Unlinked visitor configurations expire after seven days. Confirmed account deletion does not create a six-month recovery right. Switching and protected retrieval periods under the Terms take priority over conflicting routine cleanup dates.

Active deletion is followed by expiry of residual database copies within seven days. Retained legal records are segregated, access-restricted and deleted when the applicable purpose ends. Atticca can confirm completion of instructed deletion on request. Common Customer identities maintained independently for other Clients are not Client Personal Data subject to deletion solely because this Client closes its account.

Atticca makes information reasonably necessary to demonstrate compliance available and permits and contributes to audits or inspections by the Client or its authorised independent auditor. The parties coordinate reasonable scope, notice and confidentiality to protect other customers and security; these arrangements must not prevent an urgent or legally required audit. Existing independent evidence may be used where it adequately addresses the issue, without eliminating required inspection rights. Authorities retain their statutory powers.

Each party promptly informs the other of material circumstances preventing compliance and cooperates in corrective action. The Client may suspend affected processing or end the affected service where a material breach cannot be remedied within a reasonable period. Nothing in this Addendum limits rights of data subjects or obligations that applicable law does not permit the parties to exclude.