Data Processing Agreement

Version: 2026-10 · As of: 1 December 2026

Parties

This agreement applies between the customer of REALONAUT 360 (“controller”) and REALONAUT GmbH, Feldgasse 12, 1080 Vienna, Austria, FN 467668y, Commercial Court of Vienna, UID ATU72214846 (“processor”). It supplements the agreement on the use of REALONAUT 360 under Part B of the REALONAUT General Terms and Conditions (“Terms”) (“Main Agreement”).

Agreement

1 Subject matter, conclusion and term

1.1 The processor processes personal data on behalf of the controller insofar as the controller uses the REALONAUT 360 platform to create, publish, share and embed virtual tours.

1.2 The agreement is concluded when the Terms are accepted at registration; the controller confirms it with the mandatory checkbox, which also covers the controller's status as a business and the Terms. For customers who concluded an agreement on REALONAUT 360 before 17 October 2026, it applies from their consent, in particular with the checkbox that the owner or an admin of the company ticks once for the company when first signing in to the new platform.

1.3 The agreement applies for as long as the Main Agreement exists and beyond that until all data has been deleted in accordance with point 10.

2 Nature and purpose of the processing

2.1 Nature of the processing: storage, technical preparation (for example tiles, preview images, resizing, editing of images in the editor, blurring of areas on instruction), provision of tours and making them publicly available on the instruction of the controller, analysis of views without cookies and without storing IP addresses, receipt and management of access requests to locked rooms including confirmation by email, access codes and messages to prospects on behalf of the controller, backup and deletion.

2.2 Purpose: creation, publication and embedding of 360-degree tours, above all for marketing real estate, and analysis of how often and for how long they are viewed, as well as, where the controller locks rooms, handling access requests and contact regarding the property concerned.

3 Categories of data and data subjects

3.1 Categories of data:

  • Image data: 360-degree panoramas, detail photos and floor plans of the properties with their metadata (including the capture location); persons, objects or documents may be recognisable in images.
  • Master data: information on the property entered by the controller (for example title, address, property reference number, key facts such as sale or rent, price, living area, rooms), name, title and profile picture of the staff members looking after the property, name and logo of the company, insofar as they appear in the tour.
  • Communication data: telephone numbers and email addresses of the staff members and of the company that are shown in the tour for enquiries.
  • Log data: technical access data when a tour is opened (for example IP address for delivery, time, browser identifier, embedding website) and view statistics derived from it; IP addresses are not stored for the statistics.
  • Prospect data (locked rooms only): name, email address, telephone number, language, requested tour and room, page from which the request was sent, times of request and confirmation, wording and version of the checkbox, truncated IP addresses, status of the request, hash of the email address, access code stored only as a hash with its validity and use.

3.2 Categories of data subjects:

  • customers and their staff members, insofar as their data appears in tours;
  • visitors to the published tours;
  • persons shown in photos;
  • owners, tenants and occupants of the properties shown;
  • prospects who request access to locked rooms via a tour.

3.3 This agreement does not cover data that the processor processes as a controller in its own right, in particular user accounts and sign-in, contract, payment and invoice data, support requests, the log of important changes and server logs for operational security. The Privacy Policy at realonaut.com/datenschutz/ applies to such data.

4 Instructions

4.1 The processor processes the data only on documented instructions from the controller. Instructions are in particular the settings and actions that the controller or its users carry out in the platform (for example publishing a tour, taking it offline, deleting it, blurring areas, handing over a tour) and instructions in text form.

4.2 If the processor considers an instruction to be unlawful, it informs the controller without undue delay.

4.3 If the processor is required by law to carry out other processing (for example under B10 of the Terms in the case of unlawful content), it informs the controller beforehand, unless the law prohibits this.

5 Obligations of the controller

The controller is responsible for the lawfulness of the processing, in particular for ensuring that it may publish photos and information (B5.4 and B5.5 of the Terms) and that it informs visitors to its own website about embedded tours (B5.9). It blurs recognisable persons and documents before publication unless consent has been given; the platform does not offer automatic detection.

