Gegevensverwerkingsovereenkomst
Versie 1.0 — Van toepassing vanaf: 25 maart 2026
1. Introduction and Scope
1.1 Parties
This Data Processing Agreement ("DPA") forms part of and supplements the Spwig Terms of Service ("Terms") between:
- Spwig Pte. Ltd. ("Spwig", "Processor"), 3 South Buona Vista Road, #B1-08 Viva Vista, Singapore 118136; and
- the Merchant ("Controller"), the entity that has entered into the Terms for hosted or self-hosted Spwig services.
1.2 Applicability
This DPA applies where Spwig processes personal data on behalf of the Controller in connection with:
- hosted Spwig subscriptions, where Spwig provides the infrastructure and application environment for the Controller's store; and
- self-hosted Spwig installations, to the limited extent that Spwig-operated services receive personal data from the Controller's installation (such as GeoIP lookups, address autocomplete, push notification relay, and SSO broker interactions).
This DPA does not apply to personal data for which Spwig acts as controller in its own right (such as merchant account, billing, licensing, support, and business relationship data), which is governed by the Spwig Privacy Policy.
1.3 Precedence
If there is a conflict between this DPA and the Terms, this DPA prevails for data protection matters. If the Controller and Spwig enter into a separate, signed data processing agreement, that signed agreement prevails over this DPA.
2. Definitions
In this DPA:
- "Applicable Data Protection Law" means GDPR (Regulation (EU) 2016/679), the UK GDPR, the Singapore PDPA, and any other applicable data protection or privacy legislation.
- "Controller" means the party that determines the purposes and means of processing personal data (the Merchant).
- "Data Subject" means the identified or identifiable natural person to whom personal data relates.
- "Personal Data" means any information relating to a Data Subject that is processed by Spwig on behalf of the Controller under this DPA.
- "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
- "Processor" means the party that processes Personal Data on behalf of the Controller (Spwig).
- "Sub-processor" means a third party engaged by Spwig to process Personal Data on behalf of the Controller.
- "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed under this DPA.
3. Processing Details
3.1 Hosted Spwig
For hosted subscriptions, Spwig processes Personal Data as follows:
| Detail | Description |
|---|---|
| Subject matter | Provision and operation of the hosted Spwig eCommerce environment |
| Duration | For the term of the hosted subscription, plus any post-termination retention period described in Section 10 |
| Nature and purpose | Hosting, storage, transmission, backup, security monitoring, and technical maintenance of the Controller's store environment |
| Categories of Data Subjects | The Controller's customers, staff, and other users of the hosted store |
| Categories of Personal Data | Customer account data; names, email addresses, phone numbers, and addresses; order, cart, and fulfilment data; payment status and tokenised payment references; uploaded files and store content; visitor analytics and session data; logs and operational metadata; and other data entered into the hosted environment by the Controller or its users |
Spwig does not have ordinary access to the contents of Personal Data within the Controller's hosted container. Spwig personnel can access such data only where the Controller separately provisions access (for example, by creating a support account) or where access is strictly necessary for infrastructure security, backup, or incident response.
3.2 Self-hosted Spwig
For self-hosted installations, Spwig processes limited Personal Data through Spwig-operated services:
| Service | Personal Data Processed | Purpose |
|---|---|---|
| GeoIP lookups (geoip.spwig.com) | End-customer IP addresses | Geolocation for currency, language, tax, and shipping |
| Address autocomplete (geocoder.spwig.com) | Address data entered during checkout | Address validation and normalisation |
| Push notification relay (push.spwig.com) | Device identifiers and push tokens | Delivery of merchant-configured push notifications |
| SSO broker | Authentication metadata | Federated single sign-on where enabled |
| Error reports (updates.spwig.com) | Stack traces that may incidentally contain Personal Data | Debugging and platform reliability |
For self-hosted services, Spwig acts as processor only for the Personal Data listed above. All other store data remains entirely within the Controller's own infrastructure.
3.3 Controller instructions
Spwig processes Personal Data only on the Controller's documented instructions, which consist of:
- the Terms and this DPA;
- the Controller's configuration choices within the Spwig admin interface (such as enabling or disabling GeoIP, address autocomplete, push notifications, or error reporting); and
- any additional written instructions agreed between the parties.
