Last updated: 21 September 2026 (prepared revision)
RENDERED FITS LTD
Data Processing Agreement
Pursuant to Article 28 of the UK GDPR and EU GDPR
Version 1.3
Effective Date: [DATE OF APP INSTALLATION]
Revision prepared: 21 September 2026 (Phase 7 data and privacy rebuild)
Prior published version last updated: 16 July 2026
Between:
The Merchant (as identified in the Shopify App installation)
("Controller")
and
Rendered Fits Ltd
Company No. 16922551 | VAT No. 510026164
50-54 Oswald Road, Scunthorpe, North Lincolnshire, DN15 7PQ
("Processor")
Each a "Party" and together the "Parties"
DATA PROCESSING AGREEMENT
Background
1.1 The Controller is a Shopify merchant who has installed the Rendered Fits virtual try-on application (the "App") on its Merchant Store.
1.2 The Processor provides the App, which enables the Controller's customers ("End Users") to upload photographs and receive AI-generated virtual try-on images depicting the End User wearing products from the Controller's store.
1.3 In providing the App, the Processor processes Personal Data on behalf of the Controller. This Data Processing Agreement ("DPA") sets out the terms on which the Processor processes Personal Data on behalf of the Controller, in compliance with Article 28 of the UK General Data Protection Regulation ("UK GDPR") and the EU General Data Protection Regulation ("EU GDPR").
1.4 This DPA is incorporated into and forms part of the Merchant Terms and Conditions (the "Principal Agreement") between the Parties. In the event of any conflict between this DPA and the Principal Agreement, this DPA shall prevail in respect of matters relating to data protection.
1.5 Capitalised terms used but not defined in this DPA shall have the meanings given to them in the Principal Agreement. Terms such as "Personal Data", "Special Category Data", "Processing", "Controller", "Processor", "Sub-processor", "Data Subject", and "Personal Data Breach" shall have the meanings given to them in the UK GDPR and EU GDPR (as applicable).
2. Scope, Nature and Purpose of Processing
2.1 The Processor shall process Personal Data on behalf of the Controller only to the extent necessary to provide the App and the Virtual Try-On Feature, and only in accordance with this DPA and the Controller's documented instructions.
2.2A Fit Passport data excluded. The optional Fit Passport consumer account is operated by Rendered Fits Ltd as an independent data controller, and not as the Controller's processor. Personal Data processed in connection with a Fit Passport (a Customer's account email, and the measurements and photographs the Customer chooses to store with Rendered Fits) is outside the scope of this DPA and is governed by the Fit Passport Privacy Notice (renderedfits.com/legal/fit-passport-privacy-notice). This DPA continues to govern the standard, session-only Virtual Try-On Feature and the size-recommendation, conversion-attribution, and analytics processing carried out on the Controller's behalf.
2.2 The details of the processing are set out in Annex 1 (Processing Details), which forms part of this DPA. In summary:
(a) Subject matter: Provision of the Rendered Fits virtual try-on application
(b) Nature of processing: Collection, temporary storage, transmission to sub-processor, AI image generation, AI size recommendation (including Redis caching of recommendation results), conversion attribution, and automated deletion
(c) Purpose of processing: Generating virtual try-on images for the Controller's End Users; providing AI size recommendations at the End User's request; enforcing rate limits; attributing conversions; and providing analytics to the Controller
(d) Duration of processing: For the term of the Principal Agreement (i.e., for as long as the App remains installed on the Controller's Merchant Store), plus any period necessary to complete deletion obligations
3. Controller Obligations
3.1 The Controller shall:
(a) ensure that it has all necessary rights, consents, and legal bases to provide the Personal Data to the Processor for Processing in accordance with this DPA, the Principal Agreement, and applicable Data Protection Laws;
(b) provide the Processor with documented instructions for Processing, and not instruct the Processor to process Personal Data in a manner that would violate applicable Data Protection Laws;
(c) ensure that its privacy notices to End Users adequately disclose the Processing carried out by the Processor, including the involvement of the AI Service and the sub-processors identified in Annex 2;
(d) ensure that the end-user consent mechanism provided by the Processor (or an equivalent mechanism approved by the Processor) is implemented on the Controller's Merchant Store and that consent is obtained from each End User before any photograph is uploaded or processed;
(e) be responsible for assessing the adequacy, reliability and fitness of the Processing, and for determining the lawfulness of Processing under applicable Data Protection Laws; and
(f) promptly notify the Processor if it becomes aware of any circumstances that could affect the Processor's ability to comply with this DPA.
