Data processing agreement

This data processing agreement sets out how Sizewright processes personal data on behalf of business customers who use Sizewright. It applies from October 15, 2026, and forms part of our terms of service. An owner or admin of a workspace accepts it in workspace settings; we keep a record of which version was accepted, by whom and when.

Parties

Controller

The business customer that accepts this agreement in the settings of its Sizewright workspace (“you”)

Processor

Sizewright (“we”)

Contact for this agreement

support@sizewright.com

1. Definitions

1.1 Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given to them in the General Data Protection Regulation (EU) 2016/679 (GDPR).

1.2 In this agreement:

• Customer personal data means the personal data in your customer content, as defined in the terms of service, that we process on your behalf when providing Sizewright.
• Subprocessor means a third party we engage to process customer personal data.
• Standard Contractual Clauses means the clauses adopted by Commission Implementing Decision (EU) 2021/914.
• Workspace means a workspace in Sizewright that you own or administer.

Other defined terms have the meaning given in the terms of service.

2. Scope and roles

2.1 This agreement applies to customer personal data that we process when we provide Sizewright to you as a business customer. Annex 1 describes the processing.

2.2 You are the controller of customer personal data, and we are your processor. If you act as a processor for your own clients, for example as an agency, we are your subprocessor, and you confirm that your clients have authorized you to engage us on the terms of this agreement.

2.3 We process personal data about the people who use Sizewright, such as account, billing and security data, as a controller for our own purposes. Our privacy policy describes that processing; this agreement does not apply to it.

2.4 You are responsible for the lawfulness of the processing of customer personal data, including having a legal basis for it and informing the data subjects, such as people shown in images you upload or clients who review banners through approval links.

3. Instructions

3.1 We process customer personal data only on your documented instructions, unless EU or Member State law requires us to process it. In that case, we inform you of that legal requirement before processing, unless the law prohibits this.

3.2 Your instructions are this agreement, the terms of service and the way you use and configure Sizewright, for example when you upload content, start jobs, share approval links, export banners or delete content. Further instructions must be given in writing, must be consistent with the nature of the service, and may be subject to an agreement about any costs they cause.

3.3 We inform you without delay if, in our opinion, an instruction infringes the GDPR or other data protection law.

3.4 We do not process customer personal data for our own purposes. We do not sell it, and we do not use it to train AI models. Customer personal data is sent to AI providers only to perform the generation, analysis or check that you requested.

4. Confidentiality

4.1 We ensure that everyone authorized to process customer personal data is bound to confidentiality by contract or by law.

4.2 We give access only to those who need it. Our support staff can look into a workspace only to help you or to investigate a problem: they must record a reason, each session ends after at most 60 minutes, they cannot change billing or delete anything during it, and every session is logged.

5. Security

5.1 We implement the technical and organizational measures described in Annex 2, which ensure a level of security appropriate to the risk, as required by Article 32 GDPR.

5.2 We may update these measures as technology and threats develop, provided the overall level of security is not reduced.

5.3 You are responsible for the security of your own use of Sizewright, including your users’ passwords and two-factor authentication, the roles you give to workspace members, and who you share approval links with.

6. Subprocessors

6.1 You give us general written authorization to engage subprocessors. The subprocessors we use when you accept this agreement are listed on our subprocessors page.

6.2 We engage each subprocessor through a written contract that imposes data protection obligations that offer at least the same protection as this agreement. We remain responsible to you for the performance of our subprocessors’ obligations.

6.3 We inform you at least 30 days before we add or replace a subprocessor, by updating the change log on the subprocessors page and by email to the owners of workspaces that have accepted this agreement.

6.4 You may object to a new subprocessor within those 30 days on reasonable grounds relating to data protection, by writing to support@sizewright.com. We will then discuss your objection in good faith and, where we can, offer an alternative. If we cannot resolve the objection, you may end the affected service before the change takes effect, by canceling your plan, and we refund the unused part of the current paid period and the value of the unused credits from credit packs.

6.5 If we must replace a subprocessor urgently, for example because of a security incident or because the subprocessor stops its service, we may do so at once and inform you as soon as possible. Your right to object under 6.4 applies.

7. International transfers

7.1 We transfer customer personal data to a country outside the European Economic Area only in accordance with Chapter V of the GDPR: on the basis of an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for subprocessors certified under it, or on the basis of the Standard Contractual Clauses (module three, processor to processor) concluded with the subprocessor, with additional measures where needed.

7.2 If you are established outside the European Economic Area and the GDPR requires it, the Standard Contractual Clauses (module four, processor to controller) apply to the transfer of customer personal data from us to you, and are incorporated into this agreement by reference.