If Spwig believes an instruction infringes Applicable Data Protection Law, Spwig will inform the Controller without undue delay.
4. Spwig's Obligations
Spwig shall:
(a) process Personal Data only in accordance with the Controller's documented instructions, except where required by law (in which case Spwig will inform the Controller before processing, unless prohibited from doing so);
(b) ensure that persons authorised to process Personal Data are bound by appropriate confidentiality obligations;
(c) implement and maintain the technical and organisational security measures described in Section 5;
(d) comply with the sub-processor requirements in Section 6;
(e) taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to Data Subject rights requests;
(f) assist the Controller in ensuring compliance with obligations relating to security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of processing and the information available to Spwig;
(g) at the Controller's choice, delete or return all Personal Data after the end of the provision of services, subject to Section 10; and
(h) make available to the Controller the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, as described in Section 8.
5. Security Measures
5.1 Technical and organisational measures
Spwig implements security measures appropriate to the risk, including:
Infrastructure and network security:
- HTTPS enforcement in production with HSTS (1-year max-age, includeSubdomains, preload)
- Content Security Policy with nonce-based script enforcement
- X-Content-Type-Options, X-Frame-Options, Referrer-Policy headers
- CORS controls configurable per deployment
- Container-level environment segregation for hosted instances
Access control:
- Role-based access controls with configurable permission categories
- Multi-factor authentication (TOTP) with configurable enforcement levels
- Rate limiting on authentication endpoints (5 attempts/minute), API endpoints (300 requests/minute), and sensitive operations (30 requests/minute)
- Session fixation prevention and secure session cookie configuration (HttpOnly, Secure, SameSite=Lax)
Encryption:
- Fernet symmetric encryption for stored provider credentials (payment, shipping, translation, email, exchange rate)
- HTTPS for all data in transit between installations and Spwig-operated services
- JWT authentication (HS256) for service-to-service communication
Monitoring and audit:
- Audit logging of administrative actions with 90-day retention (user, action, resource, old/new values, IP address, user agent, timestamp)
- Consent change logging with IP address and user agent
Backup and recovery:
- Container-level backups for hosted environments
- Post-termination backup archive available for up to 90 days on request
5.2 Hosted environment segregation
Each hosted merchant environment operates within its own isolated container. Spwig does not commingle Personal Data from different Controller environments at the application level.
5.3 No remote backdoor access
Spwig does not maintain hidden remote admin access, backdoor accounts, or automatic support entry into Controller environments. Spwig personnel can access Controller environments only where the Controller separately provisions such access.
6. Sub-processors
6.1 Authorised sub-processors
The Controller provides general written authorisation for Spwig to engage the sub-processors listed in the current sub-processor list (Annex B). Spwig will keep the sub-processor list current and make it available at the location specified in Annex B or on request.
6.2 New sub-processors
Before engaging a new sub-processor, Spwig will:
(a) notify the Controller by email to the account address on file at least 30 days before the new sub-processor begins processing Personal Data; and
(b) provide the name, location, and description of processing for the new sub-processor.
6.3 Objection
If the Controller has a reasonable, documented objection to a new sub-processor on data protection grounds, the Controller must notify Spwig in writing within 14 days of receiving notice. The parties will discuss the objection in good faith. If the parties cannot resolve the objection within 30 days, the Controller may terminate the affected service by providing written notice, and Spwig will refund any prepaid fees for the terminated service covering the period after termination.
6.4 Sub-processor obligations
Spwig will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, by way of a written contract. Spwig remains liable for the acts and omissions of its sub-processors to the same extent as if Spwig had performed the processing directly.
7. Data Subject Rights
7.1 Assistance
If Spwig receives a request from a Data Subject relating to the Controller's Personal Data, Spwig will promptly redirect the Data Subject to the Controller and notify the Controller of the request. Spwig will not respond to Data Subject requests directly unless instructed by the Controller or required by law.
7.2 Technical support
Where the Controller requires technical assistance to respond to Data Subject access, correction, deletion, portability, or restriction requests, Spwig will provide reasonable assistance using available platform functionality.