4. Processor Obligations
4.1 The Processor shall:
(a) process Personal Data only on the documented instructions of the Controller (including the instructions set out in this DPA and the Principal Agreement), unless required to do so by applicable law, in which case the Processor shall (to the extent permitted by law) inform the Controller of such legal requirement before carrying out the Processing;
(b) immediately inform the Controller if, in the Processor's opinion, an instruction from the Controller infringes applicable Data Protection Laws;
(c) ensure that all persons authorised to process Personal Data under this DPA are subject to binding obligations of confidentiality;
(d) implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, or damage, as further described in Annex 3 (Technical and Organisational Measures);
(e) taking into account the nature of the Processing, assist the Controller by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under applicable Data Protection Laws;
(f) assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR and EU GDPR (as applicable), taking into account the nature of the Processing and the information available to the Processor;
(g) at the Controller's choice, delete or return all Personal Data to the Controller after the end of the provision of the App, and delete existing copies unless applicable law requires storage of the Personal Data;
(h) make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR and EU GDPR, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to the audit provisions in Clause 9; and
(i) not process Personal Data for any purpose other than providing the App and the Virtual Try-On Feature, and shall not use Personal Data for advertising, marketing, profiling, automated decision-making, or the training of third-party or generative artificial intelligence models. The Processor may derive anonymous, aggregated, product-level fit signals from order and return outcomes (as further described in Annex 4) to improve the accuracy of the App's size and fit recommendations; such aggregated signals do not identify any Data Subject and are not used to train generative image models.
5. Sub-Processors
5.1 The Controller provides general written authorisation for the Processor to engage sub-processors to carry out specific Processing activities on behalf of the Controller, subject to the conditions set out in this Clause 5.
5.2 The Processor's current sub-processors as at the date of this DPA are listed in Annex 2 (Sub-Processor Register). By entering into this DPA, the Controller approves the engagement of the sub-processors listed in Annex 2.
5.3 The Processor shall:
(a) enter into a written agreement with each sub-processor that imposes data protection obligations no less protective than those set out in this DPA;
(b) remain fully liable to the Controller for the performance of each sub-processor's obligations; and
(c) ensure that each sub-processor processes Personal Data only in accordance with the Controller's documented instructions and applicable Data Protection Laws.
5.4 The Processor shall give the Controller prior written notice (by email or in-app notification) of any intended changes to the sub-processors engaged in the Processing of Personal Data, including the addition or replacement of sub-processors, giving the Controller a reasonable opportunity to object to such changes.
5.5 If the Controller objects to a new or replacement sub-processor on reasonable data protection grounds:
(a) the Processor shall use reasonable efforts to make available an alternative solution that avoids the use of the objected-to sub-processor;
(b) if no alternative solution is reasonably available, the Controller may terminate the Principal Agreement (and this DPA) by uninstalling the App, in which case the Processor shall facilitate the orderly transition and deletion of Personal Data in accordance with Clause 10.
6. International Data Transfers
6.1 The Processor shall not transfer Personal Data to a country outside the United Kingdom or the European Economic Area ("EEA") unless:
(a) the transfer is to a country that has been recognised by the relevant authority (the UK Secretary of State, the European Commission, or relevant supervisory authority) as providing an adequate level of data protection;
(b) appropriate safeguards are in place in accordance with Article 46 of the UK GDPR or EU GDPR, including the UK International Data Transfer Agreement ("UK IDTA"), the UK Addendum to the EU Standard Contractual Clauses, or the European Commission's Standard Contractual Clauses ("SCCs"); or
(c) a derogation applies under Article 49 of the UK GDPR or EU GDPR.
