Data Processing Agreement

1. Scope

This DPA applies when you send Uwear personal data about your own end users through the Uwear API, such as your customers or staff ("End-User Data"). It does not apply to the data of your own account users, such as their names and emails. The Privacy Policy covers that data.

2. Roles

• • You are the controller of End-User Data. Uwear is your processor.
• • Under laws that use other words, such as the CCPA, you are the business and Uwear is your service provider.
• • You are responsible for the lawful basis, the notices to your end users, and their consent where the law requires it.
• • Do not send Uwear data about children under 16.

3. Details of the Processing

• • Subject matter: body measurement, size recommendation, avatar creation, and virtual try-on through the Uwear API.
• • Duration: while you use the Service, and until deletion under section 9.
• • Nature and purpose: receive, store, analyse, and transform images and numbers to return measurements, size recommendations, avatars, and generated images to you.
• • Data subjects: your end users, such as your customers, your staff, or your client's staff.
• • Types of data: front and side photos of a person; height, weight, and sex; body measurements and the results of measurement jobs; body type, age range, skin tone, and other avatar descriptions; avatars; generated images of the person; and any metadata you attach.
• • Special categories: Uwear does not use photos to identify a person. Do not send health data or other special categories of data. Height and weight for body measurement are allowed.

4. Uwear Commitments

• • Instructions: Uwear processes End-User Data only on your documented instructions. Your API requests, your account settings, and the Terms are your instructions. If the law requires Uwear to process End-User Data in another way, Uwear tells you before it does so, unless that law forbids the notice. If Uwear thinks that an instruction breaks data protection law, Uwear tells you immediately.
• • No training: Uwear does not use End-User Data to train or improve AI models.
• • No other use: Uwear does not sell End-User Data, does not share it for advertising, and does not use one customer's End-User Data for another customer.
• • Confidentiality: Uwear gives access to End-User Data only to the people who need it to run or support the Service. Uwear makes sure that these people are bound by confidentiality.
• • Security: Uwear applies the measures in section 5, as Article 32 requires.
• • End-user rights: Uwear helps you, with technical and organisational measures, to answer every request that an end user makes under Chapter III of the GDPR, such as access, correction, deletion, restriction, portability, and objection. The API routes in section 9 are the main tools. If an end user asks Uwear directly, Uwear sends the request to you and does not answer it unless you tell Uwear to.
• • Other help: Uwear helps you meet your duties under Articles 32 to 36: security, notice of a data breach, data protection impact assessments, and prior consultation with a supervisory authority.

5. Security Measures

• • All traffic between your systems and the Uwear API uses HTTPS.
• • Uwear checks API keys against a one-way hash. You can revoke a key at any time, and the revocation takes effect at once.
• • Each API key belongs to one company. Access to company records uses company permissions, through API keys or signed-in member sessions. Shared catalog assets from Uwear, such as system avatars, are visible to every company.
• • Body-measurement photos are not stored in Uwear's file storage (S3). The copy in the temporary store expires 30 minutes after submission. The measurement server deletes its working copy when the job ends, or when it recovers after a failure. Photo metadata such as location is removed on upload.
• • Uwear measures bodies on GPU servers that Uwear runs in its own AWS account. No AI provider receives body-measurement photos.
• • Uwear's file storage (S3) and temporary store (Redis) are encrypted at rest.
• • Uwear limits staff access to production systems to the people who need it.

6. Sub-processors

You give Uwear general permission to use the sub-processors below. Each sub-processor handles End-User Data under its standard terms, and under its data processing terms where it offers them. Uwear stays fully responsible to you for its sub-processors.

At least 30 days before a new or replaced sub-processor receives End-User Data, Uwear emails the owner of your Uwear account and updates this list. You can object on reasonable data protection grounds within those 30 days. If Uwear cannot solve the problem, you can stop using the affected feature, or end the Terms for that feature. Questions go to support@uwear.ai.

7. Data Breaches

If Uwear becomes aware of a breach of security that affects End-User Data, Uwear tells you without undue delay, and no later than 72 hours after it becomes aware. The notice says what happened, which data and how many end users are affected, the likely effects, and what Uwear does about it. It gives you the information you need to notify a supervisory authority and your end users. Uwear sends updates as it learns more.

8. International Transfers

• • Uwear is in Canada. The EU and the UK recognise Canada as giving adequate protection for commercial organisations.
• • Uwear stores and processes End-User Data in the United States (AWS, region us-east-1). Sub-processors can process it in the United States and in other countries where they operate.
• • Where a transfer is not covered by an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914, the "SCCs") apply and are part of this DPA by reference. Module 2 (controller to processor) applies between you and Uwear. Uwear uses Module 3 (processor to processor) with its sub-processors. Clause 7 (docking) applies. Clause 9 uses option 2, with the 30-day notice in section 6. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the law and the courts of Ireland apply. Sections 3, 5, and 6 of this DPA are Annexes I, II, and III.
• • For data from the UK, the UK International Data Transfer Addendum to the SCCs applies. Table 1 names the parties of this DPA. Table 2 uses the SCC choices above. Table 3 is sections 3, 5, and 6 of this DPA. Under Table 4, either party can end the Addendum as its Section 19 allows.

9. Retention and Deletion

The section "End-User Data Received Through the API" of the Privacy Policy states how long Uwear keeps each type of End-User Data, and how it is deleted.

• • Temporary data: body-measurement jobs, with their photos and results, expire automatically. There is no route to delete a job earlier.
• • Saved data: you can delete avatars, saved measurements, and generated images at any time with the API delete routes. Deleting an avatar does not yet delete its image files or its search index entries. Uwear deletes them when you ask at support@uwear.ai. Deleting a generated image leaves a hidden record with the prompt and settings of the generation.

When the Terms end, you choose whether Uwear returns End-User Data to you or deletes it. Tell Uwear your choice at support@uwear.ai. You can also export the data yourself with the API before the end. Closing an account does not delete stored data automatically. The Privacy Policy explains what the delete routes remove and what stays stored. Uwear keeps the records of your credit charges, which contain no photos or measurements, as billing records.

10. Information and Audits

Uwear makes available all the information that you need to show that Article 28 and this DPA are followed. Uwear allows and contributes to audits and inspections by you or by an auditor that you mandate. Uwear first answers a written security questionnaire. An audit normally takes place once per year, with 30 days' notice, during business hours, and under confidentiality. More audits, or a shorter notice, are possible after a data breach or when a supervisory authority requires them. You pay the cost of an audit, unless it finds that Uwear materially breached this DPA.

11. General Terms

• • If this DPA and the Terms conflict about End-User Data, this DPA applies.
• • If the Standard Contractual Clauses and this DPA conflict, the Standard Contractual Clauses apply.
• • The limitation of liability in the Terms applies to this DPA, to the extent that the law allows.
• • This DPA ends when the Terms end, but section 9 continues until the deletion is complete.

12. Signed Copy and Contact

This DPA applies automatically when you accept the Terms and use the API. If you need a copy signed by both parties, email us your company's legal name and address.