Privacy Policy of UTRY ApS

Effective date: October 2, 2025
Jurisdiction: Denmark / EU (GDPR applies)

1. Introduction

This Privacy Policy explains how UTRY ApS (“UTRY,” “we,” “our,” or “us”) collects, uses, stores, and protects personal data when you use our services. UTRY provides a virtual fitting room solution that allows users to create an avatar, try on clothing digitally, and receive personalized size recommendations. We are committed to safeguarding your privacy and ensuring compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Danish and EU data protection laws.

2. Data Controller

UTRY ApS
CVR: 45254364
Østervang 11, 3450 Allerød, Denmark
Email: contact@utry.dk

UTRY acts as the independent controller of personal data processed through our services.

3. Types of Data Collected

Account information: name, email address, password hash, login credentials.
Body measurements: user-provided measurement data necessary to create avatars and provide size recommendations.
Photos and images: if uploaded by users, stored securely with the user’s account and deletable at any time.
Avatar and fit data: results of try-on sessions, size recommendations, and related outputs.
Usage and telemetry data: information on garments tried, timestamps, and session identifiers.
Device and technical information: IP address, browser type, operating system, approximate location.
Support and feedback data: communications with our support team, including tickets and chat logs.
Marketing data: newsletter subscriptions and interactions with marketing content.
Cookies and identifiers: cookies or similar technologies used for session management, analytics, and marketing (see Section 10).

We do not collect or process special categories of personal data (e.g., health, ethnicity, religion), nor do we use biometric data for identification.

4. Purposes of Processing

We process personal data for the following purposes:

To provide the virtual try-on service, including avatar creation and size recommendations.
To operate user accounts and maintain cross-brand avatar functionality.
To process user photos and measurement data solely for visualization and sizing purposes.
To analyze and improve our services, conduct A/B testing, and monitor system performance.
To send newsletters and marketing communications (with consent).
To provide customer support and respond to inquiries.
To comply with legal and regulatory obligations (e.g., recordkeeping for tax purposes).

5. Legal Bases for Processing

We rely on the following GDPR legal bases:

Contract performance – for providing accounts, avatars, try-on services, and recommendations.
Legitimate interests – for service analytics, security monitoring, and product improvement.
Consent – for cookies, newsletters, and other marketing activities.
Legal obligations – for compliance with applicable laws, including tax and accounting.

6. Data Retention

Avatar and body measurements: deleted 3 months after account deletion.
Uploaded photos: deleted 3 months after account deletion, or immediately if a user deletes them.
Fit/telemetry logs: retained for 6 months.
Support requests: retained for a standard business period consistent with operational needs.
Backups: retained for a limited rolling period in accordance with our technical safeguards.
B2B contact data: retained for the duration of the business relationship and for a reasonable period thereafter.

Aggregated and anonymized data may be retained beyond these periods for analytics and statistical purposes.

We may share personal data with carefully selected third-party service providers (“processors”) that support our operations, including cloud hosting, analytics, error logging, security monitoring, CRM/ticketing, and CDN/web security. All such processors are bound by contractual data protection obligations. We also provide brand clients with aggregated and anonymized reports to help them assess the value of our solution. We do not sell personal data.

8. Security Measures

We implement appropriate technical and organizational measures, including encryption in transit and at rest, RBAC with MFA, network segmentation, secure key management, audit logging, secure SDLC, regular pentesting and vulnerability scanning, data minimization/pseudonymization, and incident response with breach notification.

9. International Data Transfers

All personal data is stored and processed within the European Union (Microsoft Azure Europe). We do not transfer personal data outside the EU/EEA. If future transfers occur, they will use GDPR-approved mechanisms (e.g., SCCs).

10. Cookies and Tracking

We use:

Strictly necessary cookies for authentication and sessions
Analytics cookies for service improvement
Marketing cookies only with consent

UTRY uses a consent management platform on our website. Retailer partners manage cookie consent on their own platforms. See our Cookie Policy for details.

11. User Rights

Under GDPR, you have the rights of access, rectification, erasure, restriction, portability (avatars cannot be exported), objection (incl. marketing), and to withdraw consent.
Requests: contact@utry.dk. We verify via email and respond within one month.

12. Automated Processing

We use algorithms to generate size recommendations based on measurements and garment info. This does not have legal or similarly significant effects. We do not disclose proprietary algorithmic details; only anonymized/aggregated outputs are shared with third parties.

13. Children’s Data

Our services are not intended for children under 13. If we become aware of collection from a child, we will delete the data immediately.

14. Changes to this Policy

We may update this Policy. Material changes will be communicated on our website and, where appropriate, directly to users. The effective date above indicates the latest version.

15. Contact Information

UTRY ApS
Østervang 11, 3450 Allerød, Denmark
Email: contact@utry.dk