Data Processing Agreement

Last updated: 19 October 2026

This Data Processing Agreement ("DPA") is Annex 1 to, and forms part of, the Vistura Terms of Service ("Terms") and governs the processing of personal data by Vistura on behalf of its customers.

This DPA applies to the extent that Vistura acts as a processor or sub-processor under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, or other applicable data protection laws, including Brazil's Lei Geral de Proteção de Dados ("LGPD") and applicable US state privacy laws.

Parties:

Customer: The individual or legal entity holding a Vistura account and determining the purposes and means of the relevant personal data processing, or acting as a processor on behalf of another controller.
Vistura: the sole trader established in Portugal identified in the Legal notice, operating the Vistura service at vistura.app. Contact: legal@vistura.app.

The terms "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings assigned under applicable data protection law.

This DPA takes effect when the Customer accepts the Terms and remains applicable for as long as Vistura processes personal data on the Customer's behalf.

1. Scope and description of processing

1.1. Vistura provides a software-as-a-service platform for creating, hosting, publishing and analysing interactive virtual property tours, including associated lead-generation forms.

1.2. When processing personal data contained in the Customer's tours, form submissions and visitor analytics on the Customer's behalf, Vistura acts as a processor. The Customer acts as controller or, where applicable, as a processor acting under the authority of another controller.

1.3. Processing activities may include:

Hosting and displaying virtual tours, photographs, floor plans and associated content.
Collecting, storing, organising, displaying, exporting and deleting form submissions and enquiries.
Recording tour visits, session duration, time spent in individual rooms or scenes, interactions, navigation events and other engagement metrics.
Recording viewport orientation and viewing activity within 360-degree images for engagement analytics and heatmaps, where this functionality is enabled.
Associating visitor activity with submitted contact information when a visitor completes a form and the relevant session can be linked.
Producing statistical reports and aggregated analytics for the Customer.
Sending notifications relating to enquiries and form submissions.
Performing operations reasonably necessary to maintain the security, availability and functionality of the Service.

1.4. Visitor analytics may initially be collected without directly identifying visitors by name. However, session identifiers, interaction records and related information may constitute personal data, particularly where they can subsequently be linked to a form submission or an identifiable individual.

Vistura will not treat such data as anonymous merely because the visitor has not supplied a name or email address.

1.5. The subject matter, duration, categories of data subjects, categories of personal data and purposes of processing are described in Schedule A.

1.6. Vistura acts as an independent controller for personal data processed for its own legitimate purposes, including account administration, billing, customer support, platform security and its own website analytics, as described in its Privacy Policy.

Such independent processing is not governed by this DPA, except where mandatory law requires otherwise.

2. Instructions and Customer responsibilities

2.1. Vistura shall process Customer Personal Data only on documented instructions from the Customer, including instructions concerning international transfers, unless otherwise required by applicable EU or Member State law.

The Terms, this DPA, the Customer's use and configuration of the Service, and other mutually agreed written instructions constitute documented instructions.

2.2. The Customer authorises Vistura to perform the processing activities reasonably necessary to provide the Service, including the use of authorised sub-processors and the international transfers described in this DPA.

2.3. The Customer is responsible for:

Establishing a valid legal basis for collecting and processing personal data through its tours and forms.
Providing legally required privacy notices and obtaining any necessary consent.
Determining the purposes for which leads and visitor analytics are used.
Ensuring the lawful use of information obtained through the Service.
Configuring its forms, tracking features and retention settings in accordance with applicable law.
Responding to data subjects' requests as controller.
Ensuring that uploaded content is lawful and does not infringe privacy or other rights.
Obtaining any necessary authorisation to instruct Vistura where the Customer acts as a processor for another controller.

2.4. The Customer is responsible for informing visitors where their tour activity may be associated with an enquiry or form submission.

Vistura shall provide reasonable technical means to support the Customer's compliance, taking into account the available functionality and applicable legal requirements.

2.5. Vistura shall not sell Customer Personal Data, use identifiable leads for independent marketing, or use Customer Personal Data for purposes incompatible with the Customer's documented instructions.

