Data Processing Agreement: Wearo API, MCP server and marketplaces

This Data Processing Agreement (the "DPA") forms part of the Wearo Terms of Service between Wearo SAS, a company registered in France ("Wearo", "we"), and the customer that uses the Wearo API, the Wearo MCP server or Wearo through an AI model marketplace (the "Customer", "you"). It applies whenever Wearo processes personal data on your behalf through those channels.

1. Roles

The party that collects a photo from the person shown in it is the controller of that photo.

• Wearo API, Wearo MCP server and AI model marketplaces (such as OpenRouter). You send us the photos. You are the controller and Wearo is your processor within the meaning of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
• Marketplaces. Where the Customer is a marketplace that itself acts as a processor for its own users, Wearo acts as its sub-processor. The marketplace remains responsible for passing on to its users the obligations of this DPA that concern them.
• Out of scope. This DPA does not cover the Wearo widget, where the shopper uploads the photo in the Wearo window and Wearo is the controller, nor the personal data of your own account (name, e-mail address, billing), for which Wearo is the controller. Both are described in our privacy policies.

2. Subject matter, nature and purpose

Wearo processes the personal data you send to provide the Service: generate the try-on image you request, return it to you, and operate, secure and maintain the Service. Wearo does not process that data for any other purpose and does not use it to train AI models.

The processing lasts for as long as you use the Service through the channels listed in section 1.

3. Personal data and data subjects

Wearo does not process the photos for the unique identification of a person, and performs no facial recognition, age, gender or ethnicity inference. Article 9 GDPR processing is outside the scope of the Service.

4. Your obligations as controller

You warrant that:

1. you have a lawful basis under Article 6 GDPR for each photo you send us;
2. the people shown have been informed of the processing, in particular that their photo is sent to a service provider to generate a try-on image, and have given their consent where your lawful basis requires it;
3. you do not send photos of children under 16 (13 in the United States) without verifiable parental consent;
4. your instructions to Wearo comply with the GDPR and with the laws that apply to you.

Your instructions are this DPA, the Terms of Service and the requests you send to the Service. Any other instruction must be given in writing.

5. Wearo's obligations as processor

Wearo:

1. processes personal data only on your documented instructions, unless EU or Member State law requires otherwise, in which case Wearo informs you before processing unless that law prohibits it; Wearo informs you if, in its opinion, an instruction infringes the GDPR;
2. ensures that the persons authorised to process the personal data are bound by confidentiality;
3. implements the technical and organisational measures required by Article 32 GDPR, including encryption in transit;
4. engages sub-processors only under the conditions of section 6;
5. assists you, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights; Wearo forwards to you any such request it receives about data it processes on your behalf, and does not respond to it directly unless you instruct it to;
6. assists you in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the information available to Wearo;
7. notifies you of a personal data breach affecting your data without undue delay after becoming aware of it, with the information available at that time;
8. at your choice, deletes or returns the personal data processed on your behalf when the provision of the Service ends, on your written instruction, unless EU or Member State law requires its storage;
9. makes available to you the information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate, on reasonable prior written notice.

6. Sub-processors

You give Wearo a general authorisation to engage sub-processors. Wearo imposes on each of them, by contract, data protection obligations that are no less protective than those of this DPA, and remains liable to you for their performance.

The current list of sub-processors, with their names and locations, is provided on written request to contact@wearo.io, under confidentiality. Wearo informs you in advance of any intended addition or replacement of a sub-processor; you may object on reasonable data protection grounds by writing to contact@wearo.io, and if no solution is found, you may stop using the Service through the channels covered by this DPA.

7. International transfers

Where personal data processed under this DPA is transferred outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on the Standard Contractual Clauses adopted by it.

8. Precedence, liability and law

This DPA prevails over any conflicting provision of the Terms of Service as regards the protection of personal data. Liability under this DPA is governed by the Terms of Service. This DPA is governed by French law, and the courts of Paris have jurisdiction, subject to any mandatory rule to the contrary.

9. Contact

Questions about this DPA, written instructions, objections and requests: contact@wearo.io, subject line DPA.