Data Processing Agreement
Gardenly3D — A Service of SmartFuture AB
Last Updated: July 4, 2026 Effective Date: July 4, 2026 Version: 1.3
This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Terms") between SmartFuture AB ("Processor," "we," "us," or "our") and you ("Controller," "Customer," "you," or "your") and governs the processing of Personal Data by the Processor on behalf of the Controller in connection with the Gardenly3D service (the "Service").
This DPA is entered into by electronic execution upon your acceptance of the Terms, in accordance with Terms Section 18.2, and constitutes a binding contract in writing within the meaning of GDPR Article 28(9).
If there is any conflict between this DPA and the Terms, this DPA prevails with respect to data protection matters, in accordance with Terms Section 28.2.
Table of Contents
- Definitions
- Scope and Roles
- Processing Details
- Controller Obligations
- Processor Obligations
- Sub-Processors
- International Data Transfers
- Security Measures
- Data Subject Rights
- Data Breach Notification
- Data Protection Impact Assessments
- Audit Rights
- Data Return and Deletion
- Liability
- Duration and Termination
- General Provisions
1. Definitions
1.1. "Applicable Data Protection Law" means: (a) Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"); (b) the Swedish Supplementary Data Protection Act (Kompletterande dataskyddslag 2018:218); (c) the EU ePrivacy Directive 2002/58/EC as implemented in Swedish law (Lag om elektronisk kommunikation 2003:389); (d) the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, where the Controller is a UK entity or processes personal data subject to UK Data Protection Law; and (e) any other applicable data protection or privacy legislation in the Controller's jurisdiction, to the extent it imposes obligations on the Processor in connection with the processing activities described in this DPA.
1.2. "Controller Personal Data" means Personal Data that the Controller inputs, uploads, imports, creates, or causes to be processed through the Service, including Personal Data of the Controller's clients, customers, project stakeholders, and other third parties.
1.3. "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Controller Personal Data transmitted, stored, or otherwise processed by the Processor.
1.4. "Data Subject" means an identified or identifiable natural person to whom Controller Personal Data relates.
1.5. "Personal Data" has the meaning given in GDPR Article 4(1).
1.6. "Processing" has the meaning given in GDPR Article 4(2) and includes any operation performed on Personal Data, whether automated or manual.
1.7. "Sub-Processor" means any third party engaged by the Processor to process Controller Personal Data on behalf of the Controller.
1.8. "Supervisory Authority" means the competent data protection authority, which for SmartFuture AB is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, "IMY").
1.9. "SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 of June 4, 2021, as amended or replaced from time to time.
1.10. All other capitalized terms not defined in this DPA have the meanings given in the Terms.
2. Scope and Roles
2.1. Controller. You are the data controller for Controller Personal Data. You determine the purposes and means of processing Controller Personal Data through your use of the Service. Where the Controller is not established in the EU/EEA or UK, references to "GDPR" in this DPA are deemed to include the equivalent applicable data protection law in the Controller's jurisdiction as defined in Section 1.1.
2.2. Processor. SmartFuture AB is the data processor for Controller Personal Data. We process Controller Personal Data solely on your behalf and in accordance with your documented instructions as described in this DPA.
2.3. Processor as Controller. SmartFuture AB is an independent data controller for Personal Data it collects and processes for its own purposes, including: account registration data, authentication credentials, billing and payment data, usage analytics, support communications, and browser storage or request metadata used for Service operation. The processing of such data is governed by our Privacy Policy, not this DPA.
2.4. Scope. This DPA applies only to Controller Personal Data — that is, Personal Data of third parties (such as your clients) that you input, upload, or cause to be processed through the Service. It does not apply to your own Personal Data as a Service user, which is governed by the Privacy Policy.
3. Processing Details
The following details of processing are required by GDPR Article 28(3):
3.1. Subject Matter and Purpose
The Processor processes Controller Personal Data solely for the purpose of providing, maintaining, and supporting the Service as described in the Terms, including:
(a) Storing and rendering garden design projects that may contain personal data (e.g., client names, property addresses, site photographs);
(b) Generating exports, reports, PDFs, images, and presentations that may contain personal data;
(c) Enabling collaboration and sharing features where the Controller shares projects with third parties;
(d) Providing backup and data recovery services;
(e) Providing customer support related to the Controller's use of the Service;
(f) Providing AI-assisted features and geocoding/location-search features when the Controller chooses to use them.