This does not prevent Vistura from processing appropriately anonymised, aggregated information that no longer constitutes personal data, or from processing personal data independently for purposes described in Section 1.6 where lawful.

2.6. Vistura shall promptly inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

Where legally justified, Vistura may suspend the affected processing pending clarification or correction of the instruction.

2.7. Instructions requiring substantial additional technical work outside the normal functionality of the Service may be subject to reasonable charges or a separate agreement, to the extent permitted by law.

3. Confidentiality

3.1. Vistura shall ensure that persons authorised to process Customer Personal Data are subject to appropriate contractual or statutory confidentiality obligations.

3.2. Access to Customer Personal Data shall be limited to authorised persons who reasonably require access for the performance, maintenance, security or support of the Service.

3.3. Confidentiality obligations shall continue after the termination of the relevant engagement for as long as legally or contractually required.

4. Security measures

4.1. Vistura shall implement appropriate technical and organisational measures designed to provide a level of security appropriate to the risks associated with the processing, in accordance with Article 32 GDPR and other applicable data protection laws.

These measures shall take into account the state of the art, implementation costs, nature, scope, context and purposes of processing, and the likelihood and severity of risks to individuals.

4.2. Security measures shall include, as appropriate to the processing:

Encryption of personal data in transit using industry-standard secure communication protocols.
Authentication and access controls.
Logical separation of Customer data within the Service.
Appropriate protection of passwords, authentication credentials and secrets.
Restrictions on administrative and database access.
Appropriate protections against unauthorised access, abuse and excessive automated requests.
Security updates and vulnerability remediation based on assessed risk.
Appropriate backup and recovery arrangements.
Procedures for detecting, assessing and responding to suspected security incidents.
Periodic assessment and improvement of security controls.

Further details are set out in Schedule B.

4.3. Vistura may use third-party infrastructure and security providers to implement these measures.

Such reliance does not remove Vistura's obligations under applicable data protection law.

4.4. Vistura shall take reasonable steps to ensure that sub-processors provide appropriate security guarantees and comply with their contractual data protection obligations.

4.5. Vistura may modify its technical and organisational security measures to reflect technological developments, changes in infrastructure or evolving threats, provided that such changes do not materially reduce the overall protection afforded to Customer Personal Data.

4.6. No information system can be guaranteed to be completely secure. Nothing in this provision constitutes a guarantee that all security incidents can be prevented, nor does it exclude obligations or liabilities that cannot lawfully be excluded.

5. Sub-processors

5.1. The Customer grants Vistura general written authorisation to engage sub-processors where reasonably necessary to provide, maintain or secure the Service.

5.2. The current sub-processors and their processing activities are identified in Schedule C.

5.3. Vistura shall impose data protection obligations on its sub-processors through written agreements providing the protections required under Article 28 GDPR or equivalent applicable law.

5.4. Vistura shall remain responsible to the Customer for its sub-processors' performance of their data protection obligations to the extent required by applicable law.

5.5. Vistura shall give the Customer at least 30 days' advance notice of an intended addition or replacement of a sub-processor, by email or through a notification within the Service.

Where an urgent replacement is reasonably necessary for security, continuity or legal compliance, Vistura may provide shorter notice where permitted by applicable law, explaining the reasons.

5.6. The Customer may object to a new sub-processor on reasonable, documented data protection grounds by notifying Vistura within 15 days of receiving notice.

5.7. Vistura shall consider any timely and reasonable objection in good faith and may propose a technically and commercially feasible alternative.

If no reasonable resolution is available, the Customer may terminate the affected Service without penalty for the termination itself, subject to payment for services already provided and any mandatory refund rights.

5.8. Vistura is not required to provide dedicated infrastructure, modify its standard architecture or maintain a particular sub-processor solely to satisfy an individual Customer's preference, unless otherwise required by applicable law or a separate written agreement.

6. International data transfers

6.1. The Customer acknowledges that providing the Service may involve processing or transferring Customer Personal Data in countries outside the Customer's jurisdiction, including the United States and other locations where authorised sub-processors operate.

