Skip to main content
SpAItial

Data Processing Agreement

SpAItial Data Processing Agreement

Updated: 5 November 2026

This Data Processing Agreement ("DPA") forms part of the SpAItial Terms of Service (the "Terms") between SpAItial Ltd ("SpAItial") and the customer that has agreed to the Terms ("Customer"). It applies automatically, without signature, whenever SpAItial processes Customer Personal Data on Customer's behalf. If this DPA conflicts with the Terms, this DPA prevails in relation to the processing of personal data.

1. Definitions

  • "Customer Personal Data" means personal data contained in User Input that Customer, or its end users, submit to the Services on Customer's behalf, and in the Generated Content produced from it.
  • "Data Protection Law" means the EU General Data Protection Regulation ("EU GDPR"), the UK GDPR and Data Protection Act 2018, the German Federal Data Protection Act (BDSG), and any other data protection law that applies to the processing.
  • "Subprocessor" means a third party SpAItial engages to process Customer Personal Data.
  • "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
  • "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.
  • Other terms (controller, processor, data subject, processing) have the meanings given in Data Protection Law. Capitalised terms not defined here have the meanings given in the Terms.

2. Roles

2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own customer. SpAItial is Customer's processor, or subprocessor.

2.2 Model improvement. SpAItial may use Customer’s inputs and Generated Content to train, fine-tune or evaluate its models only to the extent permitted by the Terms and any applicable agreement with Customer. Any applicable exclusion from model improvement under the Terms will be respected.

Before making customer-derived material available for model training, SpAItial applies a sanitisation process designed to remove personal information and reduce the risk of identifying individuals. Material that does not satisfy SpAItial’s privacy checks is excluded from the training dataset.

To the extent that preparing or using material for SpAItial’s own model-improvement purposes involves personal data, SpAItial Ltd acts as an independent controller and is responsible for its compliance with Data Protection Law, including lawful basis, transparency, retention and individuals’ rights, as described in its Privacy Notice. Sanitised material is treated as personal data unless effective anonymisation has been established.

Customer must provide any information required by Data Protection Law concerning its disclosure of personal data to SpAItial for these purposes. This does not relieve SpAItial of its own transparency obligations.

2.2A Group support. SpAItial Ltd determines the purposes of its model-improvement activities and may engage SpAItial GmbH, its German subsidiary, to provide model-development services on its behalf. Where those services involve personal data, they are governed by an intercompany data-processing agreement. SpAItial Ltd remains the Customer’s contracting party and responsible for its obligations under this DPA.

2.2B Training safeguards. Access to unsanitized customer material is restricted to authorised personnel and systems responsible for service delivery, sanitisation and privacy checks. Model-development personnel receive only approved sanitised training material and do not receive customer-account identifiers or access to original uploads through the training environment. Any retained source-to-training linkage is separately secured and access-restricted. SpAItial periodically tests the effectiveness of its sanitisation measures.

2.2C Training retention. Temporary copies created to prepare material for model improvement will be deleted when preparation is complete or the material is rejected, and in any event within 30 days of their creation. This does not change the retention of originals held separately to provide the Services.

Approved customer-derived training datasets that remain personal data will be retained only while needed for model improvement and for no more than five years from their first approval for training. SpAItial will review continued retention at least annually and delete material earlier where it is no longer needed or where applicable law or the agreement with Customer requires. Reprocessing or copying material does not restart the five-year period.

Any source-to-training linkage will be separately secured and retained only for as long as necessary to administer permissions, removal requests and compliance, and no longer than the associated training material, unless applicable law requires otherwise.

Material that has been effectively anonymised may be retained for model improvement without a fixed retention period, subject to the Terms and any applicable agreement with Customer. SpAItial will periodically reassess identification risk and will not attempt to re-identify individuals from anonymised material.

2.3 SpAItial is a controller, not a processor, of the account, billing, security and usage data it needs to run the Services, as described in its Privacy Notice.

2.4 Scope of processor obligations. Sections 3 to 6 govern processing carried out by SpAItial on Customer’s behalf. Processing for which SpAItial acts as an independent controller is governed by clauses 2.2 to 2.3, SpAItial’s Privacy Notice and applicable Data Protection Law. SpAItial remains responsible for its own obligations as a controller, including responding to individuals’ requests concerning that processing. The security measures in Annex II apply, as relevant, to personal data processed for model improvement.

3. SpAItial's obligations

3.1 Instructions. SpAItial processes Customer Personal Data only on Customer's documented instructions. Customer's instructions are the Terms, this DPA, and Customer's use and configuration of the Services, including API requests. SpAItial will tell Customer if it believes an instruction breaks Data Protection Law, unless the law prohibits this.

3.2 Confidentiality. SpAItial ensures that everyone authorised to process Customer Personal Data is bound by confidentiality.

3.3 Security. SpAItial maintains the technical and organisational measures in Annex II and will not materially reduce them during the term of the Terms.

3.4 Data-subject requests. Customer can access and delete Customer Personal Data itself through the Services, including the Developer API (for example DELETE /v1/worlds/requests/{request_id}). If SpAItial receives a request directly from a data subject about Customer Personal Data, it will pass it to Customer and not respond itself, except to say it has been passed on. SpAItial will give reasonable help with requests Customer cannot handle itself.

3.5 Other help. Taking into account the nature of the processing and the information available to it, SpAItial will give Customer reasonable help with security, breach notification, data protection impact assessments and prior consultation with supervisory authorities (Articles 32 to 36 GDPR).

3.6 Personal Data Breaches. SpAItial will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe the breach, its likely consequences and the measures taken, and SpAItial will update it as more information becomes available. Notifying Customer is not an admission of fault.

