Data processing agreement

When this applies

If you use VideoPixo in a business capacity, this agreement applies automatically and forms part of the Terms of service. You do not have to sign anything; if you do want a signed copy, ask at juridisch@videopixo.be.

Who is what

You are the controller for the personal data contained in the properties and photos you supply. We, 3D Worx BV, are the processor.

For your own account data — your email address, your billing details — we are the controller ourselves. That is set out in the Privacy policy.

What we process and why

Subject matter: making videos from the data and images you supply. Duration: as long as your account exists.

Types of data: images that may show people, vehicles or homes, property addresses, and the contact details of the agents you enter yourself.

Categories of data subjects: your agents and team members, and the people who happen to appear in the images.

Our obligations

We process that data only on your instruction and for the purposes above. If we consider an instruction unlawful, we say so.

Everyone with access at our end is bound to confidentiality.

We take appropriate technical and organisational measures: encrypted transport and storage, access control, and separate development and production environments.

Sub-processors

You give us general authorisation to engage sub-processors. Today those are: Vercel (hosting and bot detection), Supabase (database, storage and sign-in links), fal.ai (image and video generation), ElevenLabs (speech) and Mollie (payments).

If that list changes, we announce it at least thirty days in advance. If you have a reasoned objection, you may terminate the agreement at no cost.

Assistance

If you receive a data subject request — access, erasure — we help you with it, to the extent you cannot do it yourself in the app.

We also assist with a data protection impact assessment or with consulting the supervisory authority, insofar as it concerns our processing.

Data breaches

If we discover a security breach involving your data, we report it without undue delay and within forty-eight hours at the latest, with what we know at that point.

Notifying the supervisory authority is yours to do, because you are the controller. We supply what you need for it.

Transfers, audit and termination

Transfers outside the EEA take place under the European Commission's standard contractual clauses or under an adequacy decision.

You may ask us once a year to demonstrate compliance with this agreement; we answer with documentation, and with an on-site audit only where the supervisory authority requires one.

On termination we delete the data within thirty days, unless the law obliges us to keep it longer.