6.2. Vistura shall ensure that transfers of personal data subject to the GDPR comply with Chapter V GDPR, where applicable.

Appropriate transfer mechanisms may include:

An applicable European Commission adequacy decision.
The EU-US Data Privacy Framework where the relevant recipient is validly certified and the transfer is covered.
The European Commission's Standard Contractual Clauses for international transfers.
Other transfer mechanisms permitted by applicable law.

6.3. Where required, Vistura shall implement or obtain applicable contractual safeguards, including supplementary measures where necessary.

6.4. Where the UK GDPR applies, Vistura shall use a legally valid UK transfer mechanism for restricted international transfers, where required, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6.5. Where Brazil's LGPD applies, international transfers shall be subject to the requirements of that legislation, including applicable adequacy decisions or other legally recognised transfer mechanisms.

6.6. The Parties shall cooperate reasonably in executing additional mandatory transfer documentation where required by applicable law.

6.7. Any mandatory international transfer clauses entered into by the relevant parties shall prevail over conflicting provisions of this DPA to the extent required by law.

6.8. The Customer authorises the international processing operations necessary for the Service, subject to the safeguards and limitations described in this Section.

7. Assistance with data protection obligations

7.1. Taking into account the nature of processing and the information available to Vistura, Vistura shall provide reasonable assistance to the Customer in responding to data subjects exercising their applicable legal rights.

7.2. Where supported by the Service, the Customer may access, export and delete form submissions and other Customer data using available account functions.

7.3. If Vistura receives a request from a data subject concerning personal data processed on behalf of a Customer, Vistura shall, where reasonably possible, forward the request to the relevant Customer without undue delay, unless legally prohibited.

Vistura shall not independently determine the merits of such requests unless required by law or authorised by the Customer.

7.4. Vistura shall provide reasonable assistance, as required by applicable law and taking into account the nature of the processing and information available to it, concerning:

Security of processing.
Personal data breach assessment and notification.
Data protection impact assessments.
Prior consultations with supervisory authorities.
Demonstration of compliance with applicable processor obligations.

7.5. Assistance ordinarily provided through the Service's standard functionality is included in the Service.

Additional assistance requiring substantial dedicated work may be subject to reasonable, previously communicated charges, to the extent permitted by law.

8. Personal data breaches

8.1. Vistura shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

8.2. The initial notification shall include information reasonably available at the time, which may include:

A description of the nature of the incident.
The categories of personal data potentially affected.
The approximate number of affected individuals or records, if known.
The likely consequences, to the extent they can be assessed.
Measures taken or proposed to address the incident.
Contact information for further communication.

8.3. Where complete information is not immediately available, Vistura may provide the notification in stages and supply relevant updates as the investigation progresses.

8.4. Vistura shall take appropriate steps to contain, investigate and remediate personal data breaches within its responsibility.

8.5. The Customer remains responsible for determining whether a breach must be reported to a supervisory authority or communicated to affected individuals, where the Customer acts as controller.

Vistura shall provide the assistance required of it as processor under applicable law.

8.6. Vistura shall maintain appropriate internal documentation of personal data breaches and associated response measures as required by law.

8.7. Notifications under this Section do not, by themselves, constitute an admission of fault or legal liability.

9. Compliance information and audits

9.1. Vistura shall make available the information reasonably necessary to demonstrate compliance with its obligations under Article 28 GDPR and other applicable processor requirements.

Such information may include relevant descriptions of security measures, contractual safeguards, sub-processor information and available independent assurance reports.

9.2. The Parties shall ordinarily seek to demonstrate compliance through documentation, independent certifications, security reports and written responses before arranging direct inspections.

9.3. Where the information provided is insufficient to meet an applicable legal audit requirement, Vistura shall allow and contribute to audits, including inspections, by the Customer or an appropriately authorised independent auditor.

9.4. Routine audits shall normally be subject to:

At least 30 days' prior written notice.
Reasonable scheduling during normal business hours.
Appropriate confidentiality obligations.
Measures to protect other customers' data and Vistura's confidential information.
Procedures designed to minimise unreasonable disruption.

