Data processing agreement

1. Parties and subject matter

The Client, a professional subscribing to DrawThink, acts as controller for the data of its own customers and prospects. RENDERTHINK, a French SAS, 17 rue Louis Pasteur, 38400 Saint-Martin-d’Hères, France, registered with the Grenoble Trade and Companies Register under number 102 977 147 (“RenderThink”), acts as its processor.

This Agreement does not cover the data of Users’ accounts or of the subscription: RenderThink processes that data as a controller, under its privacy policy.

For that data, please read our privacy policy

Terms used in this Agreement have the meaning given to them by the GDPR (Article 4) and, for those specific to the Service, by the terms of use.

2. Description of the processing

Subject matter:

enabling the AI assistant chosen by the Client to work in InSitu or KitchenDraw on the Client’s projects, and keeping what is needed to resume those projects from one session to the next.

Nature of the operations:

reading, at the AI assistant’s request, the scene, quotation and images of the open project, and sending them to the Client’s AI assistant; calculations, checks and reviews; storing project data, the style learned from a User’s past projects, the assistant memory and the Workspace’s 3D object library; preparing 3D models; hosting.

Purpose:

solely to provide the Service to the Client, to the exclusion of any other purpose.

Data processed:

the data the Client or its Users include in their projects, quotations, assistant memory, 3D object library or support requests: in particular the name or customer reference of a project, which may name the end customer; the end customer’s request and requirements; the plans and features of their home (rooms, dimensions, openings, technical points, ceiling); the items chosen and the quotation amounts; and, where they appear in what the assistant reads, the identity and contact details of the end customer.

Sensitive data:

the Service is not intended to process the special categories of data referred to in Article 9 of the GDPR; the Client undertakes not to submit any.

Data subjects:

the Client’s customers and prospects, and any other person whose data the Client includes in its projects.

Duration:

the term of the Client’s subscription and of the retention of its Workspace, followed by the time needed to return and delete the data (see “End of processing”).

Data minimization: the tools do not read, on their own initiative, the end customer’s contact details held by the Design Software; the assistant only receives them if a User gives them to it or has it read them. The assistant cannot keep a customer’s name, address, phone number or email in the memory.

3. The Client’s instructions

RenderThink processes the data only on the Client’s documented instructions. This Agreement, the terms of use and the use of the Service by the Client’s Users, directly or through their AI assistant, constitute those instructions.

RenderThink immediately informs the Client if, in its opinion, an instruction infringes the GDPR or other data protection rules. Where Union or Member State law requires RenderThink to carry out processing, it informs the Client before doing so, unless that law prohibits it.

4. Confidentiality

The persons RenderThink authorizes to process the data are bound by confidentiality and only access it to the extent necessary for the Service (support, security, maintenance). The team console does not show project data. Every change the team makes to an account is logged.

5. Security

RenderThink implements appropriate technical and organizational measures within the meaning of Article 32 of the GDPR, including:

• Hosting in France, with OVHcloud; 3D object files with Cloudflare, in the European Union; a copy of the database backups with Cloudflare, in Western Europe
• Encryption of communications (HTTPS and TLS)
• Hashed passwords and two-factor authentication; restricted team console, with two-factor authentication, and changes logged
• Workstations authenticated by a key specific to the PC, which Windows keeps without allowing it to be exported; instructions signed by the server and verified by the plugin
• Separation of each Workspace’s data, checked in every request
• Secrets entrusted by Users (Sketchfab key) encrypted at rest
• 3D models from the Internet prepared in an isolated process, with no network or database access
• Scenes, quotations and images in transit only; logs kept for limited periods, without scene content

6. Sub-processors

The Client authorizes RenderThink to engage the following sub-processors for the data covered by this Agreement:

• OVH SAS (OVHcloud), France: hosting of the server, the database, its backups and the queues, in France
• Cloudflare, Inc., United States: storage of the files of the 3D object library and of files sent for preparation, in the European Union, and of a copy of the database backups, in Western Europe
• Microsoft (Microsoft 365): the mailbox that receives emails written to contact@drawthink.app

RenderThink’s other service providers (Stripe, Resend, PostHog, and Google and Microsoft for sign-in) only receive account, subscription or usage data, which RenderThink processes as a controller; they are listed in the privacy policy.

