Data processing addendum

This Data Processing Addendum ("DPA") forms part of the terms of service between the merchant using the RenderX app ("Merchant", controller) and Visibrix, Test address ("The RenderX", processor). It applies where The RenderX processes personal data on the Merchant's behalf under the GDPR, the UK GDPR, or similar laws.

1. Roles

• For data about shoppers on the Merchant's store, and for the Merchant's design files and links, the Merchant is the controller and The RenderX is the processor.
• For merchant account data (store details, contact email, login sessions, billing status, support messages), The RenderX is an independent controller, as described in the privacy policy.

2. Subject matter and duration

The RenderX processes data to provide the app as described in the terms, for as long as the app is installed, and then until deletion as described in section 9.

3. Nature and purpose

Converting and displaying the Merchant's 3D jewellery models; collecting anonymous viewer analytics to report them to the Merchant; supporting the Merchant.

4. Categories of data and data subjects

Shoppers (visitors to the Merchant's store). Viewer events only: event type, 3D product, time, a random per-tab session id held in page memory (no cookie, no device storage), device type, country, load time and error messages. No IP addresses, names, emails, customer ids or order data are stored. This data is designed to be anonymous; we nevertheless handle it under this DPA.

Merchant staff. Names and emails Shopify shares when staff log in to the web dashboard.

Merchant content. .3dm design files (stored only in "Upload file" mode with "Keep my original" ticked), encrypted links (in "From a link" mode; the linked file itself is never saved), and product references. No special categories of data are processed.

5. Processor obligations

The RenderX will:

• process the data only on the Merchant's documented instructions, which are these terms and the Merchant's settings in the app (including switching analytics off);
• ensure that people authorised to process the data are bound by confidentiality;
• implement the security measures in section 7;
• help the Merchant respond to data subject requests and with data protection impact assessments, taking into account the nature of the processing and the (anonymous) data involved;
• notify the Merchant without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Merchant's data;
• make available the information necessary to demonstrate compliance with this DPA, and allow reasonable audits (normally by written questionnaire, at most once a year, with 30 days' notice).

6. Sub-processors

The Merchant authorises these sub-processors:

Sub-processor	Purpose	Location
DigitalOcean	Hosting, database, stored originals, backups	Hostinger
Shopify	App platform, App Proxy, Shopify Files and CDN, billing	Shopify's infrastructure
Cloudflare	Content delivery of the On hand 3D hand files to shoppers (sees request IP addresses; no data stored by The RenderX)	Cloudflare's global network
Hostinger	Transactional email	Per the provider

The RenderX will give at least 30 days' notice of a new sub-processor by updating this page and emailing the Merchant; the Merchant may object and, if we can't address the objection, uninstall without penalty. The RenderX imposes data protection obligations on sub-processors equivalent to this DPA and remains responsible for them.

7. Security measures

• TLS for all traffic; the database is not exposed to the internet.
• Links encrypted at rest (AES-256-GCM); never logged or shown in full.
• Stored originals are private: never served to shoppers or anyone else, only back to the merchant's own signed-in admin (to re-convert them or export an STL).
• The link fetcher blocks private and internal network addresses on every redirect.
• Every query is scoped to the Merchant's store.
• Shopify webhook and App Proxy signatures are verified.
• Admin access requires an allow-listed account with two-factor authentication; access to a store's data is read-only and audited.
• Nightly backups, kept for 14 days.

8. International transfers

Where data is transferred outside the EEA or the UK to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), which are incorporated by reference.

9. Deletion and return

Merchants can delete their stored originals, links and 3D products in the app at any time. After uninstall: stored originals and product records are deleted after 48 hours (unless the app is reinstalled), and all of the Merchant's data, including analytics, is deleted on Shopify's shop/redact request. Backups roll off within 14 days. Display models and pictures are in the Merchant's own Shopify Files and remain under the Merchant's control.

10. Precedence

If this DPA conflicts with the terms, this DPA prevails for the processing of personal data.

Contact

Data protection questions: manthanzlj@gmail.com.