Trust and privacy
FitMyType hosts all data in the European Union and processes shopper data only for the merchant. These pages answer a standard vendor security and privacy questionnaire.
-
Data processing agreement
The template a merchant signs with us, with its annexes.
-
Sub-processors
Who processes data for us, where, and how changes are announced.
-
Security overview
Encryption, access control, widget isolation and testing.
-
Shopper privacy notice
What shoppers are told about their data.
Where to find each answer
| Question | Answer | Where |
|---|---|---|
| Who is controller and who is processor? | The merchant is controller; FitMyType is processor. | DPA, parties |
| Which personal data is processed, and why? | Shopper answers and body data, usage events with consent, back-office users. | DPA, Annex 1 |
| Where is data hosted? | In the European Union. | DPA, section 6 |
| Who are your sub-processors? | Listed with region and safeguard. | Sub-processor list |
| How are sub-processor changes announced? | By email and on the list, at least 30 days ahead. | DPA, section 5 |
| Is data encrypted in transit and at rest? | TLS everywhere; body data and merchant secrets encrypted at rest. | Security overview |
| How is access controlled? | Per-shop access, two-factor sign-in. | Security overview |
| When was the last penetration test? | An internal review is done; an external test is planned. | Security overview |
| How fast are breaches reported? | Without undue delay, at the latest within 48 hours. | DPA, section 8 |
| What happens to data when the contract ends? | Export, then deletion. | DPA, section 10 |
| How do you help with shopper data requests? | We find, export or delete a shopper's data on your instruction. | DPA, section 7 |
| What is stored on the shopper's device? | Listed key by key, with consent rules. | Shopper privacy notice |