6 Confidentiality

The processor only engages persons who are bound by confidentiality (section 6 DSG, Austrian Data Protection Act). At REALONAUT, only platform administrators have access to the controller's data, insofar as this is necessary for operation and support; every change they make is logged (Annex 1).

7 Security of processing

The processor takes the technical and organisational measures under Art. 32 GDPR set out in Annex 1. It may develop them further as long as the level of protection does not decrease.

8 Sub-processors

8.1 The controller authorises the engagement of the sub-processors listed in Annex 2.

8.2 The processor informs the controller by email at least four weeks in advance of any new or changed sub-processors. The controller may object for good cause relating to data protection; if no agreement is reached, it may terminate the Main Agreement with effect from the date on which the change takes effect.

8.3 The processor contractually binds sub-processors to the obligations of this agreement. Transfers to countries outside the EU take place only under the conditions of Art. 44 et seq. GDPR.

8.4 The processor transfers images to external artificial intelligence services only if the controller has ordered a corresponding add-on service and the service is listed in Annex 2. It passes other personal data to such services only insofar as this is necessary for operation, troubleshooting or maintenance and the service is listed in Annex 2.

9 Assistance and notification of breaches

9.1 The processor assists the controller with requests from data subjects (Art. 12 to 22 GDPR). The controller can fulfil many requests itself in the platform (changing content, blurring areas, taking tours offline or deleting them, deleting users). The processor forwards requests that it receives directly without undue delay.

9.2 It assists the controller with the obligations under Art. 32 to 36 GDPR, insofar as the information available to it permits.

9.3 The processor notifies the controller of a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it, with the information under Art. 33(3) GDPR, insofar as available.

10 Deletion and return

10.1 After the end of the Main Agreement, the processor deletes the controller's data 14 days after the company or the account has been deleted (B12.6 of the Terms), unless there is an obligation to retain it. If only a paid plan ends, the account reverts to the Free plan under B12.3 of the Terms; the data then remains stored. On request to support@realonaut.com, the processor provides the original images of the tours as a download before deletion.

10.2 Further periods are set out in Annex 3. Data in backups is deleted when the backup sets expire (Annex 1).

11 Evidence and audits

The processor makes available the information necessary to demonstrate compliance with its obligations and allows audits by the controller or by an auditor appointed by the controller and bound by confidentiality, after timely notice. Evidence is provided primarily by documents, in particular Annex 1 and the evidence provided by the sub-processors. On-site audits take place at most once a year, with at least four weeks' notice and without disrupting operations; the processor charges for the resulting effort on a time and effort basis.

12 Final provisions

12.1 Liability is governed by Art. 82 GDPR; otherwise the liability provisions of the Terms apply.

12.2 In the event of conflict, this agreement takes precedence over the Main Agreement insofar as the protection of personal data is concerned.

12.3 Austrian law applies. Place of jurisdiction as in the Terms (A8).

Annex 1: Technical and organisational measures

This annex describes the measures of the REALONAUT 360 platform.

Confidentiality

  • Tenant separation: each company sees only its own data. The separation is enforced in the application for every query and additionally secured in part in the database.
  • Roles and permissions within the company (owner, admin, team lead, agent) according to a fixed permissions table; every action is checked on the server.
  • Passwords stored only as a hash, at least ten characters; limits on sign-in attempts; invitations without sending access credentials; time-limited reset links.
  • Second factor by email code or authenticator app available for all users and mandatory for platform administrators.
  • The capture location from image metadata is never delivered publicly.
  • Blurring of areas on our own server without external services; the original remains private.
  • Tour statistics without cookies and without storing IP addresses; the player sets no cookies and loads no content from third-party servers.
  • The player delivers images, spots and tiles of locked rooms only after a valid access code has been entered, via signed URLs that are valid for no more than two hours; each request checks whether the code is still valid. Access codes are stored only as a hash, and failed attempts are limited. After a code has been entered, the player stores an access key in the browser's storage until the access expires, for no more than 30 days where the access does not expire; it still sets no cookies.
  • Test systems are reachable only from the internal network.