3.2. Duration of Processing
Processing begins when the Controller first inputs Controller Personal Data into the Service and continues until the later of: (a) the end of the Controller's subscription and the expiry of the data export window described in Terms Section 15.7; or (b) the completion of deletion of all Controller Personal Data in accordance with Section 13 of this DPA.
3.3. Categories of Personal Data
Controller Personal Data may include, but is not limited to:
(a) Client identification data: names, addresses, email addresses, phone numbers of the Controller's clients or project stakeholders;
(b) Property data: property addresses, site photographs, photo-derived GPS coordinates and camera metadata, aerial imagery, property dimensions and plans;
(c) Project notes and communications: text notes, annotations, comments, and collaboration messages that may reference identifiable individuals;
(d) Visual data: photographs, images, and videos uploaded to the Service that may depict identifiable individuals or identifiable properties.
3.4. Categories of Data Subjects
Data Subjects may include:
(a) The Controller's clients and prospective clients;
(b) Property owners and occupants;
(c) Contractors, subcontractors, and project collaborators;
(d) Individuals identifiable in uploaded photographs or images;
(e) Any other individuals whose Personal Data the Controller inputs into the Service.
3.5. Nature of Processing
The processing consists of: storage, retrieval, display, rendering, transformation (2D/3D conversion, format conversion, AI image generation, EXIF extraction for site-survey placement), geocoding lookup, export, backup, caching, deletion, and transmission (sharing, collaboration, sub-processor processing).
4. Controller Obligations
4.1. Lawful Basis. You are responsible for ensuring that you have a valid lawful basis under GDPR Article 6 (and, where applicable, Articles 9 or 10) for all Controller Personal Data you process through the Service.
4.2. Data Minimization. You are responsible for ensuring that the Controller Personal Data you input into the Service is adequate, relevant, and limited to what is necessary for the purposes of your use of the Service, in accordance with GDPR Article 5(1)(c).
4.3. Data Subject Information. You are responsible for providing appropriate privacy notices to Data Subjects whose Personal Data you process through the Service, in accordance with GDPR Articles 13 and 14.
4.4. Instructions. You are responsible for ensuring that your processing instructions to the Processor comply with Applicable Data Protection Law. The Terms and this DPA constitute your complete and final documented instructions to the Processor. Any additional or modified instructions must be agreed in writing.
4.5. Accuracy. You are responsible for the accuracy and quality of Controller Personal Data. The Processor has no obligation to verify the accuracy of Controller Personal Data.
5. Processor Obligations
5.1. Documented Instructions. The Processor shall process Controller Personal Data only on the Controller's documented instructions, as set out in this DPA and the Terms, unless required to do otherwise by EU or Swedish law. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such disclosure on important grounds of public interest (GDPR Article 28(3)(a)).
5.2. Instruction Compliance Notification. If the Processor determines that a Controller instruction infringes GDPR or other Applicable Data Protection Law, the Processor shall immediately inform the Controller. The Processor may suspend the relevant processing until the Controller issues a lawful instruction.
5.3. Confidentiality. The Processor shall ensure that all persons authorized to process Controller Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (GDPR Article 28(3)(b)).
5.4. Security. The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Section 8 of this DPA, in accordance with GDPR Article 32 (GDPR Article 28(3)(c)).
5.5. Sub-Processors. The Processor shall comply with the conditions for engaging Sub-Processors as described in Section 6 of this DPA (GDPR Article 28(3)(d)).
5.6. Data Subject Rights. The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests, as described in Section 9 of this DPA (GDPR Article 28(3)(e)).
5.7. Compliance Assistance. The Processor shall assist the Controller in ensuring compliance with the obligations under GDPR Articles 32 to 36 (security, breach notification, and data protection impact assessments), as described in Sections 8, 10, and 11 of this DPA (GDPR Article 28(3)(f)).
5.8. Data Return and Deletion. At the end of the provision of services, the Processor shall, at the Controller's choice, delete or return all Controller Personal Data and delete existing copies, as described in Section 13 of this DPA (GDPR Article 28(3)(g)).