8. Audits
8.1 Information and documentation
On reasonable request and subject to confidentiality obligations, Spwig will provide the Controller with information reasonably necessary to demonstrate compliance with this DPA, including summaries of security measures, sub-processor lists, and relevant certifications or assessment reports where available.
8.2 Inspections
The Controller (or a qualified third-party auditor bound by confidentiality) may conduct an audit of Spwig's processing activities under this DPA, subject to the following:
(a) the Controller must provide at least 30 days' written notice;
(b) audits are limited to once per 12-month period, unless required by a supervisory authority or triggered by a Security Incident;
(c) the audit must be conducted during normal business hours and must not unreasonably disrupt Spwig's operations;
(d) the Controller bears the costs of the audit; and
(e) audit findings and reports are treated as Spwig's confidential information.
8.3 Shared audit reports
Where Spwig has obtained a relevant third-party audit report, certification, or security assessment (such as SOC 2 or ISO 27001), Spwig may provide that report to the Controller in lieu of a separate on-site audit, provided it reasonably addresses the Controller's audit scope.
9. Security Incidents
9.1 Notification
Spwig will notify the Controller of a confirmed Security Incident without undue delay and in any event within 72 hours of becoming aware of it. Notification will be sent to the Controller's account email address on file, or to an alternative security contact if one has been designated.
9.2 Notification content
The notification will include, to the extent reasonably available at the time:
(a) a description of the nature of the Security Incident, including the categories and approximate number of Data Subjects and records concerned;
(b) the name and contact details of Spwig's point of contact;
(c) a description of the likely consequences of the Security Incident; and
(d) a description of the measures taken or proposed to address the Security Incident and mitigate its effects.
Where the full information is not available at the time of initial notification, Spwig will provide it in phases as it becomes available.
9.3 Cooperation
Spwig will cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Security Incident.
9.4 No admission
Notification of a Security Incident is not an acknowledgement of fault or liability.
10. Data Retention and Deletion
10.1 During the service term
Spwig retains Personal Data for the duration of the service relationship, subject to the retention periods described in the Privacy Policy.
10.2 On termination
On termination or expiry of the relevant service:
(a) for hosted environments, Spwig will retain a post-termination backup archive for up to 90 days on request and subject to feasibility, after which Spwig will permanently delete remaining Personal Data from the hosted environment and backups;
(b) for self-hosted services, Spwig will delete cached Personal Data (such as GeoIP lookup results) in accordance with the retention periods described in the Privacy Policy (typically 7 to 30 days for geolocation cache data);
(c) the Controller may request data export before termination using available platform export functionality.
10.3 Exceptions
Spwig may retain Personal Data after termination to the extent required by Applicable Data Protection Law, for the establishment, exercise, or defence of legal claims, or for legitimate record-keeping obligations (such as billing records and audit logs).
11. International Transfers
11.1 Processing locations
Personal Data may be processed in the following locations:
- Hosted environments: The region selected by the Controller at provisioning (currently available: Frankfurt for Europe, Singapore for Asia/Oceania, Newark for the Americas), subject to change as described in the Privacy Policy.
- Spwig account and billing data: Singapore.
- Spwig-operated services (GeoIP, Geocoder, Push, SSO, Update Server): Spwig's infrastructure locations, which may include Singapore and other regions.
11.2 Transfer safeguards
Where Personal Data is transferred to a country that does not have an adequate level of data protection under Applicable Data Protection Law, Spwig will ensure that appropriate safeguards are in place, which may include:
(a) the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated by reference as Annex C where applicable;
(b) the UK International Data Transfer Addendum, where the Controller is subject to UK GDPR; or
(c) other transfer mechanisms recognised under Applicable Data Protection Law.
The parties agree that where the Standard Contractual Clauses apply:
- Module Two (Controller to Processor) applies to hosted and self-hosted service processing;
- the Controller is the data exporter and Spwig is the data importer;
- the details of the transfer are as set out in Annex A; and
- the governing law of the Standard Contractual Clauses is the law of the EU Member State in which the Controller is established, or (where the Controller is not established in the EU) the law of Ireland.
