Spindlewise Data Processing Addendum

DRAFT v0.2 for legal review · not yet in force

Written to meet Article 28 of the EU and UK GDPR, the Australian Privacy Principles, the New Zealand Privacy Act 2020 and Canada's PIPEDA. Placeholders in {braces} must be filled in. Review with a lawyer before publishing.

1. Purpose and roles

1.1 This addendum applies to personal information contained in Customer Data ("Customer Personal Data"), as those terms are used in the Terms. The Customer is the controller of Customer Personal Data and decides what is put into the Service and why. Spindlewise is the processor and handles it only on the Customer's behalf to provide the Service.

1.2 For New Zealand purposes, Spindlewise holds Customer Personal Data as the Customer's agent and does not use or disclose it for its own purposes. For Australian purposes, Spindlewise handles it only as needed to provide the Service to the Customer.

1.3 Account, billing, support and security information that Spindlewise handles as a controller is covered by the Privacy Policy, not this addendum.

2. Details of processing

3. Spindlewise's commitments

3.1 Spindlewise will:

• process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this addendum and the Customer's use and settings of the Service, unless the law requires otherwise (in which case Spindlewise will tell the Customer first where the law allows), and tell the Customer if it believes an instruction breaks data protection law;
• not sell it, not share it with other customers, not use it to match the Customer with buyers, and not use it to train third-party AI models;
• make sure anyone who can access it is bound by confidentiality;
• apply the security measures in Annex 2 and keep them at least as protective during the term;
• help the Customer, taking into account the nature of the processing, to answer requests from individuals exercising their rights, and to meet its obligations on security, breach notification, data protection impact assessments and consultation with regulators, to the extent the Customer cannot do so through the Service.

4. Sub-processors

4.1 The Customer gives general authorisation for Spindlewise to use sub-processors. The sub-processors at the effective date are listed in Annex 3.

4.2 Spindlewise will give at least 30 days' notice by email before adding or replacing a sub-processor that handles Customer Personal Data. If the Customer reasonably objects on data protection grounds, the parties will discuss it in good faith; if it cannot be resolved, the Customer may terminate the affected Service and receive a refund of prepaid fees for the period after termination.

4.3 Spindlewise will put data protection terms in place with each sub-processor that are at least as protective as this addendum, and remains responsible to the Customer for their performance.

5. Location and international transfers

5.1 Customer Data is stored in Singapore. Spindlewise is operated by an individual based in China, who may access Customer Data remotely only when needed for support, maintenance or security. Sub-processors based in the USA may access data to run their services. Spindlewise will give at least 30 days' notice before moving primary storage to another country.

5.2 EU and EEA. To the extent Customer Personal Data subject to the EU GDPR is transferred to Spindlewise in a country without an adequacy decision, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this addendum, with: the Customer as data exporter and Spindlewise as data importer; clause 7 (docking clause) included; option 2 of clause 9(a) (general authorisation, with the notice period in clause 4.2); the optional wording in clause 11(a) not used; option 1 of clause 17 with the law of {EU member state}; the courts of that member state under clause 18(b); and Annexes I to III completed by Annexes 1 to 3 of this addendum. The competent supervisory authority is that of the Customer's EU establishment or, if it has none, of its EU representative.

5.3 United Kingdom. For Customer Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) applies to the clauses in 5.2, with the tables completed by this addendum and neither party able to end it under its section 19.

5.4 Switzerland. For data subject to the Swiss Federal Act on Data Protection, the clauses in 5.2 apply with references to the GDPR read as references to that Act and the Federal Data Protection and Information Commissioner as the competent authority.

5.5 If these clauses conflict with this addendum, the clauses prevail. Spindlewise will cooperate with the Customer on any transfer impact assessment and tell the Customer promptly if it receives a government request for Customer Personal Data, unless the law prevents it.

6. Security incidents

6.1 Spindlewise will notify the Customer without undue delay, and in any case within 48 hours of becoming aware, of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

6.2 The notice will describe what happened, the categories and approximate numbers of people and records affected, the likely consequences, what Spindlewise has done or proposes to do, and a contact person, with further detail as it becomes available. Spindlewise will help the Customer meet any notification duty it has, including under the GDPR, the Australian Notifiable Data Breaches scheme, the New Zealand Privacy Act 2020 and PIPEDA.

7. Information and audits

7.1 Spindlewise will make available the information needed to show compliance with this addendum, and answer reasonable written security questionnaires once a year and after any security incident.

7.2 If that information is not enough to show compliance, or a regulator requires it, the Customer (or an independent auditor it appoints, bound by confidentiality) may audit Spindlewise's compliance once a year, on at least 30 days' notice, during business hours and at the Customer's cost, in a way that does not reveal other customers' data.

8. Requests from individuals and authorities

8.1 If Spindlewise receives a request from an individual about Customer Personal Data, it will pass it to the Customer and not answer it itself, except to say it has been passed on.

9. Return and deletion

9.1 The Customer can export Customer Data at any time during the term and for 30 days after it ends. Spindlewise then deletes Customer Personal Data from the live system within a further 60 days, and from backups within 35 days after that, unless the law requires it to be kept.

10. Liability and precedence

10.1 The liability terms of the Terms apply to this addendum, except where the standard contractual clauses do not allow it. If this addendum conflicts with the Terms on the handling of Customer Personal Data, this addendum prevails.

Annex 1: Parties and description of the transfer

Annex 2: Security measures

Annex 3: Sub-processors