Privacy Policy

1. WHO WE ARE AND SCOPE OF THIS POLICY

Dress UP SRL (“Dress UP”, “we”, “us” or “our”) is the controller of personal data processed through the Dress UP peer-to-peer fashion rental and marketplace services, except where another party acts as an independent controller under applicable law.

Registered office: Via Marcantonio parenti, 47/E – Modena (MO), 41122, Italy.

Contact for privacy and data-protection requests: customersupport@dressupstore.it.

This Privacy Policy explains how we collect, use, disclose, transfer, retain and protect personal data when you use the Dress UP mobile application, website, marketplace, payment, rental, purchase, AI Virtual Try-On and related services (the “Services”). It should be read together with our Terms and Conditions and, where applicable, our Cookie/Tracking Policy.

The Services are intended for users aged 18 or over. Dress UP does not knowingly offer marketplace accounts to children.

2. PERSONAL DATA WE COLLECT

Depending on how you use Dress UP, we may collect the following categories of personal data:

• Account and identity data: name, surname, username, date of birth, email address, telephone number, address, profile photo, biography and account credentials.

• Verification/KYC data: identity-document and verification information required to verify users, lenders, sellers or payment recipients. Verification may be performed through third-party providers such as Stripe.

• Tax and DAC7 data: tax residence, Tax Identification Number (TIN), VAT number where applicable, legal name, address, date of birth, financial account information and other information required for tax due-diligence or reporting.

• Transaction and marketplace data: listings, rentals, purchases, prices, commissions, payouts, deposits, refunds, cancellations, delivery/tracking information, disputes, damage claims and transaction history.

• Payment data: payment and payout information processed through payment service providers. Dress UP does not intend to store full payment-card credentials where these are handled directly by the payment provider.

• User content: listing photographs, descriptions, reviews, messages, condition photographs, reports and other content submitted through the Services.

• AI Virtual Try-On data: photographs voluntarily uploaded for Virtual Try-On, generated images, prompts or technical information necessary to provide the feature.

• Technical and usage data: device information, IP address, operating system, browser/app information, identifiers, logs, crash information, pages/screens viewed and interaction data.

• Consent and compliance records: Terms/Privacy versions accepted, timestamps, cookie/tracking preferences, marketing preferences and other consent or acknowledgement records.

• Communications: information you provide when contacting customer support, participating in disputes, responding to surveys or communicating with us.

• Optional social/profile data: social-media handle, location, photo or biography where you choose to provide them.

3. WHY WE USE PERSONAL DATA AND OUR LEGAL BASES

3.1 Providing the Services and performing our contract

We process data necessary to create and manage accounts, enable listings, rentals and purchases, process payments and payouts, provide customer support, manage delivery and returns, operate disputes and provide requested features, including Virtual Try-On where applicable.

3.2 Compliance with legal obligations

We may process personal data to comply with tax, accounting, anti-fraud, regulatory, law-enforcement, product-safety and platform obligations. This includes DAC7 due diligence and reporting where applicable, and responding to valid requests from competent authorities.

3.3 Legitimate interests

Where permitted by law, we may process data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights. These interests may include securing the Services, preventing fraud and abuse, resolving disputes, improving the marketplace, maintaining business records and protecting legal rights.

3.4 Consent

We rely on consent where required, including for certain marketing communications, non-essential cookies/tracking technologies, and specific uses of photographs or AI-generated content that are not necessary to provide the requested service. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

4. LENDING, RENTING, BUYING AND MARKETPLACE ACTIVITY

When you lend, rent, sell or buy an item, we process information required to facilitate the transaction, including order details, pricing, delivery information, communications, payment status and transaction history.

Certain information may be shared between the parties to a transaction where necessary to complete the rental, sale, delivery, return or dispute process. Users must not use another user’s personal data for unrelated purposes.

5. IDENTITY VERIFICATION, PAYMENTS AND STRIPE

Dress UP may use Stripe and related payment/identity services to facilitate payments, payouts, fraud prevention, identity verification and KYC. Stripe may process personal data as a processor or independent controller depending on the relevant service and applicable terms.

Completing payment-provider KYC does not necessarily satisfy Dress UP’s separate tax-reporting obligations. Dress UP may request additional information required for DAC7 or other legal compliance.

6. DAC7 AND TAX REPORTING

Where Dress UP is subject to Council Directive (EU) 2021/514 (“DAC7”) or national implementing legislation, we may be legally required to collect, verify, retain and report information about reportable lenders or sellers to the competent tax authority.

Reportable information may include identification details, primary address, date of birth, tax residence, Tax Identification Number (TIN) - including, for Italian individuals where applicable, the Codice Fiscale - VAT number where applicable, financial account information, total consideration paid or credited, number of relevant activities and fees or commissions withheld or charged by Dress UP.

