Data Processing Agreement

This page is the standard form of our DPA. For a countersigned copy to attach to your agreement, contact legal@aviatostudio.com.

1. Roles

Where you (the “Customer”) use Aviato Studio to process personal data, you act as the controller and RivTech (SASU) acts as the processor (or sub-processor where you are yourself a processor). This DPA applies to that processing and is governed by the GDPR.

2. Our obligations as processor

RivTech will:

• process personal data only on your documented instructions, including as set out in the Service and this DPA;
• ensure persons authorised to process the data are bound by confidentiality;
• implement appropriate technical and organisational measures (Annex 2);
• assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your obligations under GDPR Articles 32–36;
• notify you without undue delay after becoming aware of a personal-data breach;
• at your choice, delete or return personal data at the end of the Service, subject to legal retention requirements;
• make available information necessary to demonstrate compliance and allow for audits as described in Section 5.

3. Sub-processors

You grant general authorisation for RivTech to engage the sub-processors listed in Annex 3 to provide the Service. We impose data-protection obligations on each sub-processor no less protective than those in this DPA, and we remain responsible for their performance. We will inform you of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data-protection grounds.

4. International transfers

Where processing involves a transfer of personal data outside the EEA — for example to our US-based sub-processors — such transfers are made under the European Commission’s Standard Contractual Clauses, supplemented by the technical measures in Annex 2. Simulation geometry and results are stored within the EU.

5. Audits

On reasonable prior written notice and no more than once per year (unless required by a supervisory authority), we will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality and to not compromising the security of other customers.

6. Liability & governing law

Liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by French law, with the courts referenced in the Terms having jurisdiction.

Annex 1 — Details of processing

• Subject matter: provision of the Aviato Studio CFD platform.
• Duration: the term of the Service plus the retention periods in our Privacy Policy.
• Nature & purpose: hosting, computation, storage, and display of customer projects and account data to deliver the Service.
• Categories of personal data: account identifiers (name, email), authentication data, usage and billing metadata, and any personal data the Customer chooses to include in uploaded files or configurations.
• Categories of data subjects:the Customer’s authorised users and personnel.
• Special categories: none are intended or required; do not upload special-category data.

Annex 2 — Technical & organisational measures

Encryption of personal data in transit (TLS) and at rest; logical tenant isolation; least-privilege access controls; EU storage of simulation files; and reliance on certified infrastructure providers. Full details are on our Security page, which forms part of this Annex.

Annex 3 — Authorised sub-processors

Contact

For DPA questions or a signed copy: legal@aviatostudio.com.