6.2 As at the date of this DPA, the following international transfers take place in connection with the Processing:
(a) Customer photographs are transmitted from the End User's browser via the Shopify app proxy to the Processor's backend hosted in Google Cloud region europe-west2 (London, UK), then to the Gemini Developer API for AI image generation. No UK/EU-only restriction has been verified for Google's provider-managed processing. Google's paid-service terms state that abuse-monitoring data may be transiently stored or cached in any country where Google or its agents maintain facilities. Google LLC participates in the EU-U.S. Data Privacy Framework and processes paid-service prompts and responses under its Data Processing Addendum for Products Where Google is a Data Processor (https://business.safety.google/processorterms/). Source: https://ai.google.dev/gemini-api/terms.
(b) Merchant account data (shop domain, billing data) is processed by Shopify Inc. in Canada and the United States. Shopify's data processing terms incorporate Standard Contractual Clauses.
6.3 The Processor shall ensure that any sub-processor engaged in international transfers of Personal Data has entered into appropriate transfer mechanisms and that the overall level of protection for Personal Data is not undermined.
6.4 Details of the transfer mechanisms in place for each sub-processor are set out in Annex 2 (Sub-Processor Register).
7. Data Subject Rights
7.1 The Processor shall, taking into account the nature of the Processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from Data Subjects to exercise their rights under applicable Data Protection Laws, including rights of access, rectification, erasure, restriction of processing, data portability, and objection.
7.2 If the Processor receives a request directly from a Data Subject, the Processor shall:
(a) promptly notify the Controller of the request;
(b) not respond to the request directly unless authorised to do so by the Controller or required to do so by applicable law; and
(c) cooperate with and assist the Controller in fulfilling the request within the timeframes required by applicable Data Protection Laws.
7.3 The Processor shall implement and maintain the Shopify mandatory GDPR compliance webhooks (customers/data_request, customers/redact, and shop/redact) and shall respond to such webhooks in accordance with Shopify's requirements and applicable Data Protection Laws.
7.4 Access requests. On receipt of a customers/data_request webhook, or of a written request from the Controller, the Processor shall produce a machine-readable export of every record it holds against the identifiers concerned (saved measurement profiles, size-recommendation records, widget events, order attribution records and, where the End User holds a Fit Passport, the Passport data for which the Processor is controller), together with the pseudonymous consent and erasure records, and shall make it available to the Controller within ten (10) Business Days.
7.5 Erasure. On receipt of a customers/redact webhook the Processor shall, in one database transaction, delete or clear every identified record linked to the End User (including visitor identifiers discovered through the End User's orders and recommendations), cut the link between those records and the anonymised fit corpus, and write an erasure receipt recording what was removed. A retried webhook is idempotent. The Processor shall provide the erasure receipt to the Controller on request.
7.6 Restriction and objection. Where an End User refuses or withdraws analytics consent through the Controller's cookie banner (read by the App through Shopify's Customer Privacy API), the App stops using a persistent visitor identifier for that End User on the Controller's store and records the withdrawal; the Controller remains responsible for the banner and its wording.
8. Personal Data Breach Notification
8.1 The Processor shall notify the Controller without undue delay (and in any event within forty-eight (48) hours) upon becoming aware of a Personal Data Breach affecting the Controller's Personal Data.
8.2 The notification shall include, to the extent available:
(a) a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects and Personal Data records concerned;
(b) the name and contact details of the Processor's point of contact for further information;
(c) a description of the likely consequences of the Personal Data Breach; and
(d) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its possible adverse effects.
8.3 The Processor shall cooperate with the Controller and take reasonable steps to assist the Controller in:
(a) investigating and remediating the Personal Data Breach;
(b) fulfilling the Controller's obligation to notify the relevant supervisory authority (within seventy-two (72) hours under Article 33 of the UK GDPR/EU GDPR) and affected Data Subjects (under Article 34) where required; and
(c) complying with any other applicable breach notification requirements under applicable Data Protection Laws.
