Data Processing Addendum

Thridify is run by three companies in the same group. Which one you deal with depends on where you are. For a business account, that is the country of the business’s billing address.

• India: Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India). It is the data fiduciary for your personal data under Indian law.
• European Union and United Kingdom: Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia). It is the controller of your personal data under the GDPR and the UK GDPR.
• Everywhere else: 14818032 Canada Inc. (Burlington, Ontario, Canada). It is the controller of your personal data.

The three companies share engineering, hosting and support, and each processes personal data for the others under a written intra-group agreement. In this document “Thridify”, “we” and “us” mean whichever of them you deal with.

This Data Processing Addendum (“DPA”) is between Thridify (“Processor”) and the customer that accepts the Thridify Platform Terms (“Controller”). It applies to personal data about the Controller’s shoppers, website visitors and enquirers that the Processor handles for the Controller through Thridify: the 3D and AR viewer embedded on the Controller’s own sites, links on viewer.thridify.com, lead forms, shared configurations and quotes, integrations such as our WooCommerce plugin, and AI tools used on the Controller’s content. It forms part of the Platform Terms and takes effect when they do.

For personal data of people in India, the Controller is the data fiduciary and the Processor is its data processor under the Digital Personal Data Protection Act, 2023. Data we receive through our Shopify app is covered by the Thridify for Shopify Data Processing Addendum instead.

For Controllers in the European Union or the United Kingdom, the Processor is Aapastech OÜ and this DPA is the contract required by Article 28 of the GDPR and of the UK GDPR.

• Purpose: showing 3D and AR product experiences on the Controller’s sites and links; letting shoppers configure, save, share and personalise products and send enquiries; sending the shared configurations and quotes the Controller asks us to send; reporting which views, leads, carts and orders followed a 3D or AR view; and running AI features on content the Controller submits.
• Data subjects: visitors to the Controller’s sites and Thridify links, shoppers, people who send the Controller an enquiry, and people shown in images the Controller or a shopper uploads.
• Viewer events: the product and experience viewed and how it was used, the page address, referrer and campaign tags, the device type and whether it supports AR. A session ID is kept in the browser’s memory. Where the consent signal on the page allows it, the viewer also stores a session ID and a visitor ID in the browser.
• Location: an approximate location (country, region, city) that YOM, our analytics service, works out from the IP address. YOM does not store IP addresses.
• Leads and quotes: when the Controller turns on lead collection, a shopper’s name and email address, and optionally phone number and city, with the configuration they saved and any quote the Controller sends them.
• Personalisation: images or other content a shopper uploads to personalise a product.
• Orders: where the Controller connects an order integration, order IDs, amounts, currency and the link to a 3D view. If the Controller turns on order attribution in a plugin such as WooCommerce, a first-party cookie, _thridify_3d, links an order to a 3D view.
• AI tools: images and other content the Controller submits to our AI features, which may show people.
• Duration: while the Controller uses Thridify, and then until the data is deleted under section 8.

The Processor processes this data only to provide Thridify to the Controller, as the Controller configures it, and as the Platform Terms allow, including building anonymous statistics under their section on aggregated data. If the Processor believes an instruction breaks data protection law, it will tell the Controller.

The Controller decides what personal data Thridify collects for it, for example by turning on lead forms or connecting its own analytics or advertising accounts. It must have a lawful basis for that data, tell its shoppers about it in its own privacy notice, and get any consent the law requires. The viewer stores IDs in the browser, and forwards events to the Controller’s own analytics or advertising accounts, only when the consent signal on the page allows it. The Controller should not use Thridify to collect sensitive personal data.

People with access to the data are bound by confidentiality. The Processor keeps the security measures in Annex 2 in place and may improve them over time, but will not make them weaker.

The Controller authorises the sub-processors in Annex 3. The Processor will give at least 30 days’ notice of a new sub-processor, by email or in the product. The Controller may object on reasonable data protection grounds, and may close its account if the objection cannot be resolved. The Processor holds each sub-processor to data protection terms at least as protective as this DPA and remains responsible for its sub-processors.

The Processor helps the Controller answer requests from individuals (access, correction, erasure, withdrawal of consent, nomination and grievances), and helps with data protection impact assessments and regulator enquiries about Thridify, within the Controller’s deadlines. If such a request reaches the Processor directly, it passes it on to the Controller without delay, unless the law requires otherwise. Write to our Privacy Officer, Shikha Gupta, at contact@aapastech.com.

The Processor will notify the Controller of a personal data breach affecting the Controller’s data without undue delay, and no later than 48 hours after becoming aware of it. The notice will describe what happened, the data and people affected as far as known, and the steps taken. Where the CERT-In Directions apply to an incident on our systems, we also report it to CERT-In within 6 hours.

• Deletion: the Controller can delete records or ask us to delete them at any time. When the Platform Terms end, the Processor deletes the Controller’s personal data as their section on ending the terms describes. It keeps only what the law requires. From 13 May 2027 Indian law will also require us to keep personal data, related traffic data and processing logs for one year from processing. From then, when we delete data from our systems we will keep a sealed copy for the rest of that year, which nobody uses except to meet that legal duty, and then destroy it.
• Transfers: data may be processed outside the Controller’s country, by the sub-processors in Annex 3. Transfers out of India follow section 16 of the Digital Personal Data Protection Act, 2023, and no data goes to a country the Government of India restricts. For Controllers in the European Union or the United Kingdom, transfers to 14818032 Canada Inc. rely on the adequacy decisions for Canada, and transfers to Aapastech Private Limited in India and to sub-processors in other countries without an adequacy decision rely on the European Commission’s Standard Contractual Clauses (Module 3) with the UK International Data Transfer Addendum.
• Audits: on request, the Processor provides the information needed to show it meets this DPA. Where that is not enough, the Controller may audit once a year on 30 days’ notice, at its own cost, under confidentiality.

Each party’s liability under this DPA is governed by the liability section of the Platform Terms, under which the limit for breaches of data protection obligations is three times the general limit. This DPA is governed by the same law, and disputes go to the same forum, as the Platform Terms, except where data protection law requires another law or forum (for example, the EU Standard Contractual Clauses, which follow the law and courts they specify). If this DPA and the Platform Terms conflict on data protection, this DPA applies.

See section 2.

• TLS on every public endpoint.
• Encryption at rest provided by our hosting and database providers.
• Access to production systems limited to staff who need it.
• Secrets kept in managed secret stores, never in source code.
• Logging of security and administrative events.
• Incident response with the notification times in this addendum.
• Backups provided by our database providers.

We are extending log retention to 180 days across all systems by 31 December 2026.

• Google Cloud: hosting and storage (Taiwan, Mumbai, Delhi).
• MongoDB Atlas: database.
• Cloudflare: content delivery, file storage and the analytics edge (global).
• Resend: sends shared configurations and quotes by email.
• OpenAI and Replicate: AI image features, only for content the Controller submits to them.
• Sentry: error monitoring.
• Aapastech Private Limited (India) and 14818032 Canada Inc. (Canada): when either is not the Processor, for engineering, hosting and support, under a written intra-group agreement. Aapastech Private Limited also runs YOM analytics.

Questions about this DPA: contact@aapastech.com.