Data Processing Agreement (DPA)
Last Updated: October 14, 2026
This Data Processing Agreement ("DPA") forms part of the agreement between the business customer using Gemetica ("Customer") and the legal operator of Gemetica identified in Section 15 ("Gemetica," "we," "us," or "Processor").
This DPA applies where Gemetica processes personal data on behalf of the Customer in connection with the Service, to the extent applicable data protection law requires a data processing agreement and this DPA has been validly incorporated into the parties' agreement.
This DPA supplements Gemetica's Terms & Conditions, available at https://gemetica.com/docs/terms.
1. Definitions
"Applicable Data Protection Law" means the data protection laws applicable to the relevant processing, including, where applicable, the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the Turkish Personal Data Protection Law No. 6698 ("KVKK").
"Personal Data," "Processing," "Controller," "Processor," and "Data Subject" have the meanings assigned to them under the applicable data protection law.
"Customer Data" means personal data submitted to or generated within Gemetica by or on behalf of the Customer, including personal information contained in design projects, review links, comments, feedback, and approval records.
"Subprocessor" means a third party engaged by Gemetica to process Customer Data on behalf of the Customer.
2. Roles of the Parties
For Customer Data processed on the Customer's behalf, the Customer acts as Controller and Gemetica acts as Processor, unless the circumstances establish a different relationship under applicable law.
The Customer determines the purposes and lawful basis for processing Customer Data.
Gemetica processes Customer Data to provide and support the Service in accordance with this DPA, the Terms & Conditions, and the Customer's documented lawful instructions.
Gemetica may separately act as Controller for account administration, billing-related communications, security, business operations, and other processing described in its Privacy Policy.
Paddle acts as Merchant of Record for purchases processed through its checkout and may process buyer information for its own purposes and legal obligations. Paddle is not automatically a Subprocessor of Customer Data.
3. Processing Instructions
Gemetica will process Customer Data only on documented instructions from the Customer, including instructions expressed through the Customer's use and configuration of the Service, unless otherwise required by applicable law.
Where legally required, Gemetica will inform the Customer before processing Customer Data outside those instructions, unless prohibited from doing so by law.
Gemetica will inform the Customer if, in its reasonable assessment, an instruction infringes Applicable Data Protection Law, where such notification is legally required.
The Customer is responsible for ensuring that its instructions and use of the Service comply with Applicable Data Protection Law.
4. Confidentiality
Gemetica will ensure that persons authorized to process Customer Data are subject to appropriate confidentiality obligations.
Access to Customer Data will be restricted to authorized persons and service providers who reasonably require access to operate, secure, maintain, or support the Service.
5. Security Measures
Gemetica will implement appropriate technical and organizational measures proportionate to the risks associated with processing Customer Data.
These measures will include, as applicable:
- Encryption of data in transit.
- Authentication and account access controls.
- Database-level access restrictions and appropriate authorization checks.
- Access controls for stored 3D design files.
- Review-link validation and access restrictions.
- Measures to prevent unauthorized access, modification, or disclosure.
- Security monitoring, incident response, and vulnerability remediation.
- Procedures for restricting access to or deleting Customer Data.
Gemetica's review links are designed to allow clients and collaborators to view designs without creating an account.
Anyone possessing an active review link may access the associated design and available feedback or approval features.
Customers are responsible for distributing review links appropriately.
When a design is archived or deleted, its review link becomes inactive. Gemetica will enforce the resulting access restriction through its application and storage access controls.
Temporary model-download links issued before a review link becomes inactive may remain valid until they expire, currently for up to five minutes, unless the model file is removed earlier. Deactivating a review link does not remove copies, screenshots, or recordings already obtained by a recipient.
6. Design Files and Local Conversion
When a Customer uploads a supported Rhino 3DM file, conversion to GLB format takes place locally within the user's browser.
Original 3DM files are not uploaded to or stored on Gemetica's servers through this workflow.
The resulting compressed GLB files may be uploaded and stored to provide visualization, sharing, and review functionality.
When a stored model is replaced, Gemetica deletes the previous stored model file after the replacement has been successfully uploaded, subject to applicable backup and technical limitations.
