Data Processing Agreement

1. How this Addendum applies

1.1 This Data Processing Addendum (“Addendum”) forms part of the Terms and Conditions (“Terms”) between SpinupWP Inc. (“SpinupWP”) and the customer that holds a SpinupWP account (“Customer”). It takes effect on the later of October 19, 2026 and the date Customer first uses the Services. It becomes binding when Customer accepts the Terms, including electronically, and no separate signature is needed.

1.2 This Addendum applies where SpinupWP processes Customer Personal Data on Customer’s behalf and Data Protection Laws apply to that processing.

1.3 If this Addendum conflicts with the Terms, this Addendum prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this Addendum, the Standard Contractual Clauses prevail.

2. Definitions

• Customer Personal Data means personal data that SpinupWP processes on Customer’s behalf in connection with the Services. It includes personal data on the servers, sites, databases and backups that Customer manages through the Services, and in commands, command output, logs and support requests that SpinupWP handles for Customer.
• Account Data means personal data about Customer and its users that SpinupWP processes for its own purposes of running accounts, billing, support and marketing. Site content, database records or other Customer Personal Data included in a support request remain Customer Personal Data. The SpinupWP Privacy Policy governs Account Data. This Addendum does not.
• Data Protection Laws means Regulation (EU) 2016/679 (“GDPR”), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, Canada’s Personal Information Protection and Electronic Documents Act, and any other privacy law that applies to the processing of Customer Personal Data.
• Services means the SpinupWP server control panel and related services described in the Terms.
• Customer-Selected Provider means a hosting, storage, DNS, Git or other provider that Customer engages directly and connects to the Services using Customer’s own account or credentials.
• Subprocessor means a third party that SpinupWP engages to process Customer Personal Data. A Customer-Selected Provider is not a Subprocessor.
• Standard Contractual Clauses means the clauses annexed to Commission Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner.
• The terms “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “supervisory authority” have the meanings given in the GDPR.

3. Roles

3.1 Customer is the controller of Customer Personal Data, or a processor acting for its own clients. SpinupWP is Customer’s processor, or its subprocessor where Customer is a processor.

3.2 Where Customer is a processor, Customer confirms that the relevant controller has authorized its instructions to SpinupWP and the use of Subprocessors under this Addendum.

3.3 SpinupWP is an independent controller of Account Data.

4. SpinupWP’s processing

4.1 SpinupWP processes Customer Personal Data only on Customer’s documented instructions. The Terms, this Addendum, and Customer’s use and configuration of the Services through the dashboard, the API or a support request are Customer’s complete instructions.

4.2 Settings that Customer configures, such as backup schedules and retention periods, are standing instructions. SpinupWP carries them out automatically until Customer changes them or disconnects the server.

4.3 The Services also run automated maintenance without a separate request from Customer, including certificate renewal, server health checks and updates to tools that SpinupWP installs. This maintenance forms part of Customer’s instructions.

4.4 SpinupWP will tell Customer immediately if it believes an instruction breaks Data Protection Laws, and may decline to carry out that instruction.

4.5 If a law requires SpinupWP to process Customer Personal Data in another way, SpinupWP will tell Customer before doing so, unless that law forbids it.

4.6 SpinupWP will not sell Customer Personal Data or use it for its own purposes, including advertising.

4.7 The processing is described in the table below.

5. Customer’s responsibilities

5.1 Customer is responsible for the lawfulness of its instructions, for having a legal basis and giving any required notices to data subjects, and for the accuracy of Customer Personal Data.

5.2 Customer is responsible for its Customer-Selected Providers and for its agreements with them.

5.3 Customer is responsible for the security of what it controls on its servers, including WordPress, plugins, themes, application code and the credentials Customer manages.

6. Confidentiality

6.1 SpinupWP limits access to Customer Personal Data to personnel who need it to provide the Services. Personnel means SpinupWP’s employees and the individual contractors who work under its direction. All personnel are bound by a written duty of confidentiality.

7. Security

7.1 SpinupWP maintains appropriate technical and organizational measures to protect Customer Personal Data, as required by Article 32 of the GDPR. They are described in its security measures document, which is available to Customer on request. SpinupWP may update them, provided the overall level of protection does not materially decrease.

7.2 Customer is responsible for deciding whether those measures meet its own obligations.

8. Subprocessors

8.1 Customer gives SpinupWP general authorization to use the Subprocessors named in its subprocessor list, which is available to Customer on request.

8.2 SpinupWP has a written contract with each Subprocessor that imposes data protection obligations no less protective than this Addendum. SpinupWP remains liable to Customer for each Subprocessor’s performance.

8.3 SpinupWP will give at least 14 days’ notice by email to the account owner before adding or replacing a Subprocessor. Customer may object on reasonable data protection grounds within that period.

8.4 If the parties cannot resolve an objection in good faith, Customer may end the affected Services and receive a pro-rated refund of prepaid fees for the period after termination.

9. Data subject requests and assistance

9.1 If SpinupWP receives a request from a data subject about Customer Personal Data, it will pass the request to Customer without undue delay. SpinupWP will not answer it other than to direct the person to Customer, unless the law requires otherwise.

9.2 The Services give Customer direct access to its servers and sites, so Customer can find, correct, export and delete Customer Personal Data itself. Where Customer cannot do so, SpinupWP will give reasonable help.

9.3 Taking into account the nature of the processing and the information available to it, SpinupWP will give Customer reasonable help with data protection impact assessments, consultations with supervisory authorities, and Customer’s security and breach obligations.

10. Personal data breaches

10.1 SpinupWP will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data processed by SpinupWP or its Subprocessors in connection with the Services.