8.4 The Processor's notification obligations under this Clause 8 are limited to Personal Data Breaches arising from or relating to the Processor's own systems, infrastructure, and operations, and the operations of its sub-processors. The Processor shall not be responsible for notifying breaches arising from the Controller's systems, the Shopify Platform (where the breach is not attributable to the Processor), or other third-party services engaged by the Controller.
9. Audit Rights
9.1 The Processor shall make available to the Controller, on request, all information reasonably necessary to demonstrate the Processor's compliance with its obligations under this DPA and Article 28 of the UK GDPR and EU GDPR.
9.2 The Controller (or its appointed third-party auditor, subject to reasonable confidentiality obligations) may conduct audits or inspections of the Processor's data processing activities and facilities, subject to the following conditions:
(a) the Controller shall provide the Processor with at least thirty (30) days' prior written notice of any intended audit;
(b) audits shall be conducted during normal business hours, with reasonable regard for minimising disruption to the Processor's operations;
(c) the Controller shall bear the costs of any audit, unless the audit reveals a material breach of this DPA by the Processor, in which case the Processor shall bear the reasonable costs of that audit;
(d) the scope of any audit shall be limited to matters relevant to the Processor's compliance with this DPA and applicable Data Protection Laws; and
(e) the Controller shall not be entitled to conduct more than one (1) audit in any twelve (12) month period, unless required by a supervisory authority or following a Personal Data Breach.
9.3 Where the Processor holds valid and current certifications or audit reports (such as SOC 2 or ISO 27001) relevant to its obligations under this DPA, the Processor may provide such certifications or reports (or relevant extracts thereof) to the Controller in lieu of a physical audit, provided that the Controller may still exercise its audit rights under Clause 9.2 if it reasonably determines that the certifications or reports do not adequately address its concerns.
10. Term, Termination and Data Deletion
10.1 This DPA shall come into effect on the date the Controller installs the App (the Effective Date) and shall remain in force for so long as the Processor processes Personal Data on behalf of the Controller.
10.2 This DPA shall terminate automatically upon termination or expiry of the Principal Agreement, including upon uninstallation of the App by the Controller.
10.3 Upon termination of this DPA, the Processor shall:
(a) cease all Processing of the Controller's Personal Data, except as necessary to comply with applicable law or to complete deletion obligations;
(b) at the Controller's written request (to be made within thirty (30) days of termination), return the Controller's Personal Data in a commonly used, machine-readable format, to the extent technically feasible; and
(c) unless applicable law requires continued storage, securely delete all of the Controller's Personal Data within ninety (90) days of termination, and provide written confirmation of deletion upon the Controller's request. Live data is deleted in response to the shop/redact webhook (Clause 10.4); copies in automated database backups expire within thirty (30) days of that deletion (Annex 3, Section E), and copies in Cloud Logging within thirty (30) days. The Processor retains the pseudonymous consent records, erasure receipts and audit log described in Annex 3, Section I as evidence of compliance; those records contain no Personal Data in clear.
10.4 The Processor shall comply with Shopify's mandatory GDPR shop/redact webhook upon termination, deleting all Merchant Data and Customer Data associated with the Controller's store in accordance with Shopify's requirements.
10.5 Clauses 4 (Processor Obligations, to the extent necessary for deletion), 6 (International Transfers), 8 (Personal Data Breach), 9 (Audit Rights), 11 (Liability), and this Clause 10 shall survive termination of this DPA.
11. Liability
11.1 Each Party's liability arising out of or in connection with this DPA shall be subject to the limitations and exclusions of liability set out in the Principal Agreement.
11.2 Nothing in this DPA shall limit or exclude either Party's liability for:
(a) death or personal injury caused by its negligence;
(b) fraud or fraudulent misrepresentation; or
(c) any other liability which cannot be limited or excluded by applicable law.
12. General Provisions
12.1 This DPA, together with its Annexes, constitutes the entire agreement between the Parties in relation to the processing of Personal Data in connection with the App, and supersedes all prior agreements, representations, and understandings on such matters.
12.2 This DPA shall be governed by and construed in accordance with the laws of England and Wales, and the Parties submit to the exclusive jurisdiction of the courts of England and Wales, without prejudice to any Data Subject's rights under applicable Data Protection Laws to bring claims in another jurisdiction.