The legal basis for this processing is compliance with legal obligations. Dress UP may restrict listings or payouts where legally required information has not been provided or verified.

7. AI VIRTUAL TRY-ON

7.1 What the feature does

The Virtual Try-On feature allows users to upload a photograph and receive an AI-generated or AI-manipulated visual simulation of how a garment may appear. The result is a simulation and may not accurately represent real fit, size, colour, texture or condition.

7.2 Data and purpose

Photographs uploaded specifically for Virtual Try-On and generated images are processed to provide the requested AI feature, maintain security and troubleshoot the service. We do not use uploaded Virtual Try-On photographs or generated images to train AI models unless we obtain separate, explicit consent for that specific purpose.

7.3 AI provider – Replicate

Dress UP currently uses Replicate, Inc. (United States) in connection with Virtual Try-On functionality. The original image and related technical data may therefore be transmitted to and processed in the United States. Dress UP does not store the generated result in its own storage; the result may be delivered through a provider-hosted URL. Dress UP applies the international-transfer safeguards described in Section 12 and will maintain appropriate contractual and technical measures with relevant providers. Provider-side retention and deletion are subject to the applicable service configuration and contractual arrangements.

7.4 AI transparency

Dress UP informs users when content is generated or materially manipulated using AI. Where applicable to Dress UP’s role and technical implementation, we will implement transparency and marking measures required by Article 50 of Regulation (EU) 2024/1689 (EU AI Act), including applicable requirements concerning AI-generated or manipulated content.

7.5 Automated decision-making

Virtual Try-On involves automated image processing, but Dress UP does not use the feature to make decisions producing legal effects or similarly significant effects about users. Users remain free to decide whether to rely on generated visualisations.

8. AI IMAGE RETENTION AND DELETION

Photographs uploaded by users specifically for the AI Virtual Try-On are processed only for the time necessary to submit and complete the requested AI processing. Once processing has completed, the original uploaded photograph is deleted from Dress UP-controlled storage and is not retained by Dress UP for ongoing use, except where temporary retention is strictly necessary due to a technical failure or where retention is required by law. Dress UP does not use these photographs to train AI models unless separate, explicit consent has been obtained.

Dress UP does not store the AI-generated Virtual Try-On result in its own storage. The result is returned through infrastructure operated by the AI service provider and may be temporarily accessible through a provider-hosted URL. Retention and deletion on the provider's infrastructure are governed by the provider configuration, contractual terms and applicable data-protection safeguards. Dress UP will take reasonable steps to configure providers to minimise retention and access to such data.

Users may request deletion of eligible photographs and generated images through the available account/privacy channels.

9. ANALYTICS, MICROSOFT CLARITY, COOKIES AND TRACKING

Dress UP may use analytics and product-improvement technologies to understand how users interact with the Services, diagnose technical issues and improve user experience. These technologies may include Microsoft Clarity and Google Firebase Analytics.

For users in the EEA and other jurisdictions where consent is required, non-essential analytics and tracking technologies operate only in accordance with the user's consent choices. On the website, Dress UP currently uses Iubenda to manage applicable cookie and tracking preferences. The mobile application uses a separate in-app consent mechanism; Microsoft Clarity is held back until the required analytics consent has been provided.

Microsoft Clarity may process device, usage and interaction information in accordance with the applicable configuration and Microsoft’s terms. Dress UP will configure Clarity and other non-essential tracking technologies to respect required consent signals. More detailed and current information about cookies, SDKs, trackers, purposes and retention should be provided through the Cookie/Tracking Policy or consent interface.

Dress UP does not sell personal data to advertisers.

10. MARKETING AND COMMUNICATIONS

We may send service-related communications necessary to operate your account or transactions. Marketing communications are sent where permitted by applicable law. Where consent is required, we will obtain it before sending such communications. You can opt out of marketing at any time using the unsubscribe mechanism or by contacting us.

11. WHO WE SHARE PERSONAL DATA WITH

We may disclose personal data where necessary to:

• payment, payout, KYC and fraud-prevention providers, including Stripe;

• AI infrastructure/service providers, including Replicate for Virtual Try-On;

• analytics and consent-management providers, including Microsoft Clarity, Google Firebase Analytics and Iubenda where enabled;

• cloud hosting, database, communications, customer-support, security and technical service providers, including Amazon Web Services (image and document storage, hosted in the EU), MongoDB Atlas (database), Sentry (error and crash reporting), Pusher (in-app messaging delivery) and Resend (transactional email), as well as the sign-in providers Google Sign-In, Apple Sign-In and Firebase Authentication;

• other users where necessary to complete a rental, purchase, delivery, return or dispute;

• professional advisers such as lawyers, auditors, accountants, banks and insurers;

• tax authorities, regulators, courts, law-enforcement bodies and other public authorities where required or permitted by law;

• a buyer, investor or successor in connection with a merger, financing, restructuring, acquisition or sale, subject to appropriate safeguards.