10.2 SpinupWP will send the notice to the account owner’s email address. It will describe the nature of the breach, the categories and approximate number of data subjects and records where known, the likely consequences, and the steps taken. SpinupWP may provide this information in stages.

10.3 SpinupWP will take reasonable steps to contain and remedy the breach. A notice under this section is not an admission of fault.

10.4 Customer remains responsible for the security of its servers, applications, credentials and Customer-Selected Providers. SpinupWP is not responsible for investigating or remedying incidents that arise solely from systems or activities outside its control, except as Data Protection Laws or this Addendum require. SpinupWP will tell Customer without undue delay about any such incident affecting Customer Personal Data that it becomes aware of.

11. International transfers

11.1 SpinupWP hosts Customer Personal Data in the United States. Its personnel may access Customer Personal Data from Canada, the United Kingdom, Panama and South Africa to provide support and operate the Services. Subprocessors process Customer Personal Data in the countries named in the subprocessor list. Customer authorizes these transfers.

11.2 Transfers from the European Economic Area to SpinupWP rely on Commission Decision 2002/2/EC, which recognizes Canada as adequate for organizations subject to the Personal Information Protection and Electronic Documents Act. Transfers from the United Kingdom rely on the UK adequacy regulations covering Canada on the same basis.

11.3 Before a Subprocessor outside an adequate country receives Customer Personal Data, SpinupWP will have a valid transfer mechanism in place with it. That mechanism is the Subprocessor’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or the Standard Contractual Clauses with the UK Addendum where relevant. The subprocessor list records the mechanism for each Subprocessor.

11.4 In addition to section 11.2, the Standard Contractual Clauses are incorporated into this Addendum and apply between Customer as exporter and SpinupWP as importer wherever Customer Personal Data from the European Economic Area is transferred to, or stored in, the United States or another country without an adequacy decision. They also apply if an adequacy decision in section 11.2 is withdrawn or does not cover a transfer. They apply as follows.

• Module Two applies where Customer is a controller, and Module Three where Customer is a processor.
• Clause 7 (docking) does not apply.
• Clause 9 uses Option 2, general authorization, with the notice period in section 8.3.
• The optional wording in Clause 11 does not apply.
• Clause 17 uses Option 1 and the law of Ireland. Clause 18 names the courts of Ireland.
• For Annex I.A, the data exporter is Customer, as identified in its SpinupWP account, acting as controller or processor. The data importer is SpinupWP Inc., acting as processor, with the contact details in section 15.4. Customer’s acceptance of the Terms serves as each party’s signature.
• Annex I is otherwise completed by sections 1 and 4.7 of this Addendum, Annex II by the security measures document, and Annex III by the subprocessor list.

11.5 Where Customer Personal Data from the United Kingdom is transferred to, or stored in, a country without UK adequacy regulations, the Standard Contractual Clauses apply as set out in section 11.4, as amended by the UK Addendum. The UK Addendum, including its Mandatory Clauses, is incorporated into this Addendum. Tables 1 to 3 are completed with the information in section 11.4, and in Table 4 [neither party] may end the UK Addendum under its Section 19.

11.6 Where Customer Personal Data from Switzerland is transferred to, or stored in, a country without Swiss adequacy recognition, the Standard Contractual Clauses apply as set out in section 11.4, with these changes. References to the GDPR are read as references to the Swiss Federal Act on Data Protection. The Federal Data Protection and Information Commissioner is the supervisory authority. Data subjects in Switzerland may bring claims in the courts where they habitually reside.

12. Return and deletion

12.1 Customer’s servers, sites and backups stay under Customer’s control during and after the Services. Customer can export or delete Customer Personal Data at any time using its own access.

12.2 When Customer removes a server from the Services or closes its account, SpinupWP will remove its own access to that server and delete the Customer Personal Data it holds about that server.

12.3 Copies held in SpinupWP’s own backups are deleted as those backups expire on their normal cycle. Until then, SpinupWP will not access or use those copies except for security, disaster recovery, deletion or compliance with the law.

12.4 SpinupWP may keep Customer Personal Data where a law requires it. SpinupWP will keep that data confidential and will not process it for any other purpose.

12.5 SpinupWP will confirm deletion in writing if Customer asks.

13. Information and audits

13.1 SpinupWP will give Customer the information reasonably needed to show compliance with this Addendum, including written answers to security questionnaires.

13.2 If that information is not enough, Customer or an independent auditor bound by confidentiality may audit SpinupWP’s processing of Customer Personal Data once in any 12 months, on 30 days’ written notice, at Customer’s cost. An audit must not give access to other customers’ data. These limits do not apply to an audit required by a supervisory authority, or to an additional audit that is reasonably necessary after a personal data breach or substantiated evidence that SpinupWP is not complying with this Addendum.

14. Liability

14.1 Each party’s liability under this Addendum is subject to the limits and exclusions in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow liability to be limited.

14.2 Nothing in this Addendum limits a data subject’s rights under Data Protection Laws or the Standard Contractual Clauses.

15. General

15.1 This Addendum lasts for as long as SpinupWP processes Customer Personal Data.

15.2 SpinupWP may update this Addendum to reflect changes in the law or the Services. SpinupWP will give reasonable advance notice of a material change and will not materially reduce the protection of Customer Personal Data. Previous versions remain available on request.

15.3 The governing law and courts named in the Terms apply to this Addendum, except where the Standard Contractual Clauses provide otherwise.

15.4 Privacy questions and notices go to George Fehr, Privacy Officer, at [email protected] or SpinupWP Inc., PO Box 363, Springfield, ON, Canada N0L 2J0.