Esoft Data Processing Agreement
In force
Version 1.0 · effective 1 November 2026 · all versions at esoft.com/terms
Key terms at a glance
A summary only. The DPA below governs.
Roles
You are the controller of the personal data in what you upload. Esoft International A/S processes it on your behalf.
Security
Esoft protects the data with the measures in Annex 2 and is ISO 27001 certified, including its production company in Vietnam.
Sub-processors
Esoft uses the sub-processors in Annex 3 and gives 10 business days’ notice before adding or replacing one.
Breaches
Esoft tells you about a personal data breach without undue delay, where feasible within 48 hours.
Deletion
Uploads are deleted within 30 days of delivery, and delivered files 14 days after delivery.
Esoft’s own use
Esoft’s parent company may use images to improve the services and train AI models, as the Terms allow. You can exclude this by an Amendment.
1. Scope
1.1 This Data Processing Agreement (“DPA”) is between the Client and Esoft International A/S (“Esoft”). It is part of the Agreement under clause 1.4(c) of the Esoft Terms of Service (the “Terms”) and is accepted with the Terms.
1.2 The DPA applies to personal data that Esoft processes on the Client’s behalf to provide the Services, mainly personal data in the Input and Delivered Materials (“Client Personal Data”). The Client is the controller, or a processor for its own customer; Esoft is the Client’s processor or sub-processor.
1.3 The DPA does not cover data that Esoft or its group processes as a controller, such as account and billing data or the use in section 8. Esoft’s privacy notice describes that processing.
1.4 Words defined in the Terms or the GDPR have the same meaning here.
1.5 A Client that already has a data processing agreement with Esoft, such as Esoft International’s agreement of June 2023, keeps it until it accepts this DPA. Until then, section 8 does not apply to that Client’s data.
2. Esoft’s obligations
2.1 Instructions. Esoft processes Client Personal Data only on the Client’s documented instructions: the Terms, each Order and the settings the Client chooses in the Platform. Esoft tells the Client if it believes an instruction breaks data protection law. If the law requires Esoft to process the data in another way, Esoft tells the Client first, unless the law forbids it.
2.2 Confidentiality. Everyone Esoft allows to process Client Personal Data is bound by confidentiality.
2.3 Security. Esoft protects Client Personal Data with the measures in Annex 2 (Article 32 GDPR). It may change them as long as the overall level of security does not go down.
2.4 The Client’s part. The Client makes sure it has a lawful basis for the processing and has given any notices required, including to people who appear in its images. The Client does not upload special categories of personal data unless agreed in writing.
3. Sub-processors
3.1 The Client authorises Esoft to use sub-processors. The current list is in Annex 3 and at esoft.com/terms.
3.2 Esoft gives at least 10 business days’ notice of a new or replacement sub-processor, by updating the list and by email to the account’s administrative users.
3.3 The Client may object on reasonable data protection grounds by writing to legal@esoft.com within the notice period. If Esoft cannot offer a reasonable alternative within 30 days, the Client may end the affected Services without penalty, as its only remedy.
3.4 Esoft puts a written contract in place with each sub-processor, with data protection obligations equivalent to this DPA, and remains responsible for its sub-processors.
4. Transfers outside the EU/EEA
4.1 Esoft transfers Client Personal Data outside the EU/EEA only where data protection law allows it: to a country with an adequacy decision, to a recipient certified under the EU–US Data Privacy Framework, or under the EU Standard Contractual Clauses (“SCCs”), with the UK Addendum for UK data. Annex 3 shows the safeguard for each sub-processor.
5. Personal data breaches
5.1 Esoft notifies the Client of a personal data breach without undue delay, and where feasible within 48 hours, by email to the account’s administrative users.
5.2 The notice describes, as far as known, what happened, the data and people affected, the likely consequences and the measures taken. Esoft adds information as it becomes available and takes reasonable steps to contain the breach. A notification is not an admission of fault.
6. Assistance and audits
6.1 Data subject requests. Esoft passes any request from a data subject to the Client and helps the Client respond, as far as the nature of the processing allows.
6.2 Other assistance. Esoft gives reasonable help with the Client’s obligations on security, breach notification, impact assessments and prior consultation (Articles 32–36 GDPR). Help beyond what the Services include may be charged at Esoft’s standard rates.
6.3 Information. On request to legal@esoft.com, Esoft provides the information needed to show compliance with this DPA, including its ISO 27001 certificate, which covers Esoft International and Esoft Vietnam.
6.4 Audits. If that information is not enough, or a supervisory authority requires it, the Client may audit Esoft, itself or through an independent auditor bound by confidentiality: with 30 days’ written notice, at most once a year unless an authority requires more, within an agreed scope, and at the Client’s cost.