5.9. Audit. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28 and allow for and contribute to audits, as described in Section 12 of this DPA (GDPR Article 28(3)(h)).
6. Sub-Processors
6.1. General Authorization
6.1.1. The Controller grants the Processor general written authorization to engage Sub-Processors in accordance with GDPR Article 28(2). The current list of authorized Sub-Processors is maintained at gardenly3d.com/subprocessors and is incorporated by reference into this DPA.
6.1.2. As of the effective date of this DPA, the Processor uses the following Sub-Processors:
| Sub-Processor | Purpose | Data Location | Transfer Mechanism |
|---|---|---|---|
| Supabase, Inc. | Database hosting, authentication, storage | EU (Stockholm, eu-north-1) | EU processing; SCCs as backup |
| Sinch / Mailgun Technologies | Transactional email delivery | EU (EU region) | EU processing (Sinch is Swedish-headquartered) |
| Stripe Payments Europe, Ltd. | Payment processing | EU (Ireland) / US | DPF certified; SCCs as backup |
| Vercel, Inc. | Application hosting and deployment | EU (Frankfurt) / Global CDN | DPF certification; SCCs as backup |
| Replicate, Inc. | AI image generation and AI image verification | US | Standard Contractual Clauses (SCCs) |
| OpenAI, L.L.C. | Plant visual-profile generation | US | DPF where applicable; SCCs as backup |
| Cloudflare, Inc. | Object-storage backups, CDN, DDoS protection, edge routing | EU / Global / US | DPF where applicable; SCCs as backup |
| SiteGround Spain S.L. | Support email hosting and mailbox services | EU | EU processing |
6.2. Sub-Processor Changes
6.2.1. The Processor shall inform the Controller of any intended addition or replacement of Sub-Processors with at least thirty (30) days advance notice before the change takes effect, by: (a) updating the Sub-Processor list at gardenly3d.com/subprocessors; and (b) sending notification to the email address associated with the Controller's Account. In the event of an emergency or security-related change, the Processor may provide notice as soon as practicable.
6.2.2. The Controller may object to the appointment of a new Sub-Processor by providing written notice to the Processor within thirty (30) days of receiving notification. The objection must state reasonable, data protection-related grounds for the objection.
6.2.3. If the Controller objects, the Processor shall use commercially reasonable efforts to: (a) make available a change to the Service that avoids the use of the objected-to Sub-Processor; or (b) recommend a commercially reasonable alternative Sub-Processor. If neither option is feasible within thirty (30) days, either party may terminate the affected portion of the Services by providing written notice, and the Controller will receive a pro-rata refund of any prepaid fees for the unused portion of the subscription period.
6.3. Sub-Processor Obligations
6.3.1. The Processor shall impose on each Sub-Processor, by way of a written contract, data protection obligations no less protective than those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organizational measures (GDPR Article 28(4)).
6.3.2. The Processor remains fully liable to the Controller for the performance of each Sub-Processor's obligations (GDPR Article 28(4)).
7. International Data Transfers
7.1. Primary Processing Location. The Processor's primary data processing facilities for Controller Personal Data are located in the European Union (Stockholm, Sweden via Supabase eu-north-1; Frankfurt, Germany via Vercel; Ireland via Stripe). The Processor shall not transfer Controller Personal Data outside the EU/EEA except as described in this Section 7.
7.2. Transfers to Adequate Countries. Controller Personal Data may be transferred to countries for which the European Commission has adopted an adequacy decision under GDPR Article 45, without additional safeguards.
7.3. Transfers to the United States. Where Controller Personal Data is transferred to the United States (including transfers to US-based Sub-Processors), the transfer is protected by one or more of the following mechanisms, applied in order of preference:
(a) The Sub-Processor's certification under the EU-US Data Privacy Framework ("DPF"), as recognized by the European Commission's adequacy decision of July 10, 2023;
(b) The Standard Contractual Clauses (Module 2: Controller to Processor) adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 of June 4, 2021, which are incorporated by reference into this DPA and, where applicable, into the Processor's agreements with Sub-Processors;
(c) Any other valid transfer mechanism recognized under GDPR Article 46.