RenderThink informs the Client by email of any addition or replacement of a sub-processor at least 30 days in advance. The Client may object on data protection grounds within 15 days of that notice; failing agreement, it may cancel its subscription free of charge before the new sub-processor starts processing.

RenderThink imposes on each sub-processor data protection obligations equivalent to those of this Agreement, and remains liable to the Client for their performance.

The publisher of the AI assistant is not a sub-processor of RenderThink: the Client chooses it and contracts with it directly, and the data its assistant reads is sent to it on the Client’s instructions. It is for the Client to enter into the commitments required by the GDPR with that publisher, preferably under a plan designed for professionals. Nor is Sketchfab: a User connects their own account there, under their own terms, and RenderThink only sends it the assistant’s searches and the key of that account, never any project data.

7. Place of processing and transfers outside the European Union

The data covered by this Agreement is hosted in France, and the 3D object files in the European Union. A sub-processor established outside the European Union only accesses it with the safeguards provided for in Articles 44 et seq. of the GDPR: an adequacy decision, such as the one for the EU-U.S. Data Privacy Framework, or the European Commission’s standard contractual clauses.

The data the Client has its AI assistant read is sent to that assistant’s publisher, under the Client’s responsibility.

8. Assistance to the Client

Taking into account the nature of the processing and the information available to it, RenderThink assists the Client:

• In responding to requests from data subjects: a request received directly is forwarded to the Client without delay, and RenderThink does not answer it itself unless instructed by the Client
• In ensuring the security of the processing and notifying personal data breaches
• In carrying out a data protection impact assessment and, where necessary, consulting the supervisory authority

The Client’s workspace provides the means to view, correct, delete and reset the assistant memory, remove an object from the library, export its data, including project data for the Owner, and ask support there to delete its account. A User can also have their assistant forget the style learned from their projects.

9. Personal data breaches

RenderThink notifies the Client of any breach of the data covered by this Agreement without undue delay after becoming aware of it, so that the Client can meet its own 72-hour deadline with the supervisory authority.

The notification describes, where possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. Information not yet known is provided as soon as possible.

10. End of processing

At the end of the subscription, access to the Service closes, but the Workspace’s data is kept for as long as the Workspace exists, so that the Client can come back or retrieve it. The Owner retrieves it using the export in its workspace (the files of the 3D objects are also in the cache of the Workspace’s PCs), then has it deleted by asking support to delete its account from its workspace, or by simple request to contact@drawthink.app.

RenderThink then erases the Workspace, its project data, its library and its files, and the Owner’s account with its memory, unless a legal retention obligation applies. Each Member has a personal account, whose deletion they request themselves; leaving the Workspace does not erase it. Logs are erased at the end of the periods set out in the privacy policy, and backups when they are renewed (thirty days at most).

11. Audits

RenderThink makes available to the Client the information needed to demonstrate compliance with Article 28 of the GDPR. The Client may have an audit carried out, by itself or by an independent auditor bound by confidentiality, subject to reasonable prior written notice, without disrupting the Service or accessing other clients’ data; the costs of the audit are borne by the Client.

12. The Client’s obligations

The Client undertakes to:

• Have a legal basis for the data it entrusts to the Service, and inform the data subjects
• Only entrust the Service with the data that is necessary, and no sensitive data; not include in project names, requests and files more of its customers’ data than needed
• Choose its AI assistant, enter into the commitments required by the GDPR with its publisher and, where applicable, inform the data subjects
• Ensure that its Users comply with this Agreement

13. Term, liability and governing law

This Agreement applies for as long as RenderThink processes data on behalf of the Client. Each party’s liability, the governing law and the competent court are those of the terms of use, without prejudice to the rights the GDPR grants to data subjects.

See our terms of use

14. Contact

For any question about this Agreement, or to report a request or an incident, write to contact@drawthink.app.