Data processing agreement

Version 1.0 · Effective 2026-11-02

Print this page or save it as PDF to sign it. Fill in the parts in [brackets]. The version that applies to you is the one you signed; the table at the end shows which version was current on your signing date.

Parties

	Controller (the merchant)	Processor
Name	[Merchant legal name]	FitMyType [legal entity to be confirmed]
Address	[Registered address]	[Address to be confirmed]
Registration number	[Company registration number]	[To be confirmed]
Signed by	[Name and title of signatory]	[Name and title of signatory]
Date	[Date]	[Date]

This agreement is part of the service agreement between the parties for the FitMyType size recommendation service (the “Service”). It applies whenever FitMyType processes personal data for the merchant through the Service. If this agreement and the service agreement disagree on data protection, this agreement wins.

1. Subject, duration and purpose

FitMyType processes personal data only to provide the Service: size recommendations for the merchant's shoppers, the statistics the merchant sees in the back office, and the support the merchant asks for. The processing lasts as long as the service agreement, plus the time needed to return and delete the data (section 10).

Annex 1 describes the processing: data subjects, data categories, purposes and retention.

2. Instructions

FitMyType processes personal data only on the merchant's documented instructions: this agreement, the service agreement and the settings the merchant chooses in the back office. FitMyType tells the merchant without delay if it believes an instruction breaks data protection law.

3. Confidentiality

Everyone at FitMyType who can access the personal data is bound to confidentiality, and has access only as far as their work needs it.

4. Security

FitMyType keeps the technical and organisational measures in Annex 2 and may improve them; it never lowers their overall level during the agreement.

5. Sub-processors

The merchant gives FitMyType a general authorisation to use the sub-processors on the public sub-processor list (Annex 3). FitMyType binds each sub-processor to data protection terms at least as protective as this agreement and stays responsible for it.

Before adding or replacing a sub-processor, FitMyType announces the change on the list and emails it to the merchant's account owner at least 30 days before it takes effect. Anyone can also subscribe to these emails on the list page. The merchant may object on reasonable data protection grounds within that period; the parties then look for a solution in good faith, and if none is found the merchant may end the affected part of the Service.

6. Where data is processed

FitMyType hosts all data of the Service in the European Union. A transfer outside the EU or EEA happens only to a sub-processor that the list marks as outside the EU, and only under Standard Contractual Clauses or another safeguard the GDPR allows.

7. Help with shopper requests

FitMyType helps the merchant answer shoppers who use their rights (access, copy, correction, deletion, objection). A request that reaches FitMyType directly (for example at [email protected]) is passed to the merchant without undue delay; FitMyType then finds, exports or deletes the shopper's data on the merchant's instruction.

8. Personal data breaches

FitMyType tells the merchant without undue delay, and at the latest within 48 hours, after it becomes aware of a personal data breach that affects the merchant's data. The notice says what happened, which data and how many people are concerned, the likely effects, and what FitMyType does about it; details follow as they become known.

9. Information and audits

FitMyType gives the merchant the information needed to show that this agreement is kept, starting with the security overview and the sub-processor list. The merchant, or an independent auditor bound to confidentiality, may audit once a year with 30 days' notice, or at any time after a breach or when a supervisory authority asks. Each party bears its own costs.

10. End of the agreement

When the service agreement ends, the merchant can export its data from the back office for 30 days. FitMyType then deletes the merchant's personal data, including on shoppers' behalf, within 30 more days, and from backups when they expire (at the latest 90 days later), unless the law requires keeping it. FitMyType confirms the deletion in writing on request.

11. Impact assessments and authorities

FitMyType helps the merchant with data protection impact assessments and with consulting a supervisory authority, as far as the processing by the Service is concerned.

Annex 1: Description of the processing

Data subjects	The merchant's shoppers who use the size tool; the merchant's back-office users.
Data categories	Shopper answers (gender, age, height, weight, body shape, bra, foot or head size, usual brands and sizes, fit preference); estimated body measurements and 3D body data; a random device id and usage events (only with analytics consent); order and return lines linked to that id; browser description. Back-office users: name, email address, sign-in data.
Special categories	None are asked for. Body measurements are not used to identify a person.
Purposes	Size recommendations; statistics for the merchant about its size advice; product sizing data quality; support.
Retention	Browser description: 30 days. Body data in events: anonymised after 25 months. Data on the shopper's device: as stated in the shopper privacy notice. Everything: deleted at the end of the agreement (section 10).
Location	European Union.

Annex 2: Technical and organisational measures

The measures below are also published on the security overview.

Measure	Area	What it does	Status
Encryption in transit	Encryption	Every address we serve answers only over HTTPS (TLS), with HTTP Strict Transport Security.	In place
Body data encrypted with its own key	Encryption	Stored 3D body data and fit results are encrypted at rest with a dedicated key that is used for nothing else.	In place
Sealed merchant secrets	Encryption	Shop credentials, app tokens and two-factor secrets are sealed in a vault (envelope encryption with per-client keys that can be rotated). Nobody reads them in clear text, staff included.	In place
Encrypted backups	Encryption	Nightly backups are encrypted on our servers before they are copied to a separate EU storage provider.	In place
Back-office sign-in with two-factor authentication	Access control	Back-office users sign in with a password and can turn on a one-time code app (TOTP). Each user sees only the shops they were invited to.	In place
Sandboxed widget frame and Content-Security-Policy	Widget isolation	The size tool runs in its own sandboxed frame on our domain, with a strict Content-Security-Policy, so the shop page cannot read shopper answers and the frame cannot reach the shop page.	In place
Checked messages between page and frame	Widget isolation	The shop page and the frame talk only through a checked message channel that accepts known origins and known message shapes.	In place
Bot filtering	Operations	Events from bots and data-centre addresses are filtered out, so they neither skew statistics nor fill storage.	In place
EU hosting	Operations	All service data is hosted in the European Union. The vendors we use are on the public sub-processor list.	In place
Internal security review	Testing	The widget, the frame and the API had an internal security review; its findings are tracked to closure.	In place
External penetration test	Testing	An independent penetration test of the widget, the API and the back office, then once a year.	Planned: 2027-Q1

Annex 3: Sub-processors

The authorised sub-processors are those on the sub-processor list on the day this agreement is signed, and those added later under section 5.

Signatures

For the merchant

Name and title: ______________________

Date: ____________

Signature: ______________________

For FitMyType

Name and title: ______________________

Date: ____________

Signature: ______________________

Versions

Version	Applies to agreements	What changed
Version 1.0	Signed from 2026-11-02 (current)	First version.