Legal · Version 2026-10 · Updated 25 October 2026

Data Processing Agreement

The Art. 28 GDPR agreement for the personal data TryYourSize processes on behalf of brands and retailers.

Draft

Draft — requires review by counsel before publication. Written by an AI assistant, not a lawyer. Every "For counsel" note marks a point that needs legal judgement.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between [COMPANY LEGAL NAME], S.L. ("TryYourSize", the "Processor") and the organization that accepts it (the "Customer", the "Controller"). It applies when TryYourSize processes personal data on the Customer's behalf ("Brand Personal Data") under Article 28 of Regulation (EU) 2016/679 ("GDPR") and Spanish Organic Law 3/2018 ("LOPDGDD"). Terms not defined here have the meaning given in the GDPR or the Terms.

1. Roles: what this DPA covers and what it does not

Data	Role of TryYourSize	Covered by
Orders, returns and outcomes the Customer sends (order and line IDs, product, size bought, size returned, return reason, `fit_check_id`, anonymous `visitor_id`, dates)	Processor for the Customer	This DPA
A/B experiment assignments and exposures on the Customer's stores (anonymous visitor ID, arm, timestamps)	Processor	This DPA
Per-store analytics and webhooks delivered to the Customer	Processor	This DPA
Shopper Accounts: email, sign-in, bodies, measurements, store connections, child profiles	Independent controller	Privacy Policy
Size Events the Customer receives (product, size, fit-check ID)	Disclosed by TryYourSize as controller; the Customer becomes a controller for its own use	Terms §7, Privacy Policy
Customer's members (Studio users), billing contacts	Independent controller (account administration, security, billing)	Privacy Policy
Aggregated, anonymous statistics (k ≥ 50)	Not personal data	Terms §8.2

2. Instructions

TryYourSize processes Brand Personal Data only on the Customer's documented instructions, which are the Terms, this DPA, the Customer's configuration of the Service and its written requests, unless EU or Member State law requires otherwise; in that case TryYourSize informs the Customer first unless the law forbids it.
TryYourSize informs the Customer if, in its opinion, an instruction infringes data-protection law.

3. Confidentiality

Everyone authorised to process Brand Personal Data at TryYourSize is bound by confidentiality. Staff access production data only through audited tools, only as needed for support or security, and never to shopper bodies.

4. Security

TryYourSize implements the technical and organisational measures in Annex II and keeps them appropriate to the risk (Art. 32 GDPR). It may update them if the level of protection does not decrease.

5. Sub-processors

The Customer gives a general authorisation to use sub-processors. The current list is in Annex III and at /legal/subprocessors/.
TryYourSize gives at least 30 days' notice of a new or replaced sub-processor, by updating that page and emailing the organization's owners. The Customer may object on reasonable data-protection grounds within that period. If no solution is found, the Customer may terminate the affected part of the Service without penalty.
TryYourSize imposes the same data-protection obligations on each sub-processor by contract and remains liable for their performance.

6. International transfers

Brand Personal Data is stored and processed in the European Union (Google Cloud europe-west1, Belgium; Temporal Cloud europe-west3, Frankfurt; PostHog EU Cloud, Frankfurt).
Where a sub-processor or its affiliates may access data from a country without an adequacy decision, the transfer relies on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 3 (processor to processor), with supplementary measures where the transfer impact assessment requires them. Annex III marks each case.
Customers outside the EEA. If the Customer is established outside the EEA in a country without an adequacy decision, the SCCs Module 4 (processor to controller) apply to the return of Brand Personal Data to it. For the United Kingdom, the UK International Data Transfer Addendum applies; for Switzerland, the SCCs with the FDPIC's amendments.

7. Assistance

Data subject requests. TryYourSize helps the Customer answer requests about Brand Personal Data, by tools in Studio or the API where possible, and forwards any request it receives directly without answering it, unless the request concerns data TryYourSize controls.
DPIAs and prior consultation. TryYourSize gives the Customer the information it reasonably needs for its own data protection impact assessments.
Personal data breaches. TryYourSize notifies the Customer without undue delay, and within 48 hours after becoming aware of a breach affecting Brand Personal Data, with the information in Art. 33(3) GDPR as it becomes available, and helps the Customer meet its duties.

8. Deletion and return

At the end of the Service, or when the Customer closes its organization, TryYourSize deletes Brand Personal Data after the 30-day reopening period, unless EU or Member State law requires storage. During the Service the Customer can export its data. Backups roll off within about 30 days of deletion.

9. Audits

TryYourSize makes available the information needed to show compliance with Art. 28 GDPR: this DPA, the security description in Annex II, and third-party reports when it has them (SOC 2 is planned). The Customer may audit, itself or through an independent auditor bound by confidentiality, at most once a year, with 30 days' notice, during working hours, and at its own cost, unless an audit follows a breach or an authority's request.

10. Liability and term

Liability under this DPA follows the Terms (§14), without prejudice to Art. 82 GDPR. This DPA lasts as long as TryYourSize processes Brand Personal Data.

Annex I: Description of the processing

Controller	The Customer (organization name, address and contact in Studio)
Processor	[COMPANY LEGAL NAME], S.L., [REGISTERED ADDRESS]; contact [email protected]
Data subjects	Visitors and customers of the Customer's stores
Categories of data	Order and line identifiers; product and variant; size bought and returned; return reason codes; `fit_check_id`; anonymous visitor ID (random, set on the Customer's site for A/B experiments); experiment arm; timestamps; store identifiers. No names, addresses, payment data or body measurements are needed; the Customer must not send them.
Special categories	None
Nature and purpose	Store, match and aggregate outcomes with size answers to measure size-related returns, run A/B holdouts, and show the Customer reports and webhooks
Frequency	Continuous, while the Service is used
Retention	While the organization is active; deleted 30 days after closure. Webhook events and request logs: 30 days
Sub-processors	Annex III

Annex II: Technical and organisational measures

Hosting and location: Google Cloud europe-west1 (Belgium). Private database network; no public database IP; one private bucket per environment with public access blocked.
Encryption: TLS 1.2+ in transit (HSTS); Google-managed encryption at rest for databases, storage and backups; background-job inputs and results are encrypted by TryYourSize (AES-256-GCM, keys in Secret Manager) before they reach Temporal Cloud.
Access control: role-based access for members (seven roles, brand scopes); multi-factor authentication for brand users through WorkOS; staff access only through a time-boxed grant from the Customer, read-only by default.
No access to bodies: no endpoint, role or staff tool can read a shopper's body or measurements.
Audit: an append-only audit log of configuration changes, key actions and staff actions, kept 1 year (3 years on Scale/Enterprise), readable by owners and admins.
Keys: prefix-typed publishable and secret keys; secret keys stored hashed; live keys work only on verified domains.
Minimisation: stores receive sizes, never measurements; product analytics never contain body or measurement data (enforced by a schema test); error reports are scrubbed of emails, keys, tokens and codes before they are logged or sent to PostHog.
Resilience: automated database backups with point-in-time recovery; infrastructure as code; restore procedures documented.
Development: code review, dependency updates, secrets in Secret Manager, separate development and production environments.
Incidents: an incident process with on-call, logging and breach notification as in §7.3.

Annex III: Sub-processors

The current list, with locations and transfer mechanisms, is published at /legal/subprocessors/ and forms part of this Annex. At the version date it lists Google Cloud (hosting, EU), Temporal Cloud (background jobs, EU), Resend (email), WorkOS (brand-user sign-in), Stripe (billing), Shopify (for brands installed through the Shopify App Store), PostHog (EU Cloud: product analytics and error tracking) and Cloudflare (DNS and email forwarding).