7.3 Where Standard Contractual Clauses apply between you and us: the optional docking clause does not apply; the parties and processing are those described in this agreement and its annexes; the clauses are governed by Dutch law; and disputes are resolved by the courts of the Netherlands.

7.4 The subprocessors page states, for each subprocessor, where it processes data and which transfer mechanism applies.

8. Assistance

8.1 Requests from data subjects. Sizewright gives you the tools to answer most requests yourself: you can view, export, correct and delete content, revoke approval links and delete workspaces. If we receive a request from a data subject about customer personal data, we forward it to you without undue delay and do not answer it ourselves, except to refer the person to you, unless you instruct us otherwise. Where you cannot answer a request with the tools, we assist you with appropriate measures.

8.2 Impact assessments and consultations. We assist you with data protection impact assessments and prior consultations with a supervisory authority, as far as they concern our processing, taking into account the nature of the processing and the information available to us.

8.3 Costs. Assistance that goes beyond the tools in Sizewright and beyond what the law requires of us may be charged at reasonable rates. We tell you the expected costs before we start.

9. Personal data breaches

9.1 We notify you of a personal data breach that affects customer personal data without undue delay after becoming aware of it. Our target is to notify you within 48 hours. We send the notification by email to the owners of the affected workspaces.

9.2 The notification describes, as far as we know at that moment: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose to take, and a contact person. Where we cannot give all information at once, we give it in phases without undue further delay.

9.3 We take reasonable measures to contain the breach and limit its consequences, document the breach, and assist you in meeting your own obligations to notify the supervisory authority and data subjects. Under our breach procedure, we assess every incident within 24 hours.

9.4 Notifying you of a breach is not an acknowledgment of fault or liability.

10. Deletion and return

10.1 During the term of this agreement, you can export and delete customer personal data at any time: export banners in their export formats, download a copy of a workspace’s data and files through the data export in account settings (for workspace owners), and delete files, campaigns, brand kits and whole workspaces. These tools serve as the return of customer personal data.

10.2 Deletion takes place as follows:

• when you delete a workspace, its records are deleted at once and its stored files within the hour;
• when the owner’s account is deleted, the account and the workspaces it owns without other members are deleted after a grace period of 14 days;
• files you delete from a library are deleted after 30 days, unless a live banner still uses them;
• copies in our backups roll off within 30 days.

10.3 We may keep customer personal data after deletion only where EU or Member State law requires us to store it, and only for as long as that law requires. In that case, the obligations of this agreement continue to apply to it.

10.4 On request, we confirm the deletion in writing.

11. Information and audits

11.1 We make available to you the information necessary to demonstrate our compliance with Article 28 GDPR, including this agreement, the measures in Annex 2, the list of subprocessors and answers to reasonable security questionnaires, at most once a year.

11.2 If this information is not sufficient, or if a supervisory authority requires it, you may audit our compliance with this agreement, yourself or through an independent auditor bound to confidentiality, under these conditions:

• you give us at least 30 days’ notice and a description of the scope;
• the audit takes place during business hours, without disrupting the service, and without access to data of other customers or to information that would compromise our security;
• an audit takes place at most once every 12 months, unless there has been a personal data breach affecting your data or a supervisory authority requires it;
• you bear the costs of the audit, and we may charge reasonable costs for our time;
• you share the audit report with us.

12. Liability

The liability of each party under this agreement is subject to the limitations in the terms of service, as far as Article 82 GDPR and other mandatory law allow. Nothing in this agreement limits the rights of data subjects.

13. Term

13.1 This agreement takes effect when it is accepted in workspace settings and continues as long as we process customer personal data for you.

13.2 Obligations that by their nature continue after the end of this agreement, such as confidentiality and deletion, continue to apply.

14. Changes

14.1 We may change this agreement, for example when the law or our subprocessors change. We inform you of material changes at least 30 days before they take effect, by email to the owners of workspaces that have accepted it, and the platform asks an owner or admin to accept the new version. Changes that the law requires may take effect sooner.

14.2 Changes to the list of subprocessors follow section 6.

15. Precedence and governing law

15.1 In matters of personal data processing, this agreement prevails over the terms of service. The Standard Contractual Clauses, where they apply, prevail over this agreement.

15.2 This agreement is governed by Dutch law. Disputes are submitted exclusively to the competent court in Amsterdam, the Netherlands.

Annex 1: Details of the processing

Subject matter and duration

The provision of Sizewright to you under the terms of service, for the term of this agreement and until the customer personal data is deleted under section 10.

