Opar360 Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between Opar360 ("Processor," "we," "us," or "our") and the client company identified in the applicable order form or account registration ("Controller" or "Client"), and forms part of the agreement between Opar360 and the Client governing the Client's use of the Opar360 platform (the "Principal Agreement"). This DPA applies to the extent that Opar360 processes Personal Data on behalf of the Client in the course of providing the Opar360 managed 360° video property tour platform.

1. Parties

Each is a "Party" and together the "Parties." Capitalized terms not defined in this DPA have the meaning given in the Principal Agreement.

2. Definitions

• "Personal Data," "Processing," "Controller," "Processor," "Data Subject," and "Personal Data Breach" have the meanings given to them under applicable data protection law.
• "Sub-processor" means any third party engaged by Opar360 to process Personal Data on the Client's behalf in order to provide the platform.
• "Applicable Data Protection Law" means the data protection and privacy laws applicable to the Personal Data processed under this DPA, including the laws of Bangladesh where Opar360 is established, and any data protection law applicable to the Client's own jurisdiction where relevant. See Section 12 for the placeholder on jurisdiction-specific detail.

3. Subject Matter, Duration, Nature and Purpose of Processing

Subject matter: Opar360's processing of Personal Data on behalf of the Client in connection with the hosting and operation of managed 360° video property tours, the Client's admin and staff access to the Client workspace, and the capture of enquiries submitted by End Visitors through published tours.

Duration: This DPA remains in effect for as long as Opar360 processes Personal Data on the Client's behalf under the Principal Agreement, and terminates automatically on termination of the Principal Agreement, subject to Section 10 (Return or Deletion of Data).

Nature of processing: collection, storage, hosting, transmission, and deletion of Personal Data via the Opar360 platform (database records, transactional email, and object storage).

Purpose of processing: to provide the Client with a hosted 360° tour platform, to route End Visitor enquiries to the Client, to operate Client staff logins to the Client workspace, and to generate aggregated tour-engagement analytics for the Client.

4. Categories of Data Subjects and Personal Data

5. Processor Obligations

Opar360, as Processor, shall:

• Process only on instructions. Process Personal Data only on the Client's documented instructions, including with regard to international transfers, unless required to do otherwise by law applicable to Opar360, in which case Opar360 shall inform the Client of that legal requirement before processing, unless prohibited from doing so.
• Confidentiality. Ensure that personnel authorized to process Personal Data are bound by confidentiality obligations, whether contractual or statutory.
• Security. Implement appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, taking into account the nature of the Personal Data and the risks presented by processing.
• Assistance with Data Subject requests. Taking into account the nature of the processing, provide reasonable assistance to the Client, by appropriate technical and organizational measures, to respond to requests from Data Subjects seeking to exercise their rights under Applicable Data Protection Law.
• Breach notification. Notify the Client without undue delay after becoming aware of a Personal Data Breach affecting the Client's Personal Data, and provide information reasonably available to Opar360 to assist the Client in meeting any of its own breach-notification obligations. [PLACEHOLDER — specific notification deadline, e.g., "within 72 hours," to be agreed and confirmed by legal review]
• Deletion or return on termination. At the Client's choice, delete or return all Personal Data to the Client after the end of the provision of services, and delete existing copies, subject to Section 10 and any retention required by law.
• Audit rights. Make available to the Client information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client, subject to reasonable advance notice, confidentiality, and scheduling that does not unreasonably disrupt Opar360's operations.

6. Security Measures

Opar360 maintains technical and organizational measures appropriate to the nature of the Personal Data processed, including access controls limiting Personal Data access to authorized personnel, encryption of data in transit, use of signed and time-limited URLs to restrict direct access to stored media, and hashing of certain analytics identifiers as described in the Opar360 Privacy Policy. Opar360 does not claim certification to any specific security or compliance standard (such as ISO 27001 or SOC 2) under this DPA; if the Client requires such certification, this must be confirmed separately and is not represented here.

7. Sub-processors

The Client provides general written authorization for Opar360 to engage the following Sub-processors, identified from Opar360's current technical infrastructure, to support delivery of the platform:

Opar360 shall inform the Client of any intended addition or replacement of a Sub-processor, giving the Client an opportunity to object on reasonable data-protection grounds. [PLACEHOLDER — notice period for Sub-processor changes, and objection process, to be confirmed by legal review]

The Client's own payment processor (aamarPay, used for billing the Client's subscription) is engaged directly in connection with the Principal Agreement's billing terms; Opar360 does not store raw payment card or mobile-banking credentials. Whether aamarPay itself acts as a Sub-processor under this DPA depends on what Personal Data, if any, flows through it beyond payment processing — [PLACEHOLDER — to be confirmed by legal review].

8. International Data Transfers

Bangladesh is Opar360's primary operating jurisdiction, and Opar360's own infrastructure and personnel are principally based there. The Sub-processors listed in Section 7 are global infrastructure providers and may process or store Personal Data outside Bangladesh, including in jurisdictions with different data protection regimes. Where such transfers occur, Opar360 will rely on the applicable Sub-processor's own safeguards for cross-border transfer. [PLACEHOLDER — specific transfer mechanism, e.g., standard contractual clauses or equivalent, to be confirmed by legal review if required by the Client's jurisdiction]

9. Liability

Liability arising out of this DPA is subject to the limitations of liability set out in the Principal Agreement, unless otherwise required by Applicable Data Protection Law.

10. Return or Deletion of Data on Termination

On termination or expiry of the Principal Agreement, Opar360 will make Personal Data available for export or deletion in line with the data-retention terms of the Opar360 Privacy Policy and Terms of Service, including the 90-day grace period described there. [PLACEHOLDER — confirm whether a shorter or different deletion timeline is required for DPA purposes specifically]

11. Governing Law and Dispute Resolution

Bangladesh is intended to be the governing jurisdiction for this DPA, consistent with the Opar360 Terms of Service. [PLACEHOLDER — final governing-law and dispute-resolution clause pending legal review, including whether any Client-jurisdiction-specific data protection law provisions must additionally be incorporated]

12. Execution

This DPA is intended to be executed by an authorized signatory of each Party once finalized. It is not effective until signed by both Parties.

Questions about this draft DPA can be directed to contact@opar360.com.