Routine audits should ordinarily occur no more than once per year, unless additional audits are reasonably necessary because of a material incident, a substantiated compliance concern or a legal or regulatory requirement.

9.5. Audit arrangements shall not prevent or unreasonably restrict mandatory rights under applicable data protection law.

9.6. The Customer shall ordinarily bear its own audit costs and reasonable additional costs directly attributable to a Customer-requested audit, where legally permissible.

9.7. Nothing in this Section requires Vistura to disclose another customer's personal data, compromise system security or provide unrestricted access to production infrastructure.

10. Return and deletion of data

10.1. During the term of the Service, the Customer may export and delete Customer Personal Data through available functionality or request reasonable assistance where required by law.

10.2. Upon termination of the relevant processing services, Vistura shall, at the Customer's choice, return or delete Customer Personal Data, subject to any applicable legal retention obligations.

The Customer may exercise the return option by exporting available data before account closure or by requesting an available export within the applicable account closure process.

10.3. Following the applicable export opportunity and expiry of the account closure process, Vistura shall delete Customer Personal Data from active systems within 30 days, unless retention is required by law or otherwise permitted under a valid, documented legal basis.

10.4. Personal data contained in backup systems shall be removed through the applicable documented backup retention and deletion procedures.

Where immediate deletion of individual records from a backup is not technically feasible, those records shall remain protected from ordinary operational access, shall not be restored for routine use, and shall be deleted when the relevant backup expires.

If a backup is restored, previously deleted personal data shall be deleted again where required.

10.5. Vistura shall ensure that any continued retention is limited to what is legally required or otherwise lawfully permitted.

10.6. Deleting an individual tour does not automatically require deletion of associated form submissions where the Customer retains those submissions separately for a lawful purpose.

The Customer remains responsible for determining whether continued retention of such submissions is legally justified.

10.7. Upon reasonable request, Vistura shall provide available information demonstrating the completion of applicable deletion procedures.

10.8. This Section does not require deletion of independently controlled account, billing, tax or other records which Vistura is legally required or otherwise lawfully entitled to retain, as described in its Privacy Policy.

11. Liability

11.1. The exclusions and limitations of liability set out in the Terms of Service shall apply to this DPA to the maximum extent permitted by applicable law.

11.2. Nothing in this DPA limits or excludes liability that cannot legally be limited or excluded, including mandatory liability under applicable data protection laws.

11.3. Each Party remains responsible for its own compliance with applicable legal obligations and for breaches attributable to its conduct, omissions or instructions, subject to applicable law.

11.4. The allocation of responsibilities under this DPA does not prejudice any non-waivable rights of data subjects or supervisory authorities.

12. General provisions

12.1. Order of precedence. In the event of conflict concerning personal data processing, the following order of precedence shall apply:

Mandatory applicable data protection law and any binding mandatory transfer clauses.
This DPA and its Schedules.
The Terms of Service.

12.2. Amendments. Vistura may update this DPA where reasonably necessary to reflect changes in applicable law, regulatory requirements, security measures or Service operations.

Material changes shall be communicated to the Customer in accordance with the Terms and applicable law.

12.3. Applicable law. This DPA is governed by the law specified in the Terms, without prejudice to mandatory data protection laws and any governing-law provisions required by applicable international transfer instruments.

12.4. Duration. This DPA remains effective for as long as Vistura processes Customer Personal Data on the Customer's behalf, including any applicable retention and deletion period following termination.

12.5. Severability. If any provision is found invalid or unenforceable, the remaining provisions shall remain effective, to the extent permitted by law.

12.6. International applicability. The Parties shall comply with additional mandatory data protection requirements in jurisdictions where those requirements lawfully apply to their respective activities.

Nothing in this DPA represents that the Service complies with every jurisdiction's data protection regime merely because the Service is accessible internationally.