7.4. Transfer Risk Evaluation. The Processor has evaluated the transfer risks associated with each Sub-Processor located outside the EU/EEA and has determined that, with the safeguards described in this Section 7, the transferred data receives protection that is essentially equivalent to that provided within the EU/EEA. The Processor shall re-assess transfers periodically and whenever circumstances material to the assessment change (including changes in Sub-Processor DPF certification status or relevant legislation).
7.5. Supplementary Measures. In addition to the contractual safeguards described above, the following supplementary measures apply to all international transfers of Controller Personal Data:
(a) Encryption in transit: All data transmitted between the Controller and the Service, and between the Service and Sub-Processors, is encrypted using TLS 1.2 or higher;
(b) Encryption at rest: Controller Personal Data stored in databases and file storage is encrypted at rest using AES-256 or equivalent;
(c) Access controls: Access to Controller Personal Data is restricted to authorized personnel on a need-to-know basis, using strong authentication as provided by the relevant Sub-Processor platform;
(d) Logging: Application-level logging and infrastructure-level access logging as provided by our Sub-Processors (Supabase, Vercel, Cloudflare, AWS).
7.6. Government Access Requests. If the Processor or a Sub-Processor receives a legally binding request from a government authority for access to Controller Personal Data, the Processor shall: (a) promptly notify the Controller of the request, unless legally prohibited from doing so; (b) challenge the request if there are reasonable grounds to consider it unlawful; (c) provide the minimum amount of information permissible when responding to the request; and (d) not provide mass, disproportionate, or indiscriminate access to Controller Personal Data.
8. Security Measures
8.1. The Processor shall implement and maintain appropriate technical and organizational measures to protect Controller Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risks of varying likelihood and severity for the rights and freedoms of Data Subjects (GDPR Article 32).
8.2. The Processor's security measures include, at a minimum:
Technical Measures
(a) Encryption in transit: TLS 1.2+ for all client-server and server-server communications;
(b) Encryption at rest: AES-256 encryption for database storage and file storage;
(c) Authentication: Secure authentication mechanisms including password hashing (bcrypt or equivalent) via Supabase Auth;
(d) Access control: Role-based access controls with principle of least privilege for all Processor personnel and systems;
(e) Network security: Firewalls, intrusion detection, and network segmentation for production infrastructure (provided by Sub-Processors Supabase, Vercel, Cloudflare, and AWS);
(f) Logging and monitoring: Application-level logging and infrastructure monitoring as provided by our Sub-Processors; monitoring for anomalous or unauthorized activity as feasible;
(g) Backup: Regular automated backups of Controller Personal Data with encryption;
(h) Vulnerability management: Regular security updates and patches to Service dependencies.
Organizational Measures
(i) Confidentiality commitments: All personnel with access to Controller Personal Data are bound by confidentiality obligations;
(j) Access review: Periodic review of access rights to ensure continued appropriateness;
(k) Incident response: Commercially reasonable procedures for detecting, containing, and notifying the Controller of Data Breaches, including notification to the Controller without undue delay;
(l) Sub-Processor security: Security requirements imposed contractually on all Sub-Processors.
8.3. The Processor shall periodically review its security measures and update them as reasonably practicable to respond to material changes in threats or applicable guidance, taking into account the Processor's size and resources as a small enterprise.
9. Data Subject Rights
9.1. Controller Responsibility. The Controller is responsible for responding to Data Subject requests exercising their rights under GDPR Chapter III (Articles 15–22), including requests for access, rectification, erasure, restriction of processing, data portability, and objection.
9.2. Processor Assistance. The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to Data Subject requests (GDPR Article 28(3)(e)).
9.3. Self-Service and Request-Based Functionality. The Service provides the Controller with self-service functionality to access, rectify, and delete most Controller Personal Data, and to export individual design projects. Account-level bulk export of Controller Personal Data is provided by the Processor on the Controller's request, in accordance with Section 13 below and Section 19.1 of the Terms of Service, in machine-readable formats and within one (1) month of the request. The Controller should use the self-service features as the primary means of responding to Data Subject requests for access, rectification, and erasure, and request a bulk export from the Processor where Article 20 portability requires the Controller to deliver structured machine-readable data to the Data Subject or another controller.