Gemetica does not provide a persistent history of previous stored 3D model versions.
7. Subprocessors
The Customer grants Gemetica general authorization to engage Subprocessors reasonably necessary to provide the Service.
Gemetica will impose appropriate data protection obligations on Subprocessors, including obligations concerning confidentiality, security, and processing of Customer Data.
Gemetica will maintain information about relevant Subprocessors and notify Customers of intended additions or replacements where required by Applicable Data Protection Law.
Where legally required, Customers will have an appropriate opportunity to object to changes involving Subprocessors.
If an objection cannot reasonably be resolved, the Customer may terminate the affected Service in accordance with the applicable agreement and mandatory law.
The providers currently planned for use in the Service are described in Annex A.
Not every service provider identified in Annex A is necessarily a Subprocessor of Customer Data.
8. International Data Transfers
Customer Data may be processed or stored in countries outside the Customer's country of residence or establishment.
Where Applicable Data Protection Law requires a recognized international transfer mechanism, Gemetica and the relevant parties will implement an appropriate lawful mechanism before the transfer takes place.
Depending on the circumstances, this may include an adequacy decision, applicable Standard Contractual Clauses, or another legally valid transfer mechanism.
This DPA does not, by itself, execute Standard Contractual Clauses or establish that every international transfer is lawful.
Transfers subject to the GDPR, UK GDPR, or KVKK will be assessed under the requirements applicable to those transfers.
9. Data Subject Requests
Taking into account the nature of the processing, Gemetica will provide reasonable assistance to the Customer in responding to requests from individuals exercising their applicable data protection rights.
Where Gemetica receives a request relating to Customer Data processed solely on behalf of the Customer, Gemetica may direct the requester to the Customer unless otherwise required by law.
10. Personal Data Breaches
Gemetica will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Customer Data, where notification is required by Applicable Data Protection Law.
Gemetica will provide reasonably available information concerning the nature of the incident, affected data, potential consequences, and measures taken or proposed.
Gemetica will reasonably cooperate with the Customer in fulfilling legally required breach notification and response obligations.
11. Assistance and Compliance
Taking into account the nature of processing and the information available to Gemetica, Gemetica will provide reasonable assistance with:
- Data protection impact assessments.
- Security and data protection obligations.
- Regulatory consultations where legally required.
- Information reasonably necessary to demonstrate compliance with applicable processor obligations.
Where required by Applicable Data Protection Law, Gemetica will permit and contribute to appropriate audits or inspections, subject to reasonable confidentiality, security, and operational safeguards.
12. Return and Deletion of Customer Data
Upon termination of the applicable Service or deletion of the Customer's account, Gemetica will delete or return Customer Data in accordance with the Customer's applicable instructions and available Service functionality, unless retention is required by law.
Account deletion may remove stored 3D models, projects, review links, comments, feedback, and approval records.
Residual data may remain temporarily in backups or legally required records, subject to appropriate safeguards and retention limitations.
Archived or deleted designs will no longer be accessible through their former review links.
13. Processing Details
Subject Matter: Provision of a cloud-based jewelry design visualization, sharing, feedback, and review service.
Duration: For the duration of the Customer's use of the Service and any applicable lawful retention period.
Nature of Processing: Collection, receipt, storage, organization, display, transmission, access management, deletion, and related operations necessary to provide the Service.
Purpose: To enable the Customer to manage jewelry design projects and obtain reviews, comments, and approvals from clients and collaborators.
Categories of Data Subjects: Customer personnel, jewelry designers, clients, collaborators, reviewers, and other individuals whose Personal Data is included in Customer Data.
Categories of Personal Data: Names or identifiers provided by users, email addresses where collected, comments, feedback, approval records, project metadata, and personal information voluntarily included in uploaded or submitted content.
Sensitive Data: The Service is not designed for processing special categories of Personal Data. Customers should not intentionally submit such data unless expressly authorized and appropriate safeguards are in place.
14. Order of Precedence
If this DPA conflicts with Gemetica's Terms & Conditions regarding the processing of Customer Data on behalf of the Customer, this DPA will prevail to the extent required by Applicable Data Protection Law.