12.3 If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
12.4 The Processor may amend this DPA from time to time to reflect changes in applicable Data Protection Laws, guidance from supervisory authorities, or changes to the Processing. The Processor shall provide the Controller with at least thirty (30) days' written notice of any material changes.
Annex 1: Processing Details
This Annex 1 forms part of the DPA and sets out the details of the Processing in accordance with Article 28(3) of the UK GDPR and EU GDPR.
Element | Detail
Subject matter of Processing | Provision of the Rendered Fits virtual try-on application, enabling End Users to upload photographs and receive AI-generated virtual try-on images
Nature of Processing | Collection, temporary caching, transmission to AI sub-processor, AI-assisted image generation and compositing, AI size recommendation from End User body measurements (with Redis caching of recommendation results), session-scoped rate limiting, conversion attribution, aggregated analytics computation, and automated deletion
Purpose of Processing | Generating virtual try-on images for End Users at the Controller's direction; providing AI size recommendations at the End User's request; enforcing per-session rate limits to prevent abuse; attributing completed purchases to virtual try-on sessions to enable the Controller to measure ROI; deriving aggregate, de-identified product-level fit signals from order and return outcomes to improve size and fit recommendation accuracy; providing usage analytics to the Controller; and complying with Shopify's GDPR webhooks
Duration of Processing | For the term of the Principal Agreement (from installation to uninstallation of the App), plus any period necessary to complete deletion obligations under this DPA. End User photographs are processed transiently within the active session only.
Categories of Data Subjects | End Users (customers of the Controller who interact with the Virtual Try-On Feature on the Controller's Merchant Store)
Types of Personal Data | End User photographs (facial images); body measurements provided for size recommendation (height, weight, gender presentation, fit preference, and optionally age); saved measurement profiles linked to the Controller's customer IDs (where a logged-in End User chooses "save my profile"); IP addresses; session identifiers; order identifiers (order ID, cart token); product handles in cart attributes
Special Category Data | To the extent that End User photographs constitute biometric data or data revealing racial or ethnic origin, the Processor uses them to generate the requested virtual try-on image and does not use them for profiling or advertising. Google separately logs paid-service prompts and responses for its stated safety, policy-enforcement and required legal or regulatory purposes. Processing of Special Category Data is based on the explicit consent of the Data Subject (Article 9(2)(a) UK GDPR/EU GDPR), obtained via the in-widget consent mechanism.
Annex 2: Sub-Processor Register
This Annex 2 forms part of the DPA and lists the sub-processors approved by the Controller as at the date of this DPA.
Sub-Processor | Processing Activity | Data Processed | Location | Transfer Mechanism
Google LLC — Gemini Developer API | AI image generation and sizing text: receives End User photographs and product images, generates composite virtual try-on images; Google states that Gemini Developer API prompts, contextual information and outputs are retained for 55 days for abuse monitoring | End User photographs, product images, body measurements in prompts, and generated outputs | Provider-managed processing; abuse-monitoring data may be transiently stored or cached in any country where Google or its agents maintain facilities | EU-U.S. Data Privacy Framework; Google Data Processing Addendum for Products Where Google is a Data Processor (https://business.safety.google/processorterms/)
Google Cloud Platform (GCP) — Compute Engine, Cloud SQL, Cloud Storage, Pub/Sub, Cloud Functions, Cloud Logging | Cloud infrastructure: application hosting; the application database and its automated backups (point-in-time recovery seven days, thirty daily backups); temporary file storage (live-photo deletion eligibility after 24 hours and noncurrent-version eligibility one day later, with asynchronous completion); the render queue; operational logs (thirty days); Redis (rate limiting and size-recommendation cache, results cached by product and measurement combination for up to 7 days) runs on the Processor's own GCP virtual machines | End User photographs (temporary), body measurements and size-recommendation records, saved measurement profiles, visitor and order identifiers, IP addresses (rate limiting), session data, operational logs, and the backups of the foregoing | europe-west2 (London, United Kingdom) | Google Cloud Data Processing Addendum with SCCs; UK data residency for the services listed
Shopify Inc. | Platform hosting: authentication via OAuth 2.0, subscription billing via Billing API, webhook delivery (orders, GDPR compliance); transit of Virtual Try-On and size-recommendation requests (photographs and body measurements) between the End User's browser and the Processor's backend via the Shopify app proxy | Merchant store domain, billing data, order identifiers, try-on request data (in transit only) | Canada / United States | Shopify Data Processing Addendum with SCCs; Canada adequacy decision (EU)
GitHub, Inc. | Source control and continuous integration for the App. Production Personal Data is not processed in CI; deployment workflows connect to production systems using scoped credentials | No Personal Data by design; deployment credentials | United States / EU | GitHub Data Protection Agreement with SCCs; EU-U.S. Data Privacy Framework
Not sub-processors of Controller data: the transactional email provider used to send Fit Passport sign-in links (the Processor is controller for Fit Passport data; see the Fit Passport Privacy Notice), and the providers used by the Processor's own website (Vercel, Redis Cloud, Google Analytics, Calendly), which never receive the Controller's Personal Data.
