Data Processing Addendum

Roles

For shopper personal data processed through a merchant's Shopify store, the merchant is the controller and Velox XR Limited is the processor, except where Velox independently processes limited data for security, fraud prevention, billing, service improvement, or legal compliance.

Processed Data

Velox Tri-Fit may process Shopify customer ID, customer email where available, uploaded personal photos, selected product images, generated DressMe and AnimateMe media, saved looks, ratings, sharing actions, add-to-cart actions, usage events, device and browser information, and technical logs.

Purpose

Velox XR Limited processes this data only to provide, secure, support, maintain, and improve Velox Tri-Fit, including virtual try-on, saved looks, product-gallery publishing, sharing, ratings, merchant analytics, billing, and support.

Subprocessors

Velox XR Limited may use subprocessors for hosting, database, storage, AI generation, monitoring, email, support, and security. Subprocessors must process data only as needed to provide the service.

Security

Velox XR Limited uses technical and organizational measures designed to protect personal data, including HTTPS/TLS in transit, encryption at rest for production storage, access controls, logging, and restricted operational access.

Security Incidents

Velox XR Limited maintains an incident response process for suspected unauthorized access, disclosure, loss, alteration, or misuse of personal data processed by Velox Tri-Fit.

Where required, Velox XR Limited will notify affected merchants of confirmed personal data breaches without undue delay, provide information reasonably available about the nature of the incident, and assist merchants with legally required notifications, investigation, mitigation, and remediation.

Data Subject Requests

Velox XR Limited will assist merchants with access, deletion, correction, export, and restriction requests where required by applicable law and Shopify platform requirements.

Deletion And Retention

Velox XR Limited retains personal data only as needed to provide the service, meet legal obligations, resolve disputes, maintain security, and support backups. Shopper photos, generated results, saved looks, and related data can be deleted or removed where supported by the app or by request.

International Transfers

Data may be processed in countries where Velox XR Limited or its subprocessors operate. Appropriate safeguards will be used where required.