Other provisions of the Terms & Conditions remain in effect.
15. Contact and Business Information
Service Name: Gemetica
Legal Entity / Operator: NİLİFER KARA ARKAN
Business Address: CAMİİ CEDİT MAH. BEŞ ULALI SK. NO: 14 KULA/ MANİSA/ REPUBLIC OF TÜRKİYE
Country of Establishment: Republic of Türkiye
Email: contact@gemetica.com
Website: https://gemetica.com
Annex A — Service Providers and Subprocessors
Gemetica uses or plans to use the following service providers to operate, maintain, and support the Service.
The role of each provider depends on the specific personal data processed and the relevant contractual arrangements.
| Service Provider | Purpose | Data Processing Role |
|---|---|---|
| Supabase | User authentication, database hosting, and application backend services. | Expected Subprocessor for relevant Customer Data. |
| Cloudflare | Cloudflare Pages hosting, Cloudflare R2 file storage, infrastructure security, and Cloudflare Web Analytics where enabled. | Expected Subprocessor for relevant Customer Data; roles may vary by service. |
| Resend | Transactional email delivery, including account-related notifications and service communications where enabled. | Subprocessor where it processes Customer Data on Gemetica's behalf. |
| Paddle | Merchant of Record, payment processing, subscription billing, and refund management. | Generally an independent controller for payment-related data; not automatically a Customer Data Subprocessor. |
| Infomaniak | Business email hosting and management of communications sent to Gemetica's business email addresses. | Service provider; may act as a processor for personal data contained in support communications. |
| Namecheap | Domain registration and domain administration services. | Domain service provider; not ordinarily a Subprocessor of Customer Data solely by providing domain registration. |
Gemetica will maintain appropriate contractual and security arrangements with providers that process personal data on its behalf, as required by Applicable Data Protection Law.
Gemetica will update this Annex when relevant service providers, processing purposes, or roles change.
The inclusion of a provider in this Annex does not mean that the provider receives all categories of Customer Data.
Annex B — Technical and Organizational Security Measures
Gemetica's security measures are designed to protect Customer Data against unauthorized access, disclosure, alteration, and loss, taking into account the nature of the Service and the risks of processing.
The measures described below apply to the extent implemented and relevant to the processing.
1. Access Control
- User authentication through Supabase Auth.
- Database access restrictions through authorization rules and Row Level Security policies.
- Access to stored design files through controlled storage permissions and authorized upload or retrieval mechanisms.
- Restrictions on access to administrative functions and sensitive service credentials.
2. Data Transmission and Storage
- HTTPS encryption for supported communications between users and the Service.
- Storage of compressed GLB design files using Cloudflare R2.
- Separation of user-accessible application functionality from privileged backend operations.
- Appropriate protection of authentication tokens and service credentials.
3. Review Link Security
- Review links grant access only while active.
- Review recipients are not required to register or sign in.
- Archiving or deleting a design deactivates the corresponding review link.
- Application authorization checks reject new requests through inactive review links. Temporary model-download links issued before deactivation may remain valid until expiry, currently for up to five minutes, unless the model file is removed earlier.
- Deactivating a review link does not remove copies, screenshots, or recordings already obtained by a recipient.
4. Design File Processing
- Supported Rhino 3DM conversion occurs locally in the user's browser.
- Original 3DM files are not uploaded to Gemetica's servers through the supported conversion workflow.
- Resulting compressed GLB files may be stored in Cloudflare R2.
- Previous stored model files are deleted following successful replacement, subject to applicable technical and backup limitations.
5. Incident Response and Maintenance
- Investigation and remediation of identified security incidents.
- Reasonable measures to address security vulnerabilities.
- Restriction of access to service infrastructure and administrative credentials.
- Cooperation with Customers concerning reportable Personal Data breaches where required by law.
6. Data Deletion
- Account deletion initiates removal of associated Customer Data, subject to applicable legal and technical retention requirements.
- Stored design files and associated review links are included in the deletion workflow.
- Backup copies and legally retained records are subject to appropriate access restrictions and retention procedures.
© 2026 Gemetica. All rights reserved.