Data Processing Terms (DPT)
Last updated: 18 August 2026
These Data Processing Terms (“Terms”) form an integral part of the agreement between Faslet B.V. (“Faslet”, “Processor”) and the client using Faslet’s services (“Client”, “Controller”), including where the Client uses Faslet through the Faslet app for Shopify. They describe how Faslet processes personal data on behalf of the Client in accordance with the General Data Protection Regulation (GDPR). Where the Client has signed a separate Data Processing Agreement with Faslet, that signed agreement prevails over these Terms.
1. Roles
- Controller: the Client, who determines the purposes and means of processing personal data.
- Processor: Faslet, which processes personal data only on the Client’s documented instructions.
The Client is responsible for having a valid legal basis for the processing and for informing shoppers about it in its own privacy notice.
2. Subject matter & purpose
Faslet processes personal data solely to provide its size recommendation, virtual try-on and related analytics services. Personal data is not processed for any other purpose, and never for advertising or for profiling unrelated to sizing.
3. Categories of data
Faslet processes only the data needed to deliver sizing and fit:
- Sizing inputs voluntarily entered by shoppers e.g. height, weight, age range, gender, fit preference (pseudonymised).
- Behavioural and interaction data e.g. size selections and product interactions, and, where the Client chooses to share it, return or order flags used for fit analysis (without name, address, e-mail or payment data).
- Virtual try-on images, where the shopper uses that feature processed only to generate the requested visualisation and deleted within 72 hours (see section 8).
Faslet does not process names, addresses, e-mail addresses, phone numbers, payment data, or any special category data (such as health, race, or religious beliefs).
4. Security
Faslet maintains appropriate technical and organisational measures appropriate to the risk, including:
- encryption in transit (TLS 1.2 or higher) and at rest;
- multi-factor authentication and least-privilege, need-to-know access controls;
- databases and processing operating within a private network on certified EU-based cloud infrastructure;
- regular penetration testing, with findings relevant to data protection shared on request.
Access to personal data is limited to a small number of authorised Faslet personnel, each bound by confidentiality obligations.
5. Sub-processors
Faslet engages a limited set of sub-processors, all EU-hosted and bound by written agreements imposing equivalent data protection obligations. The current sub-processors are:
- Amazon Web Services EMEA SARL — cloud hosting, compute and storage (EU/EEA regions only).
- Mailjet SAS — transactional e-mail delivery (EU, France).
Faslet will give the Client at least 30 days’ written notice before adding or replacing a sub-processor. The Client may object on reasonable data-protection grounds within 14 days of that notice; if no workable solution is found, the Client may terminate the affected services without penalty.
6. International transfers
All personal data processed under these Terms is stored and processed within the European Union, on EU-hosted infrastructure. Faslet makes no transfers outside the European Economic Area (EEA) in the ordinary course of providing the services. Should that ever change, Faslet will put a valid Chapter V transfer mechanism (such as the European Commission’s Standard Contractual Clauses) in place and inform the Client in advance.
7. Data subject rights
Faslet assists the Client in responding to data subject requests, including access, rectification, erasure, portability, restriction and objection. Taking into account the nature of the processing. Faslet will not respond to a data subject directly without the Client’s instruction, other than to confirm that the request relates to the Client.
8. Data retention & deletion
- Virtual try-on images are automatically and permanently deleted within 72 hours of upload. They are never used to train, develop or improve models or algorithms, and are never shared with third parties other than the hosting sub-processors listed above. Deletion covers all copies, including caches.
- All other personal data is retained only for as long as needed to provide the services. On termination or expiry, Faslet will, at the Client’s choice, delete or return the data, and delete any remaining copies within 30 days, unless the law requires continued storage.
- As Faslet runs on cloud-native infrastructure, secure deletion is achieved through cryptographic erasure.
9. Incident management
Faslet will notify the Client without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting data processed under these Terms. The notification will include the information the Client needs to meet its own legal obligations, provided in phases where not all details are available immediately.
10. Audit rights
On reasonable prior written notice, the Client may request the information needed to demonstrate Faslet’s compliance. Independent audit reports may be shared. On-site audits may take place no more than once per calendar year, during business hours and under confidentiality, unless a supervisory authority requires otherwise or there are reasonable grounds to suspect non-compliance.
11. Confidentiality & data sharing
All Faslet personnel authorised to process personal data are bound by strict confidentiality obligations. Personal data is processed solely for the Client’s benefit and is accessible only to the Client and Faslet, to the extent necessary to provide the services. Faslet does not sell, rent or otherwise share personal data with third parties, except for the approved sub-processors listed above.
12. Liability, governing law & changes
Faslet’s liability in connection with these Terms is governed by the limitations set out in the Client’s main agreement with Faslet. These Terms are governed by the laws of the Netherlands, and the courts of Rotterdam have exclusive jurisdiction over any dispute arising from them. Faslet may update these Terms from time to time; material changes will be notified to the Client, and the “last updated” date above will always reflect the current version.