3.7 Return and deletion at the end. When the Terms end, SpAItial will, at Customer’s choice, return or delete Customer Personal Data processed on Customer’s behalf, and delete remaining copies, within 30 days, unless applicable law requires retention. Customer may request return through privacy@spaitial.ai. Personal data separately processed by SpAItial as an independent controller for model improvement is subject to clauses 2.2 to 2.2C and SpAItial’s Privacy Notice.

3.8 Records and audits. SpAItial will make available the information needed to show it complies with this DPA. That means its most recent SOC 2 report or summary, under confidentiality, and answers to one reasonable security questionnaire a year. Customer may audit in person only where a supervisory authority requires it, or after a Personal Data Breach. Customer must give 30 days' notice, the audit must be during business hours and under confidentiality, and Customer bears its own costs.

4. Customer's obligations

4.1 Customer is responsible for having a lawful basis for the Customer Personal Data it submits, and for giving the people concerned any information required by Data Protection Law.

4.2 Customer will not submit special categories of personal data, criminal-offence data or children's personal data unless SpAItial has agreed in writing.

4.3 Customer will instruct its end users not to make individuals the subject of captures, and will not knowingly submit captures in which individuals are identifiable other than incidentally.

5. Subprocessors

5.1 Customer authorises SpAItial to use the Subprocessors listed at spaitial.ai/subprocessors.

5.2 SpAItial will give at least 30 days' notice before a new Subprocessor starts processing Customer Personal Data, by updating that page and emailing Customer's account owner. Customer may object on reasonable data protection grounds during the notice period. If the parties cannot resolve the objection, Customer may stop using the affected Services and receive a pro-rata refund of prepaid, unused fees for them.

5.3 SpAItial imposes data protection terms on each Subprocessor that are no less protective than this DPA, and remains responsible to Customer for its Subprocessors' performance.

6. International transfers

6.1 Customer Personal Data may be processed in the locations listed at spaitial.ai/subprocessors.

6.2 Transfers from the EEA to SpAItial in the United Kingdom rely on the European Commission's adequacy decision for the United Kingdom. If that decision ceases to apply, the SCCs apply to those transfers and are incorporated by reference: Module 2 where Customer is a controller, and Module 3 where Customer is a processor. Clause 7 (docking) applies. In Clause 9, Option 2 applies, with the notice period in section 5.2. The optional wording in Clause 11 does not apply. In Clauses 17 and 18, the law and courts of Germany (Munich) apply. Annexes I to III of this DPA complete the SCCs' annexes.

6.3 Where SpAItial's Subprocessors process Customer Personal Data in countries without an adequacy decision, SpAItial relies on the EU-US Data Privacy Framework where the Subprocessor is certified, and otherwise on the SCCs (Module 3), with the UK Addendum for UK personal data.

7. General

7.1 This DPA lasts for as long as SpAItial processes Customer Personal Data.

7.2 Each party's liability under this DPA is subject to the limitations of liability in the Terms.

7.3 If there is a conflict, the following order applies: the SCCs (where they apply), then this DPA, then the Terms.

7.4 SpAItial may update this DPA. Material changes that reduce Customer's protection take effect under the change-notice terms in clause 3 of the Terms.

7.5 Questions: privacy@spaitial.ai.

Annex I: Description of processing

  • Data exporter: Customer (controller, or processor for its own customer). Contact: Customer's account owner.
  • Data importer: SpAItial Ltd, 1-2 Paris Garden, London SE1 8ND, United Kingdom (processor). Contact: privacy@spaitial.ai. SpAItial GmbH’s role in model-development activities is described in clause 2.2A.
  • Data subjects: Customer's end users; occupants, owners and tenants of captured properties; individuals appearing incidentally in images, video or captures.
  • Categories of data: images and video of properties and spaces, which may incidentally show personal items, documents or individuals; text prompts; capture metadata (camera poses, timing and, if enabled, device motion); generated 3D worlds and related assets.
  • Special categories: none intended. No biometric processing.
  • Nature and purpose: storing, moderating, processing and generating 3D worlds and assets from Customer's inputs, and delivering them to Customer, including hosted viewing and export.
  • Frequency: continuous, for as long as Customer uses the Services.
  • Retention: Customer Personal Data processed on Customer’s behalf is retained for the periods applicable to the relevant Service and is deleted following Customer’s deletion instructions or in accordance with clause 3.7. Separate copies prepared or retained for model improvement are subject to clause 2.2C.
  • Supervisory authority for SCC transfers: Where the SCCs apply, the competent supervisory authority is determined in accordance with Clause 13 of the SCCs and identified in the applicable SCC Annex I.C.

Annex II: Technical and organisational measures

  • Encryption: in transit with TLS 1.2 or higher, and at rest with AES-256.
  • Tenant isolation: database row-level security per customer; customer content stored under per-customer and per-world paths.
  • Access control: staff access through single sign-on with enforced multi-factor authentication. Administrative access to internal infrastructure only over a private network. Credentials held in a managed secret store.
  • Perimeter: public endpoints behind a web application firewall.
  • Change management: every infrastructure change ships as a reviewed, revertible commit, with automated static analysis on all product repositories.
  • Vulnerability management: continuous dependency and code scanning. Fixes within 7 days (critical), 30 days (high) and 90 days (medium).
  • Testing: independent penetration test at least once a year.
  • Resilience: daily backups to independent storage, and point-in-time recovery for the customer database.
  • Logging: audit logs of security-relevant actions, kept for 90 days online and 400 days in archive.
  • People: security-awareness training and a signed acknowledgement of security policies for all staff.

Annex III: Subprocessors

The current list, with each Subprocessor's purpose and processing location, is at spaitial.ai/subprocessors.