Data Processing Agreement
Terms of Use Addendum — Last updated September 25 2026
This agreement (referred to as the "DPA") governs how Looqko processes the personal data of the Client's end users, in accordance with Article 28 of Regulation (EU) 2016/679 (referred to as the "GDPR"). It is an essential part of the Terms of Service and is accepted by the Client during account creation. In the event of any conflict between the two documents regarding personal data processing, this DPA takes precedence.
1. Parties and Purpose
The Data Controller is the Client: the online store or brand that subscribes to the Services and decides to install the virtual try on widget on its site.
The Data Processor is Looqko, SIREN 101 532 596, 18 rue Eugène Varlin, Vigneux sur Seine, France.
The Client determines the purposes and means of processing their own customers' data. Looqko processes this data solely to provide the Services and based on the Client's instructions.
2. Definitions
The terms "personal data", "processing", "data controller", "processor", "data subject", and "data breach" have the meanings given to them in Article 4 of the GDPR.
• End User: the store customer using the virtual try on widget
• Services: the widget, the API, the dashboard, and image and video generation
• Subprocessor: a service provider to whom Looqko entrusts part of the processing.
3. How we process your data
In accordance with Article 28.3 of the GDPR:
Subject matter and nature. Generating a virtual try on image or video from a photograph provided by the end user, and providing a size recommendation.
Purpose. Enabling the end user to visualize a garment on themselves before purchasing. No other purpose is permitted, specifically including no model training on end user photographs.
Categories of data subjects. The Client's end users.
Categories of data. Photograph submitted by the end user; height and weight entered by them, and optional body measurements; generated image or video; IP address, session ID, user agent, language, and country; timestamp and version of the accepted consent text.
Duration. The submitted photograph is deleted within 24 hours. The generated image or video is deleted after a maximum of 30 days, or sooner if the Client reduces this duration in their dashboard, with a minimum limit of 7 days. Technical metadata is retained for up to 12 months.
4. Customer Instructions
Looqko processes end user data only upon documented instruction from the Client. Acceptance of the TOS and this DPA, as well as the use of the Services, constitute these instructions.
If Looqko believes an instruction violates GDPR or another applicable law, it will notify the Client immediately and may suspend execution of that instruction.
Looqko will notify the Client if EU or member state law requires it to process data beyond these instructions, unless legally prohibited from doing so.
5. Privacy Policy
At Looqko, we ensure that anyone authorized to handle end user data is bound by strict legal or contractual confidentiality and accesses it only to the extent necessary to perform their duties.
Data Security
In accordance with Article 32 of the GDPR, Looqko implements:
• Encryption of data in transit (TLS)
• Encryption of stored files at rest
• Password hashing
• Data access restricted based on the principle of least privilege
• Automatic deletion of photos within 24 hours, enforced by a scheduled task and storage lifecycle rule
• Logging of access and errors
These measures may evolve, but the level of protection will never be reduced.
7. Subprocessors
The Client authorizes Looqko to use the following subprocessors:
• Vercel Inc. (United States) — application hosting, execution in the Paris region
• Supabase — database
• Cloudflare, Inc. (United States) — file storage (R2)
• Upstash — queue management
• FASHN AI (United States) — try on generation and content moderation
• Modal (United States) — GPU computing
• Google LLC, AI Studio (United States) — image generation
• kie.ai (United States) — image generation, outside the European Union
• Stripe (United States / Ireland) — payment and billing processing
• Resend (United States) — transactional email delivery
Looqko imposes data protection obligations on each subprocessor equivalent to those in this agreement and remains fully liable for their performance.
Any additions or replacements will be notified to the Client via email at least 30 days in advance. The Client may object on reasonable grounds relating to data protection; if no agreement is reached, the Client may terminate the affected portion of the Services without penalty.
8. Data Transfers Outside the European Union
Several subprocessors are located in the United States. These transfers are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), supplemented, where applicable, by the provider's adherence to the EU–US Data Privacy Framework.
In addition, technical measures are in place: encryption in transit and at rest, data minimization, and a strict 24 hour retention limit for photographs.
A copy of these safeguards is available upon request at legal@looqko.com.
9. Customer Support
Looqko assists the Client, to the extent possible and taking into account the nature of the processing:
• in responding to end users exercising their rights (access, rectification, erasure, restriction, portability, objection); Looqko will forward any request received directly from an end user to the Client without delay and will not respond directly;
• in conducting data protection impact assessments when required, and consulting with the supervisory authority beforehand;
• in documenting the security measures implemented.
10. Data Breach
Looqko will notify the Client of any personal data breach affecting end users by email as soon as possible, and no later than 48 hours after becoming aware of it.
This notification will outline the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and any measures taken or proposed.
As the data controller, the Client is responsible for notifying the supervisory authority and, where applicable, the affected individuals.
11. Data disposition upon contract termination
Audit and documentation
Looqko provides the Client with the information required to demonstrate compliance with Article 28 of the GDPR.
Documentary Audit. The right to audit is exercised in writing: upon request, and no more than once per calendar year, Looqko will complete a security questionnaire and provide the relevant documentation within 30 days. The Client agrees that receiving this documentation, or an audit report prepared by an independent third party, satisfies their right to audit.
Onsite Audit. This is only possible in two scenarios: a proven data breach affecting the Client's data, or a written mandate from a supervisory authority. It is then subject to the following terms:
• 30 day written notice and a date mutually agreed upon by both Parties;
• limited to a maximum of one business day, during regular business hours;
• conducted by an independent auditor bound by a confidentiality agreement, excluding any competitor of Looqko;
• scope restricted solely to processing activities performed for the Client, excluding other client data, source code, trade secrets, and any information covered by a third party agreement;
• all costs borne by the Client, including the time spent by Looqko teams, billed at the current rate;
• prior sharing of the report with Looqko, which will have 30 days to address any findings before any distribution.
These terms apply to any audit requested under this agreement, including those conducted by an agent of the Client.
Liability and duration
This DPA takes effect upon acceptance of the TOS and remains in force for as long as Looqko processes data on behalf of the Client.
Liability between the Parties is allocated in accordance with Article 82 of the GDPR. The liability caps set forth in the TOS apply without prejudice to the rights of data subjects or the powers of supervisory authorities.
The Client guarantees a valid legal basis for the processing entrusted to Looqko, and specifically that its end users have been informed in compliance with Articles 13 and 14 of the GDPR.
Terms and updates
This DPA is accepted electronically upon account creation, pursuant to Article 28.9 of the GDPR, which permits electronic execution. No physical signature is required.
Any material changes will be notified via email at least 30 days prior to taking effect. Clients may terminate their account free of charge before this date if they object to the changes.
Clients wishing to execute their own custom processing agreement can request one at legal@looqko.com.
Governing Law
This DPA is governed by French law. Any disputes shall be subject to the competent courts designated in the TOS.
If the Client is established outside the European Union, this agreement shall apply to the extent that the GDPR is applicable to the processing in question.
Get in touch
For any questions regarding this agreement:
• Legal email: legal@looqko.com
• Support: contact@looqko.com
• Mailing address: 18 rue Eugène Varlin, Vigneux sur Seine, France
Related documents: Terms of Service (looqko.com/cgu) and Privacy Policy (looqko.com/privacy).