Nature and purpose

Storing and hosting content; analyzing briefs, brand kits, images and imported websites with AI language and vision models; generating, editing and extending images; composing, rendering and checking banners; sharing banners with reviewers through approval links; exporting files; sending content to subprocessors as needed for these steps; and deleting content. The purpose is to provide the service you use, as described in the terms of service.

Categories of data subjects

• People shown in images that you upload, import or select.
• People named or described in briefs, brand kits, CSV files, copy and comments.
• Your clients and their contact persons, including reviewers who use approval links.
• Members of your workspace, as far as they appear in customer content, for example in comments and mentions.
• People whose data appears on websites you import into a brand kit.

Categories of personal data

• Names, email addresses, job titles and other contact details.
• Images showing people, and other likenesses.
• Personal data contained in texts you provide, such as briefs, copy, legal lines, CSV files and comments.
• Comments, change requests and approval decisions of reviewers, with their name and email address.

Special categories of personal data

Sizewright is not intended for special categories of personal data or data about criminal convictions. Do not include such data in customer content unless you have a legal basis for it and the processing is necessary. Images of people can reveal special categories, such as health or religious belief; you are responsible for having a legal basis for using them.

Frequency

Continuous, for as long as you use Sizewright.

Retention

As described in section 10 and in the retention table of our privacy policy.

Annex 2: Technical and organizational measures

Access and authentication

• Email and password sign-in with email verification, passwords of at least 10 characters and a check against passwords known from data breaches; sign-in with Google as an option.
• Two-factor authentication with an authenticator app and single-use backup codes, available to every user and required for our staff.
• Sessions in HTTP-only, secure cookies with a 30-day lifetime, a device list, sign-out per device and everywhere.
• Sensitive actions, such as changing a password or email address, turning off two-factor authentication, or deleting an account or workspace, require a sign-in from the last 15 minutes or a new password check with the second factor.
• Bot protection on sign-up, sign-in, password reset and email changes; rate limits on sign-in, sign-up, password reset and two-factor verification.
• Security emails for sign-ins from unknown devices and for changes to the password, email address and two-factor settings.

Separation of customers and permissions

• Every query is scoped to the workspace of the signed-in user, taken from the authenticated session and never from client input, so one workspace cannot reach another workspace’s data.
• Permissions per workspace role (owner, admin, member, viewer), checked on the server for every read and write.

Access by our staff

• Platform roles for staff (support and admin), with two-factor authentication required for both.
• Support access to a customer’s workspace only with a recorded reason, for at most 60 minutes per session, with a visible banner, without the ability to change billing or delete, and with full audit logging.

Approval links

• Links carry a 256-bit random token that we store only as a SHA-256 hash.
• Links expire, can be revoked, can require a password, and are excluded from search engines.

Encryption and location

• HTTPS only, with HSTS.
• The database and file storage are encrypted at rest. The database runs in an EU region, and file storage is held in the EU jurisdiction.

Application security

• A content security policy and security headers that block framing, content type sniffing and unneeded browser features.
• Protection against cross-site request forgery through origin checks; signature checks on incoming webhooks.
• Validation of all input; banner previews rendered in a sandbox without scripts.
• Uploads checked for size and identified by their content rather than their name; images decoded by our processing worker, which rejects malformed files; SVG files cleaned of scripts, event handlers and external references; fonts parsed and validated.
• Protection against requests to internal networks when fetching websites for brand import, with limits on redirects, time and size.
• Signed and time-limited requests between the web application and the processing worker, with replay protection.
• Rate limits per IP address at the edge and per user and workspace on paid actions.

Logging and audit

• Structured logs without secrets, tokens or full card data; IP addresses in sessions are kept for 90 days.
• An append-only audit log of staff actions, role changes, support access, credit adjustments, billing changes and security events, kept for one year.

Availability and backups

• Point-in-time restore for the database; backups roll off within 30 days.
• Automated retention jobs that delete data at the end of the periods in section 10.

Development and operations

• Secrets kept in the hosting environment, never in the code repository, with secret scanning.
• Dependencies kept up to date with grouped updates and checked with security audits.

Incidents

• A breach procedure: assessment within 24 hours, notification of the supervisory authority within 72 hours where required, and notification of customers as in section 9.

Data minimization toward AI providers

• AI providers receive only what a step needs, never account email addresses or billing data, and only to perform the requested work.
• We ask the image-generation provider not to store our requests’ inputs and outputs, and generated files there expire after one day.

Annex 3: Subprocessors

The current list of subprocessors, with their purpose, the data they process, their location and the transfer mechanism, is on our subprocessors page, together with a dated change log.