7. Deletion
7.1 Delivered Materials can be downloaded for 14 days after delivery and are then deleted (Terms clause 3.6). Downloading them is how the Client gets its data back.
7.2 Input is deleted within 30 days after its Order is delivered or cancelled.
7.3 Longer storage applies only where the Client has agreed it in an Amendment.
7.4 When the Agreement ends, paid Delivered Materials stay available for 14 days (Terms clause 13.5(f)). Esoft then deletes the remaining Client Personal Data within 30 days, unless the law requires Esoft to keep it.
8. Esoft’s own use of data
8.1 As the Terms allow (clauses 6.2(d) and 7.4), Esoft makes Input and Delivered Materials available to its parent company, Esoft Systems A/S. Esoft Systems uses them as an independent controller to improve the services, test and train AI models, develop products and make before-and-after marketing images. This DPA does not govern that use.
8.2 A Client that does not want its Input used this way can exclude it by an Amendment.
9. General
9.1 Liability. Liability under this DPA follows clause 12 of the Terms, as far as the law allows.
9.2 Precedence. On data protection, this DPA prevails over the Terms, Order Forms and Amendments (Terms clause 1.4). Where the SCCs apply, they prevail over this DPA.
9.3 Term and changes. This DPA applies as long as Esoft processes Client Personal Data. Esoft may update it under clause 14 of the Terms; each version is published at esoft.com/terms with its version number and effective date.
9.4 Law. Danish law governs this DPA, and disputes are resolved under clause 17 of the Terms.
Annex 1 — Details of the processing
Subject matter
Editing and delivery of real-estate images, video and floor plans ordered through the Platform or the API
Duration
The term of the Agreement, until deletion under section 7
Nature and purpose
Upload, storage, AI and manual editing, quality checks, delivery and deletion, to provide the Services the Client orders
Data subjects
People who appear in or can be identified from the Input, such as owners, occupants and agents; people named in Order instructions
Personal data
Images and video in which people, documents or number plates may be visible; property addresses; names and contact details in Order instructions; image metadata such as GPS location
Special categories
None intended (section 2.4)
Where
Denmark and the EU (AWS in Ireland; Microsoft and Google in the EU); production in Vietnam, India and the Philippines; some services in the USA (Annex 3)
Annex 2 — Security measures
Based on the measures Esoft publishes at esoft.com/data-governance.
Encryption
TLS/HTTPS in transit; data encrypted at rest
Access
Multi-factor login to the Platform and production; documented, least-privilege access to customer data, reviewed regularly
Logging
Access and actions in the Platform and systems are logged
Network
Segmented, encrypted network, monitored by a Security Operations Center through the hosting provider
Resilience
Redundant hosting; daily backups; up-to-date anti-malware
Testing
Ongoing platform checks and testing by an ethical hacker
Suppliers
Contracts with data protection terms equivalent to this DPA (section 3.4). Hosting suppliers are certified to ISO 27001, 27017, 27018 and ISO 9001; external editing vendors are ISO 27001 certified or give a similar level of protection
Physical security
Individual access keys and codes, and monitoring at Esoft’s sites
Disposal
Hardware is reset before reuse and destroyed so that data cannot be recovered
People
Confidentiality obligations for everyone with access (section 2.2)
Annex 3 — Sub-processors
Esoft Vietnam Co. Ltd
Post-editing and production of images, video and floor plans
Vietnam
SCCs
External editing vendors
Editing of images, video and floor plans by outside editors
India; the Philippines
Same security level as this DPA (ISO 27001 or similar)
Amazon Web Services, Inc.
Hosting, file storage, backup, content delivery
Ireland (EU)
SCCs
Microsoft Corporation
Hosting, file storage, backup; CRM, ERP and accounting
EU
SCCs
Cloudflare, Inc.
Network security and content delivery for the Platform
USA and EU
Data Privacy Framework; SCCs
Acronis International GmbH
Backup (Acronis Protect Cloud)
EU
Adequacy decision (Switzerland); SCCs
Adobe
Editing software used in production
Esoft’s production machines
None: client images are not sent to Adobe’s cloud
Google LLC
Cloud computing for statistics
EU
SCCs
Google LLC (Gemini API)
AI editing and generation of images and video
EU
Data Privacy Framework; SCCs
Runway AI, Inc.
AI video production
USA
SCCs
Visoid
Rendering in production
EU
None: hosted in the EU
Floorplanner
Floor plan production
EU
None: hosted in the EU
SolarWinds Worldwide, LLC (Papertrail)
Application and system logs
EU
SCCs
Dropbox, Inc.
Delivery of materials between US clients and Esoft Vietnam
USA
Data Privacy Framework; SCCs
Scrive ApS (formerly Contractbook)
Holds the record of each client’s acceptance of the Terms
EU (some support services in the USA)
Data Privacy Framework for the US services