12. Liability
Spwig's liability under this DPA is subject to the limitations of liability set out in the Terms. Nothing in this section limits either party's liability for breaches of Applicable Data Protection Law to the extent such liability cannot be limited by contract.
13. Term
This DPA takes effect when the Controller enters into the Terms (or, if later, when this DPA is made available) and continues for as long as Spwig processes Personal Data on behalf of the Controller.
Annex A — Processing Details
| Detail | Description |
|---|---|
| Data exporter | The Controller (Merchant) |
| Data importer | Spwig Pte. Ltd. |
| Categories of Data Subjects | The Controller's customers, staff, visitors, and other users of the Controller's store |
| Categories of Personal Data | As described in Section 3 of this DPA |
| Sensitive data | None intended. If the Controller stores sensitive or special category data within its store environment, the Controller does so under its own responsibility as controller. |
| Frequency of transfer | Continuous for hosted environments; on each service request for self-hosted services |
| Nature of processing | Hosting, storage, transmission, backup, security monitoring, geolocation, address validation, push notification delivery, SSO authentication relay |
| Purpose of processing | Provision of the Spwig platform and associated services as described in the Terms |
| Retention period | As described in Section 10 of this DPA and the Privacy Policy |
| Competent supervisory authority | The supervisory authority of the EU/EEA Member State in which the Controller is established, or where the Controller is not in the EU/EEA, the authority with jurisdiction over the Controller's data protection obligations |
Annex B — Sub-processors
The following sub-processors are authorised as of the effective date of this DPA:
| Sub-processor | Location | Processing Activity |
|---|---|---|
| Akamai Technologies / Linode | Varies by region (Frankfurt, Singapore, Newark, and other Akamai data centre locations) | Infrastructure hosting, compute, storage, and networking for hosted merchant environments and Spwig-operated services |
| Cloudflare, Inc. | Global edge network | DNS management, SSL/TLS termination, DDoS protection, and CDN for hosted merchant environments |
| Airwallex Pty Ltd | Singapore / varies | Payment processing for Spwig merchant subscription billing (processes billing identity and tokenised payment data on behalf of Spwig as controller — included for transparency, though this is controller processing) |
Self-hosted service sub-processors: For self-hosted installations, the Spwig-operated services (GeoIP, Geocoder, Push, SSO, Update Server) run on infrastructure provided by the sub-processors listed above (primarily Akamai/Linode). No additional sub-processors are used for self-hosted service interactions.
Merchant-selected providers: Payment providers, shipping providers, translation providers, email providers, and other third-party integrations selected and configured by the Controller within the Controller's own store are not Spwig sub-processors. The Controller contracts with those providers directly.
Updates: The current sub-processor list is maintained at spwig.com/legal/sub-processors and updated in accordance with Section 6 of this DPA.
Annex C — Standard Contractual Clauses
Where required under Section 11.2, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference with the following selections:
- Module 2 (Controller to Processor) applies.
- Clause 7 (Docking clause): Included, permitting additional parties to accede.
- Clause 9(a) (Sub-processor authorisation): Option 2 (General written authorisation) applies, with the 30-day prior notice period specified in Section 6.2 of this DPA.
- Clause 11 (Redress): The optional language permitting Data Subjects to lodge complaints with an independent dispute resolution body is not included.
- Clause 13 (Supervision): The competent supervisory authority is as set out in Annex A.
- Clause 17 (Governing law): The law of Ireland, or the law of the EU Member State in which the Controller is established where that Member State allows third-party beneficiary rights.
- Clause 18(b) (Forum): The courts of Ireland, or the courts of the EU Member State in which the Controller is established where selected under Clause 17.
The UK International Data Transfer Addendum (as issued by the ICO under Section 119A of the Data Protection Act 2018) is incorporated by reference where the Controller is subject to UK GDPR, with the information in Annex A applying as the Approved EU Transfer Tool details.
Contact
For DPA-related enquiries:
Spwig Pte. Ltd. 3 South Buona Vista Road, #B1-08 Viva Vista, Singapore 118136 [email protected]