Data Processing Agreement
How Urbania processes personal data on behalf of its clients. Version in force since September 18, 2026.
1. Parties and purpose
This agreement is entered into between Urbania Group LLC ("Urbania" or the "Processor") and the developer, marketer, real estate agency or organization that contracts the Urbania platform (the "Client" or the "Controller").
It governs the processing of personal data that Urbania carries out on behalf of the Client when providing its services: Showroom, Urbania360, Cam and the associated panels. It forms part of the commercial agreement between the parties (the accepted proposal, the contract or the terms of service) and applies from the moment the Client starts using the platform.
2. Definitions
"Personal data", "processing", "controller" and "processor" have the meaning given to them by the applicable data protection law, which depending on the case may include Argentina's Law 25,326, Brazil's General Data Protection Law (LGPD), United Arab Emirates Federal Decree-Law 45/2021 (PDPL), the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
"Subprocessor" means any provider that processes personal data on behalf of Urbania to provide the service. "Security incident" means any unauthorized access to, loss, alteration or disclosure of personal data processed under this agreement.
3. Description of the processing
Data subjects: visitors to the Client's sites, people who submit an inquiry or make a reservation, users of the Client and its agents in the panels, contacts of the Client's campaigns and, in Cam, people who appear in construction-site images or communicate over WhatsApp.
Data: identification and contact data (name, email, phone and, if the Client asks for them, ID number, city and budget), messages and conversations with the virtual assistant, browsing data (IP address, device, pages visited) and images. Urbania does not ask for sensitive data; the Client undertakes not to collect it through the platform.
Purpose: to provide the contracted service. Duration: while the commercial agreement is in force, plus the periods in clause 12.
4. Client obligations
The Client is responsible for having a legal basis for the processing, for informing data subjects (the platform includes a privacy policy it can use for that purpose) and for ensuring that its instructions comply with applicable law.
Optional integrations (analytics pixels, Google Tag Manager, ad lead forms, payment gateway) are enabled and configured by the Client, under its own responsibility. In Cam, the Client is responsible for informing workers and visitors of the site about the cameras.
5. Urbania obligations
Urbania processes personal data only to provide the service and following the Client's documented instructions, which are this agreement and the configuration the Client makes on the platform. If an instruction appears to infringe applicable law, Urbania informs the Client.
Urbania does not sell personal data or use it for its own purposes. It may use aggregated and anonymized statistics on platform usage, which do not identify any person, to maintain and improve the platform.
Urbania personnel with access to the data are bound by confidentiality and access it only to the extent necessary to provide the service and support.
6. Security
Urbania applies technical and organizational measures appropriate to the risk, including: encryption in transit (TLS) and at rest (AES-256), logical isolation of each client's data, role-based access control, daily backups, bot protection and request rate limiting, and error monitoring with on-screen data masking.
The current details are published at urbania3d.app/security. Urbania may update these measures provided it does not reduce the level of protection.
7. Subprocessors
The Client authorizes Urbania to use the subprocessors published at urbania3d.app/legal/subprocessors. Urbania requires each of them to meet data protection obligations equivalent to those in this agreement and remains liable to the Client for their performance.
Before adding or replacing a subprocessor, Urbania publishes it on that page and gives notice by email at least 15 days in advance. If the Client objects on reasonable data protection grounds, the parties seek an alternative in good faith; if none is found, the Client may terminate the affected service without penalty.
8. International transfers
The primary database is located in Brazil. Some subprocessors process data in the United States or other countries, as stated in the subprocessor list. Urbania carries out those transfers with the safeguards each provider offers in its data processing terms (such as standard contractual clauses) and to the extent required by applicable law.
If the Client needs its data to remain in a specific region, Urbania can quote a dedicated deployment in that region.
9. Data subject rights
If Urbania receives a request from a data subject (access, rectification, erasure, objection or other), it forwards it to the Client without delay and within 5 business days at the latest, and does not respond to it on its own unless the Client instructs it to.
Urbania assists the Client in responding to those requests. At the Client's request, it delivers a copy of its project data in a structured format (CSV or JSON) or deletes it.
10. Security incidents
Urbania notifies the Client of any security incident affecting its data without undue delay and within 72 hours of becoming aware of it.
The notice describes, to the extent known: what happened, which data and data subjects were affected, the likely consequences and the measures taken or proposed. Urbania cooperates with the Client so it can meet its own notification obligations to authorities and data subjects.
11. Information and audits
Urbania makes available to the Client the information reasonably necessary to demonstrate compliance with this agreement, primarily through documentation and written answers.
If that is not sufficient, the Client may carry out an audit once per year, with 30 days' notice, on business days, at its own cost and under a confidentiality undertaking, or commission it to an independent auditor subject to the same conditions.
12. End of the service
When the commercial agreement ends, the Client has 30 days to request a copy of its data. After that period, Urbania deletes the Client's personal data.
Backups are renewed automatically: deleted data disappears from them when their retention cycle expires, within a maximum of 30 additional days. Urbania may keep only what a legal obligation requires, and solely for that purpose.
13. Liability
Each party's liability under this agreement is governed by the limits and exclusions agreed in the commercial agreement between the parties.
14. Governing law
This agreement is governed by the laws of the State of the United States in which Urbania Group LLC is organized, without prejudice to the mandatory data protection rules of the country of the Client or of the data subjects, which apply as appropriate.
15. Versions and changes
Urbania may update this agreement. Material changes are notified by email at least 30 days in advance; changes required by law or by an authority may apply sooner.
This agreement is published in Spanish and English. In case of any discrepancy between the two versions, the Spanish version prevails.