Data processing agreement

Menzura processes photos and body data of the Customer’s end users only to return their body measurements, and deletes each photo as soon as its scan finishes. This agreement sets out the terms, using the European Commission’s standard clauses for processors. Customers accept it on the dashboard before their first scan.

Agreement

1. Parties. Avisio Analytics, trading as Menzura (the Processor), and the customer that accepts this agreement on the Menzura dashboard, in the name of the company it enters there (the Controller), together the Parties.
2. Standard Contractual Clauses. The Parties agree to the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (the Clauses). The Clauses are incorporated into this agreement by reference and can be read on EUR-Lex. Annexes I to IV below are the Annexes of the Clauses.
3. Options in the Clauses.
   • Clause 5 (docking clause): not included.
   • Clause 7.7(a): Option 2, general written authorisation. The sub-processors in Annex IV are authorised. The Processor informs the Controller in writing of any intended addition or replacement at least 30 days in advance.
   • Clause 9.2: the Processor notifies the Controller of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it.
4. No other purposes. The Processor does not use the personal data to identify or authenticate any person, to train or improve models, or for any purpose of its own. It only counts successful scans per Controller for invoicing.
5. The Controller’s responsibilities. The Controller has a lawful basis for each scan it submits and informs its end users, including where they are children. It sends no names, email addresses or other direct identifiers of end users to the Processor, including in the Idempotency-Key header.
6. Requests from end users. The Processor cannot link a scan to a person. The Controller identifies scans by the scan ID it received. The Processor deletes the scans the Controller names within 14 days of a written request to [email protected].
7. Liability. Each Party’s total liability under this agreement is limited to the greater of the fees the Controller paid in the 12 months before the event and EUR 10,000. This limit does not apply to damage caused by intent or deliberate recklessness, nor to liability towards data subjects under Article 82 GDPR.
8. Term. This agreement applies as long as the Processor processes personal data for the Controller. It ends when the Controller asks to close its account or the Processor closes it. Clause 10 of the Clauses governs what happens to the data afterwards.
9. Precedence and law. If this agreement conflicts with the Clauses, the Clauses prevail. Dutch law governs this agreement, and the District Court of Amsterdam (Rechtbank Amsterdam), the Netherlands, decides disputes.
10. Acceptance. The Controller accepts this agreement electronically on the Menzura dashboard. The Processor records who accepted, for which company, when, which version, and the IP address and browser used. This record is the Parties’ signature. A new version is published on this page and accepted on the dashboard in the same way.

Annex I: List of parties

Annex II: Description of the processing

The Processor estimates body measurements from photos that the Controller sends through the Menzura API.

Categories of data subjects. People whose photos the Controller submits for a measurement: the Controller’s end users, such as shoppers or app users.

Categories of personal data.

Sensitive data. None is intended. The Processor does not use the photos to uniquely identify or authenticate anyone, so they are not biometric data under Article 4(14) GDPR. Photos may still show health or other special categories incidentally. Safeguards: photos are processed automatically, deleted as soon as the scan finishes, and served only to the Processor’s processing server while it holds the scan (Annex III). No one at Menzura views the photos.

Nature of the processing. Receiving photos and inputs through the API, storing them until processing, automated analysis on the Processor’s own GPU server, storing the results, and returning them to the Controller through the API.

Purpose. Estimating the data subject’s body measurements for the Controller, scan by scan, as the Controller requests through the API. Counting successful scans per Controller for invoicing.

Duration and retention.

After 90 days only the scan record remains, without inputs and results: scan ID, status, error code and message, number of photos, timestamps and the API key used, for invoicing and usage figures. Deleted data can remain in the database provider’s point-in-time recovery for up to 30 days.

Processing by sub-processors. Hosting, database and photo storage by Cloudflare for the duration of the agreement (Annex IV).

Annex III: Technical and organisational measures

Photos exist only until their scan finishes, are encrypted wherever they are stored, and only the processing server can read them while it holds that scan.

Annex IV: List of sub-processors

Cloudflare is the only sub-processor. The processing server is the Processor’s own machine, and the payment and email providers receive no end-user data.