Data Processing Addendum
This Data Processing Addendum ("DPA") is part of the Terms of Service between FitWear and each business customer ("Shop"). It applies when FitWear processes personal data of the Shop's website visitors to provide the try-on, as required by Article 28 GDPR and the Kosovo Law No. 06/L-082 on the Protection of Personal Data.
1. Roles and scope
- The Shop is the controller; FitWear is the processor.
- Data subjects: visitors of the Shop's website who use the try-on.
- Data: uploaded photos (face images), generated images, product page and photos, time, photo fingerprint, consent version, IP address in logs.
- Purpose and nature: generating and displaying try-on images, usage statistics, abuse prevention.
- Duration: for the term of the Shop's account; photos are deleted right after each try-on (see retention below).
2. FitWear's obligations
- Process the data only on the Shop's documented instructions - these Terms, the dashboard settings and this DPA - unless the law requires otherwise.
- Ensure that people with access are bound to confidentiality.
- Apply appropriate technical and organisational measures: HTTPS, encrypted secrets, private storage of photos, access control, automatic deletion, size-limited logs.
- Help the Shop respond to data subject requests and with data protection impact assessments where needed.
- Notify the Shop without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting its visitors.
- Make available the information needed to demonstrate compliance and allow reasonable audits, normally by written questionnaire.
3. Subprocessors
The Shop authorises the subprocessors listed on the Subprocessors page. FitWear imposes equivalent data protection obligations on them, informs Shops of intended changes at least 14 days in advance by updating that page and by e-mail for material changes, and Shops may object on reasonable grounds.
4. International transfers
Transfers outside Kosovo and the EU/EEA rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
5. Retention and deletion
The visitor's photo (portrait) is deleted as soon as the try-on finishes - also when it fails - and any copy left behind by an interruption is removed automatically within 2 hours. Generated try-on images are deleted automatically after 30 days. When the Shop's account ends, its remaining try-on data is deleted or anonymised within 30 days unless the law requires otherwise.
6. The Shop's obligations
- Inform its visitors in its own privacy policy that FitWear provides the try-on and link to the Try-on Privacy Notice.
- Keep the consent step of the widget unchanged.
- Use the try-on only for lawful purposes and only for adults.