Spifex
Start free

Data protection

Data Processing Agreement

GDPR Article 28 data processing terms for customers that process personal data in Spifex workspaces.

Last updated:

This Data Processing Agreement (“DPA”) applies when Spifex processes personal data on behalf of a customer in connection with the Spifex services. It is intended to satisfy Article 28 of the EU General Data Protection Regulation (GDPR) and equivalent requirements in the UK and EEA.

This published DPA becomes part of the agreement between Spifex and the customer when it is incorporated by an order form, online terms or a signed DPA. If a separately signed DPA applies, that signed version prevails.

A countersigned version with completed annexes is available from legal@spifex.com.

1. Definitions

  • Customer means the entity that subscribes to or uses the Spifex services.
  • Processor means Spifex when it processes Customer Personal Data on behalf of the Customer.
  • Controller means the Customer when it determines the purposes and means of processing Customer Personal Data.
  • Customer Personal Data means personal data processed by Spifex on behalf of the Customer through the services.
  • Subprocessor means a third party engaged by Spifex to process Customer Personal Data.
  • GDPR means Regulation (EU) 2016/679.
  • Services means the Spifex websites, applications, platform and related services described in the applicable order or plan.

Terms such as “personal data”, “processing”, “data subject”, “controller”, “processor” and “supervisory authority” have the meanings given in the GDPR.

2. Roles and scope

The Customer is the controller of Customer Personal Data. Spifex is the processor, except where Spifex determines the purposes and means of processing for its own account, such as account administration, security monitoring, billing or legal compliance. In those cases, Spifex acts as an independent controller as described in the Privacy Policy.

The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are described in Annex A.

3. Customer instructions

Spifex will process Customer Personal Data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country, unless required to do so by EU or Member State law. In that case, Spifex will inform the Customer of the legal requirement before processing, unless the law prohibits that information.

The Customer instructs Spifex to process Customer Personal Data to provide, secure, maintain and support the services, and as further described in the agreement and product documentation.

The Customer is responsible for:

  • ensuring it has a lawful basis for the processing;
  • providing appropriate notices to data subjects;
  • configuring workspace roles, permissions and retention settings;
  • ensuring that its instructions comply with applicable law; and
  • responding to data subject requests, with Spifex assistance where required.

4. Confidentiality

Spifex will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations or are subject to appropriate statutory obligations. Access is limited to personnel who need it to provide, secure or support the services.

5. Security

Spifex will implement appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to data subjects.

The current measures are described in our Security and Technical Organisational Measures. Spifex may update the measures provided that the overall level of protection is not materially reduced.

6. Subprocessors

The Customer authorizes Spifex to engage subprocessors to provide the services. Spifex will:

  • impose data protection obligations on subprocessors that are no less protective than those in this DPA;
  • remain responsible for the performance of subprocessors;
  • maintain a current list of subprocessors on the Subprocessors page or in the DPA annex; and
  • provide a mechanism to receive notice of changes and to object on reasonable data protection grounds.

If the Customer objects to a new subprocessor on reasonable data protection grounds, the parties will discuss the concern in good faith. If no reasonable resolution is possible, the Customer may terminate the affected services as permitted by the agreement.

7. International transfers

Spifex and its subprocessors may process Customer Personal Data outside the EU/EEA. Where required, Spifex will implement appropriate safeguards, such as:

  • an adequacy decision of the European Commission;
  • the Standard Contractual Clauses adopted by the European Commission (2021/914);
  • the UK International Data Transfer Addendum where applicable; or
  • another lawful transfer mechanism.

Where Standard Contractual Clauses apply, they are incorporated by reference and the parties will complete the relevant annexes. The Customer may request a copy of the applicable transfer mechanism from legal@spifex.com.

8. Data subject rights

Taking into account the nature of the processing, Spifex will assist the Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests from data subjects.

If Spifex receives a request directly from a data subject relating to Customer Personal Data, it will redirect the request to the Customer where appropriate and will not respond substantively unless required by law or authorized by the Customer.

9. Personal data breach

Spifex will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification will include, where available:

  • a description of the nature of the breach;
  • the categories and approximate number of data subjects and records affected;
  • the likely consequences; and
  • the measures taken or proposed to address the breach.

Spifex will cooperate with the Customer’s notifications to supervisory authorities and data subjects where required. Notification to the Customer is not an acknowledgment of fault.

10. Audits and information

Spifex will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for audits, including inspections, by the Customer or an auditor mandated by the Customer, subject to:

  • reasonable prior notice;
  • confidentiality obligations;
  • scope limited to the services and relevant controls;
  • no access to other customers’ data; and
  • reimbursement of reasonable costs where the audit is not required by law or a supervisory authority.

Where Spifex provides current security certifications, audit reports or completed security questionnaires, those materials may satisfy the information requirement in place of an on-site audit.

11. Return and deletion

At the Customer’s choice, Spifex will delete or return Customer Personal Data after the end of the provision of services, unless EU or Member State law requires storage. The Customer can export workspace data during the subscription term and during the transition period described in the agreement.

Deletion may be delayed in backups until the normal backup cycle expires, provided the data remains protected and is not used for other purposes.

12. Liability and precedence

The liability of each party under this DPA is subject to the limitations and exclusions in the agreement, except where applicable law prohibits those limitations.

If there is a conflict between this DPA and the agreement, this DPA prevails with respect to the processing of Customer Personal Data. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

13. Contact

For privacy and DPA questions:

Annex A — Details of processing

Subject matter: Provision of the Spifex financial operations platform and related services.

Duration: The term of the agreement, plus the deletion or return period.

Nature and purpose: Hosting, storing, organizing, retrieving, displaying, securing and supporting customer workspace data; providing cash flow, banking visibility, settlements, ledger, projects, departments, inventory, reporting and read-only AI connection features.

Categories of data subjects: Customer personnel, contractors, workspace users, customers, suppliers, counterparties and other individuals whose data the Customer submits.

Categories of personal data: Identification and contact data, authentication and role data, financial and operational records, bank account references and transaction data, settlement and approval records, ledger and reporting data, project/department data, counterparty data, support communications and activity logs.

Special categories of data: The services are not intended for special categories of personal data or criminal conviction data. The Customer should not submit such data unless it has a lawful basis and appropriate safeguards.

Annex B — Technical and organizational measures

The measures are described in Security and Technical Organisational Measures.

Annex C — Subprocessors

The current subprocessors, including Vercel, Hostinger and the payment provider used for the relevant purchase, are described in Subprocessors.