9.4. Request Forwarding. If the Processor receives a Data Subject request directly, the Processor shall forward the request to the Controller without undue delay and shall not respond to the Data Subject directly, unless legally required to do so.
9.5. Costs. The Processor shall provide reasonable assistance with Data Subject requests at no additional cost. If a request requires assistance that is unusually extensive or complex (beyond what can be addressed through the Service's self-service features), the Processor may charge a reasonable fee based on the Processor's actual administrative costs, provided the Controller is informed of the estimated costs before work begins.
10. Data Breach Notification
10.1. Notification to Controller. The Processor shall notify the Controller of any Data Breach without undue delay after becoming aware of the Data Breach. Notification shall be sent to the email address associated with the Controller's Account and, where available, through the Service's notification system.
10.2. Content of Notification. The Data Breach notification shall include, to the extent available at the time of notification:
(a) A description of the nature of the Data Breach, including the categories and approximate number of Data Subjects affected and the categories and approximate number of Personal Data records affected;
(b) The name and contact details of the Processor's contact point for further information;
(c) A description of the likely consequences of the Data Breach;
(d) A description of the measures taken or proposed to be taken to address the Data Breach, including measures to mitigate its possible adverse effects.
10.3. Supplementary Information. If it is not possible to provide all information required under Section 10.2 at the time of the initial notification, the Processor shall provide the information in phases without undue further delay as the information becomes available.
10.4. Controller Obligations. The Controller is responsible for: (a) assessing whether the Data Breach requires notification to the Supervisory Authority (IMY) under GDPR Article 33; (b) notifying the Supervisory Authority within seventy-two (72) hours of becoming aware of the breach, where required; and (c) notifying affected Data Subjects under GDPR Article 34, where required.
10.5. Cooperation. The Processor shall cooperate with the Controller and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of the Data Breach.
10.6. Record-Keeping. The Processor shall maintain a register of all Data Breaches, including their effects and remedial actions taken, in accordance with GDPR Article 33(5).
10.7. No Admission. Notification of a Data Breach under this Section 10 shall not be construed as an acknowledgment by the Processor of any fault or liability with respect to the Data Breach.
11. Data Protection Impact Assessments
11.1. The Processor shall provide reasonable assistance to the Controller with any Data Protection Impact Assessment ("DPIA") and, where necessary, prior consultation with the Supervisory Authority (IMY), that the Controller is required to carry out under GDPR Articles 35 and 36, to the extent that such assistance relates to the processing carried out by the Processor and taking into account the nature of the processing and the information available to the Processor (GDPR Article 28(3)(f)).
11.2. Such assistance may include providing information about the Processor's processing activities, security measures, Sub-Processors, and international transfer safeguards.
12. Audit Rights
12.1. Audit Right. The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations set out in GDPR Article 28, and shall allow for and contribute to audits conducted by the Controller or a qualified auditor mandated by the Controller (GDPR Article 28(3)(h)).
12.2. Documentation-First. The Processor's primary means of satisfying audit obligations is by providing documentation: (a) this DPA and related policies; (b) relevant third-party certifications or audit reports obtained by Sub-Processors (such as SOC 2 reports from Supabase/AWS or Vercel); (c) responses to reasonable written questionnaires. The Controller shall rely on documentation review as the first and preferred audit mechanism and shall request on-site inspection only where documentation is genuinely insufficient to satisfy a specific, identified compliance requirement.
12.3. Audit Procedure. Where documentation review is insufficient and an inspection is necessary, inspections are subject to:
(a) At least thirty (30) days' prior written notice, specifying scope and duration;
(b) Conducted during normal business hours; shall not unreasonably disrupt operations;
(c) The Controller's auditor must execute a non-disclosure agreement with the Processor and must not be a direct competitor of SmartFuture AB;
(d) The Controller bears all costs, including the Processor's reasonable staff time;
(e) No more than once per twelve (12) month period, unless required by a Supervisory Authority or following a Data Breach.
12.4. Sub-Processor Audits. Where the Processor is unable to provide sufficient information regarding a Sub-Processor's compliance, the Processor shall use commercially reasonable efforts to obtain additional information or audit rights from the Sub-Processor on the Controller's behalf.