We require service providers processing personal data on our behalf to handle it in accordance with applicable data-protection requirements and contractual safeguards.

12. INTERNATIONAL DATA TRANSFERS

Dress UP operates internationally and some service providers may process personal data outside Italy or the EEA, including in the United States.

Where the GDPR requires safeguards for an international transfer, Dress UP will rely on an applicable lawful transfer mechanism, such as an adequacy decision where available, the European Commission’s Standard Contractual Clauses, and/or another mechanism permitted by applicable law. Where required, we will assess supplementary technical, contractual or organisational measures.

Users may contact us for further information about the safeguards applicable to relevant transfers.

13. DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected and to satisfy applicable legal, accounting, tax, fraud-prevention, dispute-resolution and regulatory requirements.

Retention periods differ by category. In particular:

• Account/profile data: generally for the duration of the account and then deleted or anonymised when no longer required, subject to legal retention obligations.

• Transaction, payment, accounting and tax records: retained for the period required by applicable tax, accounting and legal rules.

• DAC7 due-diligence and reporting records: retained for the period required by applicable DAC7/national implementing rules.

• Dispute, fraud and legal-claim records: retained for as long as reasonably necessary to resolve the matter and establish, exercise or defend legal claims.

• Consent and Terms acceptance records: retained as necessary to demonstrate compliance.

• Virtual Try-On source photographs and generated images: retained according to Section 8 and the actual technical retention configuration.

• Analytics/tracking data: according to the applicable provider configuration, consent choices and Cookie/Tracking Policy.

Dress UP will maintain an internal retention schedule and align production systems with the periods communicated in this Policy.

14. ACCOUNT DELETION

When a user selects Delete Account, Dress UP removes the account from normal active use and hides or removes the user's public-facing listings and content. A deletion request also triggers Dress UP's data-deletion process. Personal data that is no longer necessary will be erased or irreversibly anonymised, while information that Dress UP is legally required or otherwise permitted to retain will be separated or access-restricted and retained only for the applicable purpose and period.

Dress UP may retain limited records after an account deletion request where necessary for tax and accounting obligations, DAC7 reporting and due diligence, payment reconciliation, fraud prevention, dispute handling, product-safety obligations, regulatory compliance, or the establishment, exercise or defence of legal claims. Retention of such records does not mean that the user remains an active Dress UP user.

15. YOUR DATA-PROTECTION RIGHTS

Subject to the GDPR and other applicable laws, you may have the right to:

• request access to your personal data;

• request correction of inaccurate or incomplete personal data;

• request erasure of personal data where the legal requirements are met;

• request restriction of processing;

• object to processing based on legitimate interests, including certain direct marketing;

• receive certain personal data in a structured, commonly used and machine-readable format and request portability where applicable;

• withdraw consent at any time where processing is based on consent;

• lodge a complaint with a competent supervisory authority.

To exercise your rights, contact customersupport@dressupstore.it. We may need to verify your identity before completing a request.

Users in Italy may lodge a complaint with the Garante per la protezione dei dati personali. Users in another EU/EEA country may also contact the competent supervisory authority in their habitual residence, place of work or place of the alleged infringement.

16. SECURITY

Dress UP uses appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No system can guarantee absolute security, and users are responsible for protecting their account credentials.

17. DATA RELATING TO REPORTS, MODERATION, SAFETY AND DISPUTES

Where users report listings, illegal content, intellectual-property concerns, unsafe products, fraud or other violations, Dress UP may process the report, supporting evidence, communications, identifiers and moderation records to investigate the issue, protect users, enforce the Terms and comply with applicable legal obligations.

We may retain records of moderation or enforcement decisions where necessary to demonstrate compliance, prevent abuse, resolve appeals or disputes, or respond to competent authorities.

18. BUSINESS TRANSFERS

If Dress UP is involved in a merger, acquisition, financing, restructuring, sale of assets or similar transaction, personal data may be disclosed to relevant parties where necessary and subject to applicable confidentiality and data-protection safeguards.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in law, technology, providers or the Services. Where changes are material, we will provide appropriate notice through the App, Website, email or another suitable channel. The effective date of the current version should be displayed when the Policy is published.

20. CONTACT

Dress UP SRL

Via Marcantonio parenti, 47/E – Modena (MO), 41122, Italy

Email: customersupport@dressupstore.it