Legal

Data Processing Agreement

Version 1.0 — Effective Date: March 25, 2026

1. Introduction and Scope

1.1 Parties

This Data Processing Agreement ("DPA") forms part of and supplements the Spwig Terms of Service ("Terms") between:

Spwig Pte. Ltd. ("Spwig", "Processor"), 3 South Buona Vista Road, #B1-08 Viva Vista, Singapore 118136; and
the Merchant ("Controller"), the entity that has entered into the Terms for hosted or self-hosted Spwig services.

1.2 Applicability

This DPA applies where Spwig processes personal data on behalf of the Controller in connection with:

hosted Spwig subscriptions, where Spwig provides the infrastructure and application environment for the Controller's store; and
self-hosted Spwig installations, to the limited extent that Spwig-operated services receive personal data from the Controller's installation (such as GeoIP lookups, address autocomplete, push notification relay, and SSO broker interactions).

This DPA does not apply to personal data for which Spwig acts as controller in its own right (such as merchant account, billing, licensing, support, and business relationship data), which is governed by the Spwig Privacy Policy.

1.3 Precedence

If there is a conflict between this DPA and the Terms, this DPA prevails for data protection matters. If the Controller and Spwig enter into a separate, signed data processing agreement, that signed agreement prevails over this DPA.

2. Definitions

In this DPA:

"Applicable Data Protection Law" means GDPR (Regulation (EU) 2016/679), the UK GDPR, the Singapore PDPA, and any other applicable data protection or privacy legislation.
"Controller" means the party that determines the purposes and means of processing personal data (the Merchant).
"Data Subject" means the identified or identifiable natural person to whom personal data relates.
"Personal Data" means any information relating to a Data Subject that is processed by Spwig on behalf of the Controller under this DPA.
"Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
"Processor" means the party that processes Personal Data on behalf of the Controller (Spwig).
"Sub-processor" means a third party engaged by Spwig to process Personal Data on behalf of the Controller.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed under this DPA.

3. Processing Details

3.1 Hosted Spwig

For hosted subscriptions, Spwig processes Personal Data as follows:

Detail	Description
Subject matter	Provision and operation of the hosted Spwig eCommerce environment
Duration	For the term of the hosted subscription, plus any post-termination retention period described in Section 10
Nature and purpose	Hosting, storage, transmission, backup, security monitoring, and technical maintenance of the Controller's store environment
Categories of Data Subjects	The Controller's customers, staff, and other users of the hosted store
Categories of Personal Data	Customer account data; names, email addresses, phone numbers, and addresses; order, cart, and fulfilment data; payment status and tokenised payment references; uploaded files and store content; visitor analytics and session data; logs and operational metadata; and other data entered into the hosted environment by the Controller or its users

Spwig does not have ordinary access to the contents of Personal Data within the Controller's hosted container. Spwig personnel can access such data only where the Controller separately provisions access (for example, by creating a support account) or where access is strictly necessary for infrastructure security, backup, or incident response.

3.2 Self-hosted Spwig

For self-hosted installations, Spwig processes limited Personal Data through Spwig-operated services:

Service	Personal Data Processed	Purpose
GeoIP lookups (geoip.spwig.com)	End-customer IP addresses	Geolocation for currency, language, tax, and shipping
Address autocomplete (geocoder.spwig.com)	Address data entered during checkout	Address validation and normalisation
Push notification relay (push.spwig.com)	Device identifiers and push tokens	Delivery of merchant-configured push notifications
SSO broker	Authentication metadata	Federated single sign-on where enabled
Error reports (updates.spwig.com)	Stack traces that may incidentally contain Personal Data	Debugging and platform reliability

For self-hosted services, Spwig acts as processor only for the Personal Data listed above. All other store data remains entirely within the Controller's own infrastructure.

3.3 Controller instructions

Spwig processes Personal Data only on the Controller's documented instructions, which consist of:

the Terms and this DPA;
the Controller's configuration choices within the Spwig admin interface (such as enabling or disabling GeoIP, address autocomplete, push notifications, or error reporting); and
any additional written instructions agreed between the parties.

