Data Processing Agreement

Data Processing Agreement

Last updated: August 13, 2026

This DPA is part of our Terms of Service. It applies whenever Uwindi LLC, 2216 Whistling Duck, Leander, TX 78641, USA ("Uwindi", "we") processes personal data on your behalf while providing website development, hosting, maintenance or marketing services. You are the data controller; Uwindi is the data processor. It covers the EU GDPR, UK GDPR, Swiss FADP and, where applicable, the CCPA. It takes effect when you accept our Terms.

1. Our commitments. We process personal data only on your documented instructions (our contract and your service settings) — never for our own purposes, and we never sell it. Only team members who need access for your project get it, and all of them are bound by written confidentiality obligations.

2. Security. We enforce TLS/SSL on all hosted sites, use multi-factor authentication and unique accounts on hosting control panels, apply least-privilege access, keep CMS core and plugins updated under care plans, and maintain backups per your hosting plan. Physical infrastructure, network, and platform security (servers, firewalls, DDoS protection) are provided by our hosting platform, 20i Ltd (UK), under their published security documentation. (This section also serves as Annex II to the SCCs.)

3. Hosting model and sub-processors. We provide hosting as a reseller of 20i Ltd. You authorize the sub-processors below. We will give you 14 days' notice before adding or replacing one (by updating this page or by email); you may object on reasonable data-protection grounds. We pass the same data-protection obligations down to each sub-processor and remain responsible to you for their performance, as GDPR Art. 28(4) requires. (This table also serves as Annex III to the SCCs).

• Sub-processor: 20i Ltd | United Kingdom, United States and other infrastructure locations used as necessary for service delivery | Web hosting, CDN, backups.
• Sub-processor: Contracted development personnel | United States | Development, maintenance, technical support.

4. Your responsibilities. You remain responsible for your website's content, privacy policy, cookie consent, and the lawful basis for collecting data. Where you or your staff have direct access — your hosting subaccount, CMS admin, FTP, or databases — you are responsible for actions taken through that access, for your credentials, for plugins and third-party tools you install, and for data you upload. Uwindi is not liable for incidents to the extent caused by your access, credentials, configuration, or third-party tools.

5. Data subject requests. If someone contacts us about their data on your site, we forward the request to you and assist as reasonably needed. We don't respond on the merits without your instruction.

6. Breach notification. We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the details reasonably available to us and reasonable cooperation for your own notifications.

7. End of services. Upon termination, we will return or delete personal data processed on your behalf, at your written instruction. Absent instruction within 30 days of termination, we will delete it, except where retention is required by law. Personal data contained in automated hosting backups may remain in isolated backup copies until the applicable backup retention cycle expires, after which it is automatically overwritten or deleted.

8. Audits. Audits will ordinarily be satisfied through documentation, certifications and remote review. Any on-site audit must be reasonably necessary, conducted on reasonable prior notice, during normal business hours, at the Client’s expense, and without unreasonable disruption, except where applicable law or a supervisory authority requires otherwise.

9. International transfers (EU / UK / Switzerland). Uwindi is located in the USA. Where personal data protected by the GDPR is transferred to us, the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (Controller → Processor) are incorporated into this DPA and become binding upon acceptance of our Terms, with these selections: Clause 7 included; Clause 9(a) Option 2 with the 14-day notice above; Clause 11 optional language excluded; Clauses 17–18: law and courts of Ireland; the competent supervisory authority will be determined in accordance with Clause 13 of the SCCs. Annex I to the SCCs is Annex A below; Annexes II–III are Sections 2–3 above. For UK data, the SCCs apply as amended by the ICO's International Data Transfer Addendum; for Swiss data, with the adaptations required by the FDPIC. If this DPA and the SCCs conflict, the SCCs prevail.

10. California (CCPA). Where the CCPA applies, Uwindi acts as your service provider: we do not sell or share personal data, do not use it beyond providing the services, and do not combine it with other data except as the CCPA permits. We certify we understand and will comply with these restrictions.

11. Liability. Each party's liability under this DPA is subject to the limitations in our Terms of Service, except where data protection law or the SCCs do not allow such limits.

Privacy contact: hello@uwindi.com

Annex A — Description of processing (completes SCC Annex I)

Frequency: continuous.

Parties: Exporter — the Client (controller), as identified in the order/contract. Importer — Uwindi LLC, 2216 Whistling Duck, Leander, TX 78641, USA, hello@uwindi.com (processor).

Data subjects: visitors and users of the Client's website(s); the Client's customers and personnel appearing in site data.

Data categories: contact details, account credentials, form submissions, order/billing details stored on the site, IP addresses and usage logs. No special-category or children's data intended.

Activities relevant to the transfer: provision of website hosting, maintenance, support, backup, CDN delivery and related contracted services.

Competent supervisory authority: determined in accordance with Clause 13 of the SCCs.

Purpose and nature: hosting, storage, backup, CDN delivery, maintenance, support, migration, contracted marketing analytics.

Duration: the term of the services plus backup retention; then deleted per Section 7.