The Processor maintains the current version of this register, with the date each sub-processor's data processing terms were accepted and the date of the last review, in its Record of Processing Activities and will provide it to the Controller on request (Clause 5).
Annex 3: Technical and Organisational Measures
This Annex 3 forms part of the DPA and describes the technical and organisational security measures implemented by the Processor in accordance with Article 32 of the UK GDPR and EU GDPR.
A. Encryption and Data Protection in Transit
• All data transmitted between the End User's browser and the App's backend, and between the App's backend and sub-processors, is encrypted using TLS (Transport Layer Security) / HTTPS
• API communications with the AI service API and Shopify APIs are conducted over encrypted HTTPS connections
• No Personal Data is transmitted in plaintext
B. Transient Data Processing and Minimisation
• End User photographs are processed transiently and stored temporarily in GCP Cloud Storage. Live objects become eligible for lifecycle deletion after 24 hours; versioned, noncurrent copies become eligible for permanent deletion one day later. We target deletion within 48 hours, but lifecycle actions are asynchronous and can complete later
• Generated virtual try-on images follow the same transient lifecycle. Download/share links are signed URLs valid for 24 hours; once the underlying object is lifecycle-deleted, shared links stop working
• The 48-hour target covers Processor-controlled Cloud Storage only. Google separately states that Gemini Developer API prompts, contextual information and outputs are retained for 55 days for abuse monitoring; no account-specific zero-data-retention exception has been verified. Google states that paid-service prompts and responses are not used to improve its products, are processed under its Data Processing Addendum for Products Where Google is a Data Processor (https://business.safety.google/processorterms/), and may be transiently stored or cached for safety, policy enforcement and required legal or regulatory disclosures in any country where Google or its agents maintain facilities. Sources: https://ai.google.dev/gemini-api/terms, https://ai.google.dev/gemini-api/docs/usage-policies and https://ai.google.dev/gemini-api/docs/zdr
• No facial geometry templates, biometric identifiers, or biometric data are extracted, created, or stored on Processor systems at any point during Processing (a transient face-detection check runs entirely within the End User's browser before upload, solely to confirm the photograph contains exactly one face; its result is discarded immediately and never transmitted)
• The App collects only the minimum data necessary for its operation (data minimisation principle)
C. Access Control
• Merchant authentication is handled entirely through Shopify's OAuth 2.0 Token Exchange — no separate credentials are stored by the Processor
• Access to the App's production systems, databases, and cloud infrastructure is restricted to authorised personnel of the Processor on a need-to-know basis
• No third-party development agency holds access to production data or production systems
• Administrative access to cloud infrastructure requires multi-factor authentication
• Administrative operations within the App (billing reconciliation, privacy operations such as export, erasure verification and retention sweeps, and operational sweeps) require scoped bearer tokens issued individually per operator and purpose; every use, and every refused attempt, is written to an audit log
D. Rate Limiting and Abuse Prevention
• IP-based rate limiting is implemented to prevent abuse of the Virtual Try-On Feature (e.g., maximum generations per IP per hour)
• Rate-limit records are stored in the application's session-scoped rate-limiting system and expire automatically
E. Automated Deletion, Retention and Recovery