If Spwig believes an instruction infringes Applicable Data Protection Law, Spwig will inform the Controller without undue delay.

4. Spwig's Obligations

Spwig shall:

(a) process Personal Data only in accordance with the Controller's documented instructions, except where required by law (in which case Spwig will inform the Controller before processing, unless prohibited from doing so);

(b) ensure that persons authorised to process Personal Data are bound by appropriate confidentiality obligations;

(d) comply with the sub-processor requirements in Section 6;

(e) taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to Data Subject rights requests;

(f) assist the Controller in ensuring compliance with obligations relating to security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of processing and the information available to Spwig;

(g) at the Controller's choice, delete or return all Personal Data after the end of the provision of services, subject to Section 10; and

(h) make available to the Controller the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, as described in Section 8.

5. Security Measures

5.1 Technical and organisational measures

Spwig implements security measures appropriate to the risk, including:

Infrastructure and network security:

HTTPS enforcement in production with HSTS (1-year max-age, includeSubdomains, preload)
Content Security Policy with nonce-based script enforcement
X-Content-Type-Options, X-Frame-Options, Referrer-Policy headers
CORS controls configurable per deployment
Container-level environment segregation for hosted instances

Access control:

Role-based access controls with configurable permission categories
Multi-factor authentication (TOTP) with configurable enforcement levels
Rate limiting on authentication endpoints (5 attempts/minute), API endpoints (300 requests/minute), and sensitive operations (30 requests/minute)
Session fixation prevention and secure session cookie configuration (HttpOnly, Secure, SameSite=Lax)

Encryption:

Fernet symmetric encryption for stored provider credentials (payment, shipping, translation, email, exchange rate)
HTTPS for all data in transit between installations and Spwig-operated services
JWT authentication (HS256) for service-to-service communication

Monitoring and audit:

Audit logging of administrative actions with 90-day retention (user, action, resource, old/new values, IP address, user agent, timestamp)
Consent change logging with IP address and user agent

Backup and recovery:

Container-level backups for hosted environments
Post-termination backup archive available for up to 90 days on request

5.2 Hosted environment segregation

Each hosted merchant environment operates within its own isolated container. Spwig does not commingle Personal Data from different Controller environments at the application level.

5.3 No remote backdoor access

Spwig does not maintain hidden remote admin access, backdoor accounts, or automatic support entry into Controller environments. Spwig personnel can access Controller environments only where the Controller separately provisions such access.

6. Sub-processors

6.1 Authorised sub-processors

The Controller provides general written authorisation for Spwig to engage the sub-processors listed in the current sub-processor list (Annex B). Spwig will keep the sub-processor list current and make it available at the location specified in Annex B or on request.

6.2 New sub-processors

Before engaging a new sub-processor, Spwig will:

(a) notify the Controller by email to the account address on file at least 30 days before the new sub-processor begins processing Personal Data; and

(b) provide the name, location, and description of processing for the new sub-processor.

6.3 Objection

If the Controller has a reasonable, documented objection to a new sub-processor on data protection grounds, the Controller must notify Spwig in writing within 14 days of receiving notice. The parties will discuss the objection in good faith. If the parties cannot resolve the objection within 30 days, the Controller may terminate the affected service by providing written notice, and Spwig will refund any prepaid fees for the terminated service covering the period after termination.

6.4 Sub-processor obligations

Spwig will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, by way of a written contract. Spwig remains liable for the acts and omissions of its sub-processors to the same extent as if Spwig had performed the processing directly.

7. Data Subject Rights

7.1 Assistance

If Spwig receives a request from a Data Subject relating to the Controller's Personal Data, Spwig will promptly redirect the Data Subject to the Controller and notify the Controller of the request. Spwig will not respond to Data Subject requests directly unless instructed by the Controller or required by law.