Integrity

  • Log of important changes and of all changes made by platform administrators, including when signed in as a user (who, when, what, state before and after, without passwords and keys), retained for three years.
  • Handover log for every change of responsibility for a tour.
  • All connections over public networks are encrypted (TLS or SSH).

Availability and resilience

  • Hosting in the European Union (Annex 2).
  • Monitoring of services with notification of outages; only service names, no customer data, pass through the notification service.
  • Backups to separate storage with the hosting provider in the European Union (Hetzner Storage Box): database hourly, images daily; 48 hourly (database only), 14 daily, 8 weekly and 5 monthly backup sets are retained. In addition, server snapshots with the hosting provider and a mirror of the images, synchronised daily, on separate storage with the hosting provider at the same location. Images in the object storage are versioned; older versions are kept for 30 days.
  • Restoration from the backups is tested regularly.

Process for regular review

  • Automated tests for permitted and prohibited actions of every role and for tenant separation, which run before every change.
  • Documentation of every change to system and configuration.
  • REALONAUT installs security updates for the operating system and software on an ongoing basis, at least monthly, and without undue delay for critical vulnerabilities.

Physical security

  • Access to and physical security of the data centres according to the measures of the hosting provider (Annex 2), as described in the data processing agreement with Hetzner.

Annex 2: Sub-processors

  • Hetzner Online GmbH, Gunzenhausen, Germany: servers and object storage; place of processing Nuremberg, Germany; processing only in the EU; data processing agreement concluded on 10 October 2026. In addition, backups on a Hetzner Storage Box (Annex 1).
  • easyname GmbH, Vienna, Austria: sending the platform's emails (for example invitations, codes for the second factor) via a realonaut.com mailbox. Data centres in Austria and Germany; data processing agreement concluded on 12 October 2026.
  • ipax, Vienna, Austria: operation of the previous system with the data from the period before 17 October 2026, as long as individual customers still use it. To safeguard the migration, the processor keeps a copy of this data on its own server in Vienna, accessible only to platform administrators. Both are deleted as soon as they are no longer needed.
  • Anthropic Ireland, Limited, Ireland (artificial intelligence service Claude by Anthropic): support with the operation, troubleshooting and maintenance of the platform; in individual cases, personal data such as identifiers, email addresses or IP addresses may be processed. In addition, reading floor plan templates for the ordered add-on service. Processing also outside the EU, in particular in the USA, on the basis of appropriate safeguards under Art. 44 et seq. GDPR; the data is not used for training. Anthropic's service providers: trust.anthropic.com/subprocessors.
  • Further artificial intelligence services will be added here in advance in accordance with point 8.2.

Stripe processes payment data for billing under the Main Agreement and is not a sub-processor for the content of the tours.

Annex 3: Retention and deletion periods

  • Tours, images and information on the property: until deleted by the controller; after the end of the agreement in accordance with point 10.1.
  • Original of an image after blurring: remains stored privately until the room is deleted.
  • Users of the controller: if a user is deleted, their account is deleted; their tours remain with the controller and show the controller's contact details.
  • Individual views in the statistics: seven days, after that only daily totals without personal reference.
  • Log of important changes: three years (processing as a controller in its own right, for information).
  • Support requests: are considered resolved if there is no response within 30 days of our reply, and are deleted together with their history three years after that (processing as a controller in its own right, for information).
  • Access requests to locked rooms: without confirmation, 7 days after sending; otherwise 12 months after the last activity, deleted automatically every day. If a prospect ends contact, their name, email address and telephone number are deleted immediately; the record (times, wording, version, truncated IP addresses, hash of the email address) remains until this period expires. The controller can permanently delete an entry including the record at any time.
  • Backups: until the backup sets expire (Annex 1), no longer than six months. Deleted content may still be contained in backups until then.
Call Book a call