• GCP Cloud Storage lifecycle rules make live photographs and generated images eligible for deletion after 24 hours and versioned, noncurrent copies eligible for permanent deletion one day later. The target is 48 hours, but lifecycle actions are asynchronous. The bucket policy is held as code and checked against the live bucket; permanent deletion of a prefix is verified by listing live, noncurrent and soft-deleted objects
• Size-recommendation results cached in Redis expire automatically after no more than 7 days
• Size-recommendation records are pseudonymised 24 months after creation (every identifier column cleared) and visitor identifiers are cleared from widget event and conversion records after 13 months, by a scheduled daily sweep whose results are written to the audit log
• Upon App uninstallation, all Merchant Data and associated Customer Data is deleted in response to Shopify's mandatory GDPR shop/redact webhook; the anonymised fit corpus loses its reference to the Controller's store
• The application database is backed up automatically (point-in-time recovery for seven days; thirty daily backups retained) with deletion protection enabled; backups expire automatically, so a record erased from the live database persists in backups for at most thirty days
• Restores are performed only into a disposable instance, and the restore procedure re-applies every erasure receipt issued since the backup was taken before any restored data is used, so that erased Personal Data is not resurrected. The procedure is scripted and its execution is recorded
• Operational logs in Google Cloud Logging are retained for thirty days
F. Sub-Processor Security
• Gemini Developer API: Subject to Google's Data Processing Addendum for Products Where Google is a Data Processor (https://business.safety.google/processorterms/)
• Google Cloud Platform: Subject to Google's Cloud Data Processing Addendum, ISO 27001/27017/27018 certified, SOC 2 Type II audited
• Shopify: SOC 2 Type II audited, PCI DSS Level 1 certified
• All sub-processors are bound by contractual data protection obligations no less protective than those in this DPA
G. Incident Response
• The Processor maintains a Data Breach Response Plan setting out procedures for identifying, containing, assessing, and reporting Personal Data Breaches
• The Processor shall notify the Controller of any Personal Data Breach within forty-eight (48) hours, in accordance with Clause 8 of this DPA
H. Organisational Measures
• All personnel of the Processor with access to Personal Data are subject to binding obligations of confidentiality
• The Processor conducts periodic reviews of its security measures to ensure they remain appropriate to the nature, scope, and risks of the Processing
• The Processor maintains a Record of Processing Activities (ROPA) in accordance with Article 30 of the UK GDPR and EU GDPR, and a per-system access matrix reviewed quarterly
I. Evidence of Compliance
• Consent records: each grant, withdrawal or inherited consent (Fit Passport purposes; storefront analytics consent inherited from the Controller's banner) is written once, immutably, with the version of the notice in force, the source and the time. The record holds a one-way hash of the identifier concerned, never the identifier, email address or photograph
• Erasure receipts: every erasure (customers/redact, shop/redact, Fit Passport withdrawal, retention sweep) produces a receipt listing the record types and counts removed and the storage prefixes cleared (hashed), with a verification status that is updated once permanent deletion has been checked
• Audit log: every administrative operation and every scheduled sweep is logged with the operator, the action, counts and a request identifier; no free text or Personal Data is stored in the log
• These records are retained for six years and survive customers/redact and shop/redact because they are the evidence that those erasures happened. The Processor will provide the records relevant to the Controller's store on request under Clause 9
Annex 4: Controller's Documented Instructions
This Annex 4 forms part of the DPA and sets out the Controller's documented instructions to the Processor regarding the Processing of Personal Data.