7.2 Technical support

Where the Controller requires technical assistance to respond to Data Subject access, correction, deletion, portability, or restriction requests, Spwig will provide reasonable assistance using available platform functionality.

8. Audits

8.1 Information and documentation

On reasonable request and subject to confidentiality obligations, Spwig will provide the Controller with information reasonably necessary to demonstrate compliance with this DPA, including summaries of security measures, sub-processor lists, and relevant certifications or assessment reports where available.

8.2 Inspections

The Controller (or a qualified third-party auditor bound by confidentiality) may conduct an audit of Spwig's processing activities under this DPA, subject to the following:

(a) the Controller must provide at least 30 days' written notice;

(b) audits are limited to once per 12-month period, unless required by a supervisory authority or triggered by a Security Incident;

(d) the Controller bears the costs of the audit; and

(e) audit findings and reports are treated as Spwig's confidential information.

8.3 Shared audit reports

Where Spwig has obtained a relevant third-party audit report, certification, or security assessment (such as SOC 2 or ISO 27001), Spwig may provide that report to the Controller in lieu of a separate on-site audit, provided it reasonably addresses the Controller's audit scope.

9. Security Incidents

9.1 Notification

Spwig will notify the Controller of a confirmed Security Incident without undue delay and in any event within 72 hours of becoming aware of it. Notification will be sent to the Controller's account email address on file, or to an alternative security contact if one has been designated.

9.2 Notification content

The notification will include, to the extent reasonably available at the time:

(a) a description of the nature of the Security Incident, including the categories and approximate number of Data Subjects and records concerned;

(b) the name and contact details of Spwig's point of contact;

(d) a description of the measures taken or proposed to address the Security Incident and mitigate its effects.

Where the full information is not available at the time of initial notification, Spwig will provide it in phases as it becomes available.

9.3 Cooperation

Spwig will cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Security Incident.

9.4 No admission

Notification of a Security Incident is not an acknowledgement of fault or liability.

10. Data Retention and Deletion

10.1 During the service term

Spwig retains Personal Data for the duration of the service relationship, subject to the retention periods described in the Privacy Policy.

10.2 On termination

On termination or expiry of the relevant service:

(a) for hosted environments, Spwig will retain a post-termination backup archive for up to 90 days on request and subject to feasibility, after which Spwig will permanently delete remaining Personal Data from the hosted environment and backups;

(b) for self-hosted services, Spwig will delete cached Personal Data (such as GeoIP lookup results) in accordance with the retention periods described in the Privacy Policy (typically 7 to 30 days for geolocation cache data);

10.3 Exceptions

Spwig may retain Personal Data after termination to the extent required by Applicable Data Protection Law, for the establishment, exercise, or defence of legal claims, or for legitimate record-keeping obligations (such as billing records and audit logs).

11. International Transfers

11.1 Processing locations

Personal Data may be processed in the following locations:

Hosted environments: The region selected by the Controller at provisioning (currently available: Frankfurt for Europe, Singapore for Asia/Oceania, Newark for the Americas), subject to change as described in the Privacy Policy.
Spwig account and billing data: Singapore.
Spwig-operated services (GeoIP, Geocoder, Push, SSO, Update Server): Spwig's infrastructure locations, which may include Singapore and other regions.

11.2 Transfer safeguards

Where Personal Data is transferred to a country that does not have an adequate level of data protection under Applicable Data Protection Law, Spwig will ensure that appropriate safeguards are in place, which may include:

(a) the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated by reference as Annex C where applicable;

(b) the UK International Data Transfer Addendum, where the Controller is subject to UK GDPR; or

The parties agree that where the Standard Contractual Clauses apply:

Module Two (Controller to Processor) applies to hosted and self-hosted service processing;
the Controller is the data exporter and Spwig is the data importer;
the details of the transfer are as set out in Annex A; and
the governing law of the Standard Contractual Clauses is the law of the EU Member State in which the Controller is established, or (where the Controller is not established in the EU) the law of Ireland.

