This agreement forms part of the Terms of Service and applies to every studio using D2PLAN. It governs the personal data a studio enters into the service about others, under regulation 15 of the Israeli Privacy Protection (Data Security) Regulations, 2017, and Article 28 of the GDPR.
1. Parties and roles
- The studio (the subscriber) is the controller of the data.
- תמר גולדשמיד זירת האדריכלות, which operates D2PLAN, is the processor that processes the data on the studio's behalf.
2. The data covered
- Data subjects: the studio's clients and their family members (as provided), contacts of suppliers and contractors, and the studio's employees.
- Types of data: contact details, the property's address, project details, plans, images, documents and contracts, budget and payments, questionnaire answers, messages, and employees' working hours.
- Purpose: providing the service to the studio only — design, client and project management, calendar, documents, and communication with clients.
- Duration: as long as the account is active, and until the data is deleted under section 8.
3. Processing only on the studio's instructions
We process the data only on the studio's instructions. Using the service, the settings the studio chooses and the actions it takes are the instructions. If an instruction appears to us to breach the law, we will say so. We will not use the data for any other purpose, sell it, or use it to train models.
4. Confidentiality
Our staff who are exposed to the data are bound by confidentiality, and get access only when it is needed to run the service or handle a fault.
5. Security
We take appropriate security measures, including:
- Encryption of all traffic, and encryption of data stored with providers.
- Permissions: each studio sees only its own data, and a studio's employees see only what the studio allowed.
- Sign-in with a one-time code or a password; codes and passwords are stored only as hashes, and a password is locked for 15 minutes after repeated wrong tries. A list of devices that can be signed out, and two-step sign-in for administrators.
- Logs of security events, nightly backups and regular restore tests.
- Handling security incidents under a written procedure, and working in line with the data security regulations.
6. Subprocessors
The studio authorises us to use the subprocessors in the list. We will add any new provider to the list and give notice at least 30 days before it starts receiving data. A studio that objects can tell us and cancel the subscription without penalty. We bind every subprocessor to obligations protecting the data at a level no lower than this agreement, and remain responsible to the studio for its work.
7. Helping the studio
- Requests from individuals: the service has tools to view, correct, export and delete data. If a client of the studio contacts us directly, we will pass the request on to the studio.
- Security incidents: we will notify the studio without undue delay, and no later than 48 hours after becoming aware of an incident affecting its data, with what is known and what we have done. This lets the studio meet its own reporting duty.
- Assessments and consultations: we will give the studio the information it needs for a data protection impact assessment or for contacting an authority.
8. End of the engagement
Before closing the account, you can download a copy of all the data. When the account is deleted, the data is deleted from the service immediately, and from backups within 30 days. Data that must be kept by law is kept only as that obligation requires.
9. Audit
On request, and at a reasonable frequency, we will give the studio the information it needs to show that we comply with this agreement.
10. Transfers abroad
Data is transferred outside Israel or the European Union only as the law allows, and for data about people in the EU, under standard contractual clauses (SCCs), which form part of this agreement where they are required.
11. General
Liability under this agreement is subject to the liability section of the Terms of Service, to the extent the law allows. If this agreement and the Terms of Service conflict on a matter of personal data, this agreement prevails.