For business customers whose use of SailWP involves processing personal data on behalf of third parties (e.g. their site visitors or end users). Forms part of the SailWP Terms of Service under GDPR Art. 28.
If you use SailWP in the course of business and your site processes personal data of third parties (visitors, leads, customers), you are the data controller and SailWP is your processor under GDPR Art. 28. This page is the binding processor agreement.
It describes what we process, how, the security we apply, our sub-processors, our breach-notification commitment, and your audit rights. By using the SailWP Service in a business context you accept this DPA.
This Data Processing Agreement ("DPA") is entered into between:
This DPA forms an integral part of the Terms of Service. In case of conflict between this DPA and the Terms of Service regarding processing of personal data, this DPA prevails.
Once SailWP transfers operations to a holding/BV (in formation), this DPA will be assigned to that entity in accordance with Section 16.4 of the Terms of Service. The processor obligations under GDPR Art. 28 will continue without interruption.
This DPA applies to processing of personal data by SailWP on behalf of the Controller in connection with the Service (theme, plugin, cloud dashboard, AI Co-pilot, sailwp.com, app.sailwp.com).
It does not apply to processing where SailWP acts as a controller in its own right (e.g. account-holder data covered by the Privacy Policy).
SailWP will process personal data only on the documented instructions of the Controller, except where required to do so by EU or Member-State law. The instructions are:
If SailWP believes an instruction violates GDPR or other applicable data-protection law, we will notify the Controller without undue delay.
Storage, transmission, AI-assisted analysis and editing of WordPress page content; transactional emailing; backup; sub-processor hand-off (e.g. to AI providers).
For the duration of the Service contract plus retention periods set out in the Privacy Policy.
Controller agrees not to upload, paste, or otherwise transmit special-category data (Art. 9 GDPR — health, political opinions, biometric, religious beliefs, sexual orientation, etc.) through the Service. SailWP is not configured to process such categories with the elevated safeguards required by Art. 9.
The Controller authorises SailWP to engage the following sub-processors in connection with the Service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic, PBC | AI model inference | USA |
| Stripe Payments Europe Ltd. | Payment, invoicing, VAT | Ireland (EEA) + USA |
| Resend, Inc. | Transactional email | USA |
| mijn.host (Hostnet B.V.) | VPS hosting (database + servers) | Netherlands (EEA) |
| Cloudflare, Inc. | DNS, edge proxy, DDoS protection | USA HQ / global edge |
| Google LLC (Nano Banana Pro) | AI image generation | USA |
SailWP has data-processing agreements in place with each sub-processor that incorporate GDPR Art. 28 obligations and, where applicable, the EU Standard Contractual Clauses for international transfers.
New sub-processors: SailWP will publish a notice on this page at least 30 days before adding or replacing a sub-processor that processes personal data. The Controller may object to the change within 30 days of the notice. If a reasonable objection cannot be resolved, the Controller may terminate the affected portion of the Service with prorated refund of any unused prepaid period.
SailWP implements appropriate measures pursuant to GDPR Art. 32, including:
Measures are reviewed periodically and updated to reflect best practices and the state of the art at proportionate cost.
If SailWP becomes aware of a personal-data breach affecting Controller data, SailWP will:
The notification by SailWP does not constitute an admission of fault or liability.
Taking into account the nature of processing and the information available, SailWP will assist the Controller in fulfilling obligations under GDPR Art. 32–36 and in responding to data-subject requests (Art. 12–22).
To enable the Controller to verify compliance with this DPA, SailWP will:
The Controller will give SailWP at least 30 days' prior written notice of an audit, except in the case of a confirmed breach. Audits will take place during normal business hours, will not unreasonably interfere with SailWP's operations, will be conducted under reasonable confidentiality obligations, and will not exceed once per calendar year unless required by law or following a confirmed breach.
The Controller bears its own audit costs and SailWP's reasonable costs for participation. SailWP may offer to satisfy audit obligations by providing third-party audit reports, security questionnaires, or written attestations where these reasonably address the Controller's audit objectives.
Where personal data is transferred to a country outside the EEA that does not benefit from an adequacy decision under Art. 45 GDPR, SailWP and the relevant sub-processor have entered into the EU Standard Contractual Clauses per Commission Implementing Decision 2021/914, including the supplementary measures (where applicable) required by the Schrems II ruling and EDPB Recommendations 01/2020.
For transfers to the United States, SailWP relies on the SCCs as the primary transfer mechanism. Where the recipient has self-certified under the EU-U.S. Data Privacy Framework (Art. 45 adequacy decision of 10 July 2023), SailWP relies on that framework as an additional safeguard.
The Controller mandates SailWP to enter into the SCCs on the Controller's behalf with sub-processors as needed to enable lawful transfers.
This DPA enters into force when the Controller starts using the Service in a business context and remains in force for the duration of the Service contract.
On termination of the Service contract, SailWP will, at the Controller's choice:
except where retention is required by Union or Member-State law (e.g. tax records under Dutch law). Sub-processor data is deleted in accordance with the sub-processor's own retention schedule, set out in their respective DPAs.
Backups containing personal data are deleted on the rolling 14-day backup cycle following termination.
The liability cap and exclusions of damages set out in Sections 10 and 11 of the Terms of Service apply to claims arising under this DPA, except to the extent that such limitations are not permitted under Art. 82 GDPR.
Each party is responsible for paying any administrative fine imposed on it by a supervisory authority, unless and to the extent the fine results from the other party's breach of this DPA, in which case the other party indemnifies the affected party for the fine, subject to the cap referenced above.
This DPA is governed by the laws of the Netherlands. Disputes are subject to the exclusive jurisdiction of the competent court in Rotterdam, the Netherlands, except where mandatory consumer or data-protection rules give a party a different right.
Last updated: 30 April 2026 · Version 1.0 · Operated by 31 Ventures (KvK 81019556) · Privacy · Terms