12. Liability

Spwig's liability under this DPA is subject to the limitations of liability set out in the Terms. Nothing in this section limits either party's liability for breaches of Applicable Data Protection Law to the extent such liability cannot be limited by contract.

13. Term

This DPA takes effect when the Controller enters into the Terms (or, if later, when this DPA is made available) and continues for as long as Spwig processes Personal Data on behalf of the Controller.

Annex A — Processing Details

Detail	Description
Data exporter	The Controller (Merchant)
Data importer	Spwig Pte. Ltd.
Categories of Data Subjects	The Controller's customers, staff, visitors, and other users of the Controller's store
Categories of Personal Data	As described in Section 3 of this DPA
Sensitive data	None intended. If the Controller stores sensitive or special category data within its store environment, the Controller does so under its own responsibility as controller.
Frequency of transfer	Continuous for hosted environments; on each service request for self-hosted services
Nature of processing	Hosting, storage, transmission, backup, security monitoring, geolocation, address validation, push notification delivery, SSO authentication relay
Purpose of processing	Provision of the Spwig platform and associated services as described in the Terms
Retention period	As described in Section 10 of this DPA and the Privacy Policy
Competent supervisory authority	The supervisory authority of the EU/EEA Member State in which the Controller is established, or where the Controller is not in the EU/EEA, the authority with jurisdiction over the Controller's data protection obligations

Annex B — Sub-processors

The following sub-processors are authorised as of the effective date of this DPA:

Sub-processor	Location	Processing Activity
Akamai Technologies / Linode	Varies by region (Frankfurt, Singapore, Newark, and other Akamai data centre locations)	Infrastructure hosting, compute, storage, and networking for hosted merchant environments and Spwig-operated services
Cloudflare, Inc.	Global edge network	DNS management, SSL/TLS termination, DDoS protection, and CDN for hosted merchant environments
Airwallex Pty Ltd	Singapore / varies	Payment processing for Spwig merchant subscription billing (processes billing identity and tokenised payment data on behalf of Spwig as controller — included for transparency, though this is controller processing)

Self-hosted service sub-processors: For self-hosted installations, the Spwig-operated services (GeoIP, Geocoder, Push, SSO, Update Server) run on infrastructure provided by the sub-processors listed above (primarily Akamai/Linode). No additional sub-processors are used for self-hosted service interactions.

Merchant-selected providers: Payment providers, shipping providers, translation providers, email providers, and other third-party integrations selected and configured by the Controller within the Controller's own store are not Spwig sub-processors. The Controller contracts with those providers directly.

Updates: The current sub-processor list is maintained at spwig.com/legal/sub-processors and updated in accordance with Section 6 of this DPA.

Annex C — Standard Contractual Clauses

Where required under Section 11.2, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference with the following selections:

Module 2 (Controller to Processor) applies.
Clause 7 (Docking clause): Included, permitting additional parties to accede.
Clause 9(a) (Sub-processor authorisation): Option 2 (General written authorisation) applies, with the 30-day prior notice period specified in Section 6.2 of this DPA.
Clause 11 (Redress): The optional language permitting Data Subjects to lodge complaints with an independent dispute resolution body is not included.
Clause 13 (Supervision): The competent supervisory authority is as set out in Annex A.
Clause 17 (Governing law): The law of Ireland, or the law of the EU Member State in which the Controller is established where that Member State allows third-party beneficiary rights.
Clause 18(b) (Forum): The courts of Ireland, or the courts of the EU Member State in which the Controller is established where selected under Clause 17.

The UK International Data Transfer Addendum (as issued by the ICO under Section 119A of the Data Protection Act 2018) is incorporated by reference where the Controller is subject to UK GDPR, with the information in Annex A applying as the Approved EU Transfer Tool details.

Contact

For DPA-related enquiries:

Spwig Pte. Ltd. 3 South Buona Vista Road, #B1-08 Viva Vista, Singapore 118136 [email protected]