12.5. Confidentiality. All information obtained during an audit is Confidential Information under Terms Section 22 and shall not be disclosed to any third party without the Processor's prior written consent, except as required by law or regulatory authorities.
13. Data Return and Deletion
13.1. During Subscription. During the term of the Controller's subscription, the Controller may export Controller Personal Data at any time by: (a) using the Service's per-project export functionality for individual design projects; or (b) requesting an Account-level export from the Processor at hello@gardenly3d.com, which will be delivered in structured, machine-readable formats within one (1) month of the request, free of charge.
13.2. Upon Termination. Following subscription cancellation or termination of the Controller's Account, the Controller will have the Export Window described in Terms Section 15.7 (at least thirty (30) days) to retrieve Controller Personal Data using the same mechanisms described in Section 13.1.
13.3. Deletion. After the Export Window, the Processor shall delete all Controller Personal Data without undue delay, and in any event within ninety (90) days, including all copies in production systems and active storage.
13.4. Backup Retention. Controller Personal Data may persist in encrypted backup systems for a maximum of ninety (90) days after deletion from production systems, after which it will be permanently deleted. Such backup data is not actively processed and is accessible only for disaster recovery purposes.
13.5. Legal Retention. The Processor may retain Controller Personal Data to the extent and for the duration required by applicable law, including: (a) the Swedish Bookkeeping Act (Bokföringslagen 1999:1078) seven-year retention requirement for financial records; (b) legal obligations to preserve evidence; and (c) regulatory compliance obligations. Any such retained data shall be isolated and protected and shall not be actively processed for any other purpose.
13.6. Evidence of Deletion. Upon the Controller's written request, the Processor shall provide reasonable documentation of deletion efforts in accordance with this Section 13, subject to the exceptions in Sections 13.4 and 13.5. Such documentation is limited to records within the Processor's direct control.
14. Liability
14.1. Scope. This Section 14 governs liability arising under or in connection with this DPA, including liability arising from breaches of Applicable Data Protection Law in connection with the processing of Controller Personal Data.
14.2. Limitation of Liability. The total aggregate liability of each party arising out of or in connection with this DPA (including liability for Data Breaches) shall be subject to the limitation of liability provisions in Terms Section 13. This DPA does not create any separate or additional liability beyond the limits set out in the Terms.
14.3. Controller Liability for Instructions. Where a breach of Applicable Data Protection Law results from the Controller's instructions to the Processor, the Controller shall be solely liable for such breach. The Processor shall not be liable for any damage caused by processing that is carried out in accordance with the Controller's documented instructions.
14.4. Regulatory Fines. Each party is independently responsible for any administrative fines or penalties imposed on it by a Supervisory Authority under GDPR Article 83. Nothing in this DPA shall be construed as limiting either party's direct liability to a Supervisory Authority.
14.5. Indemnification. The Controller shall indemnify the Processor against all claims, damages, losses, costs, and expenses (including reasonable legal fees) arising from: (a) the Controller's processing instructions that violate Applicable Data Protection Law; (b) the Controller's failure to comply with its obligations as a data controller under Applicable Data Protection Law; or (c) the Controller's failure to have a valid lawful basis for processing Controller Personal Data through the Service.
15. Duration and Termination
15.1. Duration. This DPA shall remain in effect for the duration of the Controller's use of the Service and shall automatically terminate when the Processor has deleted all Controller Personal Data in accordance with Section 13.
15.2. Survival. Sections 13 (Data Return and Deletion), 14 (Liability), and 16 (General Provisions) survive termination of this DPA. The Processor's obligations regarding confidentiality of Controller Personal Data survive for as long as any Controller Personal Data is retained by the Processor.
16. General Provisions
16.1. Governing Law. This DPA is governed by the laws of Sweden, in accordance with Terms Section 25.1.
16.2. Disputes. Disputes arising under this DPA are subject to the dispute resolution provisions in Terms Section 25.
16.3. Amendments. This DPA may be amended by the Processor to reflect changes in Applicable Data Protection Law, guidance from Supervisory Authorities, or changes in the Processor's processing activities. Material amendments shall be communicated to the Controller in accordance with Terms Section 24.
16.4. Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall continue in full force and effect. The invalid or unenforceable provision shall be modified to the minimum extent necessary to make it valid and enforceable.