Schedule A: Description of processing

Item	Description
Subject matter	Provision of an online platform for hosting, presenting and analysing virtual property tours and managing related enquiries.
Duration	For the period during which the Customer uses the Service, followed by applicable return, deletion and lawful retention periods.
Purpose	Publishing tours, generating enquiries, managing leads, analysing visitor engagement and providing related Service functionality.
Nature of processing	Collection, recording, organisation, storage, retrieval, consultation, linking, analysis, disclosure to authorised recipients, export and deletion.
Data subjects	Tour visitors, prospective buyers or tenants, people submitting forms, and individuals appearing or identifiable in tour content.
Contact information	Names, email addresses, telephone numbers, messages and other information requested by Customer-created forms.
Visitor analytics	Session identifiers, visit timestamps, session duration, room and scene navigation, interaction events, viewport orientation, viewing duration and heatmap-related events where enabled.
Technical information	Device and browser characteristics, IP-related information, user-agent data, technical logs, approximate location where derived, referrer information and security-related metadata, where collected.
Linked information	Visitor interaction history associated with contact details following a form submission, where enabled and technically possible.
Uploaded content	Images, 360-degree photographs, floor plans, descriptions, media metadata and any personal data incidentally contained within them.
Special-category data	Not intentionally requested or required. The Service is not designed for systematic processing of special-category personal data.
Processing locations	Locations associated with Vistura's configured infrastructure and authorised sub-processors, subject to applicable international transfer safeguards.

Additional provisions

The Customer shall not intentionally use the Service to collect special-category personal data, payment-card information or other unusually sensitive information unless expressly supported by the Service and subject to appropriate legal and technical safeguards.

Information voluntarily provided by visitors in unrestricted text fields may nevertheless contain sensitive data. Such information remains subject to applicable law and this DPA where it constitutes Customer Personal Data.

Analytics that have been irreversibly anonymised and can no longer reasonably identify an individual are not personal data for the purposes of the GDPR.

Schedule B: Technical and organisational measures

Vistura shall maintain security measures appropriate to the risks of the Service, which may include the following controls, as applicable:

Area	Measures
Data transmission	Secure HTTPS/TLS connections for data exchanged with the Service.
Authentication	Authentication mechanisms and appropriate protection of credentials through the authentication provider.
Access control	Role-based or otherwise appropriate access restrictions, including separation of Customer data.
Secrets management	Protection of production credentials, API keys and other sensitive configuration values.
Database security	Appropriate database permissions and restrictions on unauthorised access.
Abuse prevention	Rate limiting, request validation and other appropriate anti-abuse mechanisms.
Infrastructure	Use of infrastructure providers with appropriate contractual and technical security safeguards.
Maintenance	Risk-based security updates and remediation of identified vulnerabilities.
Backup and recovery	Appropriate data recovery arrangements and documented backup retention procedures.
Incident response	Procedures for identifying, assessing, containing, documenting and communicating suspected personal data breaches.
Access governance	Limitation of administrative access to authorised persons with a legitimate operational need.
Review	Periodic reassessment and improvement of security measures based on identified risks.

These measures describe the security framework applicable to the Service and must be implemented to the extent necessary to satisfy the security commitments in Section 4.

Vistura may adopt equivalent or stronger measures without amending this DPA, provided the overall level of protection is maintained.

Schedule C: Authorised sub-processors

The following sub-processors are authorised for relevant processing activities:

Provider	Processing activities	Primary or relevant processing locations
Supabase Pte. Ltd. and applicable affiliates	Database infrastructure, authentication, storage and related services	Configured project region, currently United States (us-east-1), with additional processing locations as described in provider documentation
Railway Corporation	Hosting and operation of application backend infrastructure	Configured application region, currently United States (US East), with additional locations as applicable
Cloudflare, Inc.	Website delivery, content distribution, traffic security and associated network services	Global network
Plus Five Five, Inc. (Resend)	Transactional email delivery and notifications	United States and other applicable provider processing locations

The precise contracting entity, processing region and transfer mechanism for each provider shall be verified against the applicable provider agreement and service configuration.

The list may be updated in accordance with Section 5 of this DPA. The current list, and notice of any planned change, is published at vistura.app/legal/subprocessors.

Additional providers shall be included where they process Customer Personal Data on behalf of Vistura and qualify as sub-processors under applicable law.

End of the Data Processing Agreement (Annex 1 to the Terms of Service).