By installing the App and entering into the Principal Agreement and this DPA, the Controller instructs the Processor to process Personal Data as follows:
Instruction | Detail
Process End User photographs | Receive photographs uploaded by End Users through the storefront widget (transmitted from the End User's browser via the Shopify app proxy to the Processor's backend); transmit photographs to the Gemini Developer API for virtual try-on image generation; store photographs temporarily in Processor-controlled cloud storage; apply storage lifecycle rules that make live photographs eligible for deletion after 24 hours and versioned, noncurrent copies eligible for permanent deletion one day later; target 48 hours, with asynchronous completion. Google separately states that API prompts, contextual information and outputs are retained for 55 days for abuse monitoring
Generate virtual try-on images | Use the AI service to generate composite images depicting the End User wearing products from the Controller's store; deliver generated images to the End User's browser; serve download/share links via signed URLs valid for 24 hours; store generated images temporarily; apply storage lifecycle rules that make live objects eligible for deletion after 24 hours and versioned, noncurrent copies eligible for permanent deletion one day later, with asynchronous completion
Provide AI size recommendations | Receive body measurements (height, weight, gender presentation, fit preference, and optionally age, chest, waist, hip, inseam, underbust, shoe size and cup) voluntarily provided by End Users, transmitted from the End User's browser via the Shopify app proxy to the Processor's backend; generate an AI size recommendation for the selected product; cache recommendation results in Redis keyed by product and measurement combination for up to 7 days; keep the recommendation record for 24 months and then pseudonymise it; write, at the time of the recommendation, an anonymised fit corpus row (banded measurements, product, ISO week, size shown; no identifier) as described under "Derive product-level fit signals"; where a logged-in End User chooses "save my profile", store the measurements against that End User's customer ID for the Controller's store only, disclose them via Shopify's customers/data_request webhook, and delete them via the customers/redact webhook
Enforce rate limits | Record IP addresses in the session-scoped rate-limiting system to enforce per-session generation limits; allow records to expire automatically upon session end
Attribute conversions | Hold a visitor identifier in the End User's browser (rf_id cookie, 24 hours; rf_vid localStorage, 30 days) only while the Controller's cookie banner, read through Shopify's Customer Privacy API, reports that analytics are allowed, and remove it when the banner reports a refusal; record the inherited consent and any withdrawal against a hash of the identifier; receive order webhooks from Shopify; match completed orders to virtual try-on sessions using cart attributes and product handles; present attributed conversion data to the Controller via the analytics dashboard; clear visitor identifiers from event records after 13 months
Derive product-level fit signals | Maintain an anonymised fit corpus: at the time a size is shown, write a row holding the product, the Controller's store, the ISO week, the End User's measurements rounded to bands (height 5 cm, weight 5 kg, age 10 years, chest, waist, hip and inseam 4 cm, shoe size half a size), the size shown and the catalogue's size options, with no name, email, customer number, visitor identifier or photograph; keep a temporary link to the identified recommendation record only until the order outcome (kept, returned, exchanged, bracket resolved) is known, and cut it on any erasure and in any event after 90 days; analyse order and return outcomes received via Shopify webhooks to attach that outcome; derive aggregate, product-level fit signals that improve the accuracy of the App's size and fit recommendations, including across other merchants, suppressing small groups in every output; such signals are aggregated and de-identified, do not identify individual End Users, and are not used to train generative AI models
Manage subscriptions and billing | Receive billing plan data and subscription status via Shopify's Billing API and APP_SUBSCRIPTIONS_UPDATE webhook; enforce plan-level generation limits; present usage data to the Controller via the App dashboard
Respond to GDPR webhooks | Handle Shopify's mandatory GDPR compliance webhooks (customers/data_request, customers/redact, shop/redact); on data_request, compile the export described in Clause 7.4; on redact, delete or clear all associated identified data in one transaction, cut fit-corpus links, and write an erasure receipt; retain the pseudonymous consent, receipt and audit records described in Annex 3, Section I
Provide analytics | Aggregate virtual try-on usage data, conversion rates, and attributed revenue; present aggregated analytics to the Controller via the App dashboard; delete analytics data upon App uninstallation
The Controller may issue additional documented instructions from time to time by written notice to the Processor at [email protected]. Any additional instructions that require material changes to the Processing or to the Processor's systems shall be subject to mutual agreement and may be subject to additional fees.
End of Data Processing Agreement — Version 1.3 — Revision prepared: 21 September 2026 (prior published version: 16 July 2026)