16.5. Entire DPA. This DPA, together with the Terms and the Sub-Processor list at gardenly3d.com/subprocessors, constitutes the complete data processing agreement between the parties with respect to the processing of Controller Personal Data.
16.6. No Third-Party Beneficiaries. This DPA is between the Controller and the Processor. Data Subjects are not third-party beneficiaries of this DPA, except to the extent that GDPR directly grants them enforceable rights against the Controller or Processor.
17. United Kingdom Controller Provisions
17.1. Where the Controller is established in the United Kingdom or processes personal data subject to UK Data Protection Law, references to "GDPR" in this DPA include the UK General Data Protection Regulation (UK GDPR) retained under the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018. The Information Commissioner's Office (ICO) is the relevant Supervisory Authority for UK Controllers.
17.2. UK Transfer Mechanism. For transfers of Controller Personal Data from the United Kingdom to countries outside the UK, the Processor shall use: (a) the International Data Transfer Agreement (IDTA) issued by the ICO; or (b) EU Standard Contractual Clauses supplemented by the ICO's UK Addendum (Version B1.0, effective 21 March 2022). EU SCCs alone are not sufficient for UK-to-third-country transfers. For the purposes of the UK Addendum: Table 1 (Parties) is as set out in this DPA; Table 2 (Selected SCCs) references the EU SCCs incorporated in Annex 1; Table 3 (Appendix Information) is as set out in Sections 3 and 8 of this DPA; Table 4 (Ending the Addendum) — either party may end the Addendum as set out in Section 19 of the Addendum.
17.3. This Section 17 does not create obligations exceeding those required by UK Data Protection Law.
Annex 1: Standard Contractual Clauses Reference
Where Controller Personal Data is transferred to Sub-Processors located outside the EU/EEA and not covered by an adequacy decision, the parties hereby incorporate by reference the Standard Contractual Clauses adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 of June 4, 2021, Module 2 (Controller to Processor), as follows:
- Clause 7 (Docking clause): Not used.
- Clause 9 (Use of sub-processors): Option 2 (General written authorization) is selected, with a notification period of thirty (30) days.
- Clause 11 (Redress): The optional clause is not used.
- Clause 13 (Supervision): The Supervisory Authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
- Clause 17 (Governing law): Option 1 is selected: the laws of Sweden.
- Clause 18 (Choice of forum and jurisdiction): The courts of Sweden, with Jönköping District Court (Jönköpings tingsrätt) as the court of first instance.
The details required by Annexes I and II of the SCCs are as set out in Sections 3 and 8 of this DPA, respectively.
Annex 2: Technical and Organizational Security Measures
The following measures are implemented by the Processor and/or its Sub-Processors:
| Category | Measure |
|---|---|
| Encryption in transit | TLS 1.2+ for all client-server and inter-service communications |
| Encryption at rest | AES-256 for database storage (Supabase/AWS); encrypted file storage |
| Authentication | bcrypt password hashing (Supabase Auth); email verification |
| Access control | Row-level security (Supabase RLS); role-based access; API key controls |
| Network security | Firewalls, DDoS protection, network segmentation — provided by Sub-Processors (Vercel/Cloudflare/AWS VPC) |
| Logging | Application-level logging; infrastructure-level access logging as provided by Sub-Processors |
| Backup | Automated daily database backups; encrypted; EU-hosted (provided by Supabase/AWS) |
| Vulnerability management | Security updates to Service dependencies on a commercially reasonable schedule |
| Incident response | Commercially reasonable breach detection and response; notification to Controller without undue delay |
| Personnel | Confidentiality obligations; least-privilege access to production systems |
| Physical security | Managed by Sub-Processors (AWS, Vercel); SOC 2 certified data centers |
| Data isolation | Per-customer data isolation via database-level tenant separation |
SmartFuture AB Organisation number: 559433-4954 SciencePark, Gjuterigatan 9 553 18 Jönköping, Sweden
Data Protection Contact: hello@gardenly3d.com Sub-Processor List: gardenly3d.com/subprocessors Privacy Policy: gardenly3d.com/privacy
This Data Processing Agreement was last updated on July 4, 2026. Version 1.3 — Effective July 4, 2026.