Data Processing Agreement
Last Updated: November 2025
This Data Processing Agreement (“DPA”) forms part of any service agreement between 3DLEGENDS (“Processor”) and the Client (“Controller”). It defines how personal data is handled, protected, and processed in accordance with the GDPR (EU Regulation 2016/679) and applicable data protection laws.
Controller – The Client who determines the purpose and means of processing.
Processor – 3DLEGENDS, who processes data on behalf of the Controller.
Personal Data – Any information relating to an identifiable natural person.
Processing – Any operation performed on personal data (storage, transfer, collection, etc.).
Subprocessor – Any third party engaged by 3DLEGENDS to support service delivery.
3DLEGENDS processes personal data only for purposes necessary to deliver the contracted services, including:
– Communication
– Invoicing & accounting
– User access for project platforms
– File transfer
– Technical support
– Analytics and security
We do not sell personal data and do not process beyond agreed purposes unless required by law.
Typical personal data we may process:
– Name, email, company details
– Payment and invoice information
– Communication records
– Technical metadata (IP, device, browser)
– Uploaded assets containing incidental personal data
We do not require or accept sensitive personal data (health, religion, biometrics, etc.).
3DLEGENDS will:
– Process data only on documented instructions from the Client.
– Maintain appropriate technical and organizational security measures.
– Ensure personnel with access are bound by confidentiality.
– Notify the Client of data breaches without undue delay.
– Assist the Client with GDPR requests when reasonably required.
– Maintain records of processing activities where legally required.
However:
Assistance beyond standard obligation (e.g., custom reports, tracing, legal requests) is billable.
The Client is responsible for:
– Ensuring they have a legal basis for all data shared with 3DLEGENDS.
– Ensuring data provided is accurate and lawful.
– Not sending unnecessary or sensitive personal data.
– Maintaining their own GDPR obligations toward their customers.
– Informing 3DLEGENDS of changes in processing requirements.
3DLEGENDS is not liable for unlawful instructions or data shared by the Client.
3DLEGENDS uses trusted subprocessors for hosting, storage, rendering, AI workflows, analytics, and collaboration.
Subprocessors may include (examples, non-exhaustive):
– Cloud storage (AWS, Google Cloud, Dropbox)
– Rendering farms
– AI processing tools
– Project management platforms (Notion, Asana, Slack)
– Payment processors IDEAL, Vipps)
– Email and security providers
The Client provides general authorization for 3DLEGENDS to use subprocessors as needed.
3DLEGENDS ensures subprocessors follow GDPR-level standards, but is not liable for failures of third-party platforms.
Data may be transferred outside the EEA under:
– Standard Contractual Clauses (SCCs)
– Adequacy decisions
– Industry-standard safeguards
Because many tools (render farms, AI systems, cloud storage) are globally distributed, the Client acknowledges and agrees to these transfers.
3DLEGENDS employs:
– Encrypted transfers (TLS/HTTPS)
– Secure cloud storage
– Access control & authentication
– Password rotation
– Limited personnel access
– Malware & intrusion protection systems
Absolute security cannot be guaranteed.
If a personal data breach occurs:
– 3DLEGENDS will notify the Client without undue delay
– Provide known details, remediation steps, and required guidance
We are not responsible for breaches due to:
– Third-party platforms
– The Client’s own systems or credentials
– Force majeure events
– Acts outside 3DLEGENDS control
Unless otherwise agreed:
– Project files: up to 5 years
– Final deliverables: 12 months
– Personal data: only as long as needed for service delivery, legal compliance, or legitimate business interests
Upon contract termination:
– Client may request deletion
– 3DLEGENDS may retain data where legally required or for legitimate business purposes (e.g., tax records, portfolio rights)
Deletion requests are logged and processed within 30–60 days, unless technically impractical.
3DLEGENDS assists with rights requests (access, rectification, erasure, portability) only when strictly necessary and only after:
– verifying identity
– written request from the Client
– possible service fees for extensive support
To the fullest extent permitted by law:
– 3DLEGENDS’ total liability under this DPA is limited to the fees paid in the last 12 months.
– 3DLEGENDS is not responsible for indirect losses, downtime, data corruption, or third-party failures.
– This DPA does not extend liability beyond what is stated in the main Terms & Conditions.
Clients may not perform physical audits.
However, we may provide:
– Documentation
– Policy outlines
– System descriptions
Any on-site inspection (if ever required by law) must be:
– Requested 60 days in advance
– Minimally disruptive
– Limited to what is legally required
– Fully billable at our standard rate
This DPA remains active:
– As long as 3DLEGENDS processes data for the Client
– Or until replaced by a newer version
– Or 12 months after termination of the main agreement
Surviving obligations include confidentiality, security, and liability limitations.
This DPA is governed by:
Dutch law / EU GDPR
All disputes fall under the exclusive jurisdiction of:
The Netherlands.
Direct in contact. Deep in detail.
Fast in delivery. Legendary in impact.
- Direct in contact
We believe the best ideas grow through real conversations. No layers, no middlemen — just creators talking to creators. Working directly means clarity, speed, and energy. You speak, we build — together.
- Deep in detail
Every pixel, reflection, and shadow tells a story. Our craft is precision — whether it’s a product, architecture, or an entire world in 3D. We see what others overlook, turning vision into visual perfection.
- Fast in delivery
Deadlines don’t scare us — they sharpen us. Our streamlined process, smart workflows, and AI-enhanced production make speed a superpower without sacrificing quality. Efficiency meets artistry.
- Legendary in impact
What we create isn’t just seen — it’s remembered. From global campaigns to niche brands, our visuals inspire, move, and connect. Designed for now, built to last — truly legendary in impact.
Partnering with trailblazing agencies across the globe
