Last updated: 29 May 2026
1. Parties and scope
This Data Processing Addendum forms part of the agreement between CREA SPACE LTD and the customer using Sitewrap. It applies where Sitewrap processes personal data on behalf of the customer in connection with the service.
For customer website data, the customer is generally the controller and CREA SPACE LTD is generally the processor. For Sitewrap account, billing, security, and business operations data, CREA SPACE LTD may act as an independent controller.
2. Subject matter and duration
The subject matter is the processing of personal data required to provide Sitewrap's edge website operations platform, including proxying, caching, analytics, deployments, security controls, A/B testing, forms, leads, recordings if enabled, support, and diagnostics.
Processing continues for the duration of the customer's use of Sitewrap and any additional retention period required for security, legal, audit, backup, or dispute-resolution purposes.
3. Categories of data
Processed data may include website visitor request metadata, IP addresses or masked IPs, user agent strings, URLs, timestamps, referrers, engagement signals, form submissions, lead information, dashboard account information, deployment metadata, security logs, audit logs, and customer configuration data.
4. Categories of data subjects
Data subjects may include customer personnel, dashboard users, website visitors, form submitters, leads, support contacts, and individuals whose activity is reflected in operational or security logs.
5. Customer instructions
CREA SPACE LTD will process customer personal data only on documented instructions from the customer, including instructions reflected in the agreement, dashboard configuration, support requests, and customer use of Sitewrap features, unless required by law.
The customer is responsible for ensuring that its instructions are lawful and that it has appropriate notices, consents, and lawful bases for the processing.
6. Confidentiality
CREA SPACE LTD will ensure that persons authorized to process customer personal data are subject to appropriate confidentiality obligations or professional duties of confidentiality.
7. Security measures
CREA SPACE LTD uses technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and accidental loss, destruction, or damage.
Measures may include access controls, secure authentication, encrypted transport where applicable, tenant-aware storage, operational logging, audit trails, security monitoring, firewall controls, least-privilege access practices, backup or recovery procedures, and separation of customer domains and configurations.
8. Subprocessors
CREA SPACE LTD may use subprocessors to provide hosting, storage, email, analytics, monitoring, payments, support, and related infrastructure. Subprocessors will be engaged under terms designed to protect personal data.
Customers may contact Sitewrap for information about current subprocessors where required for compliance or procurement review.
9. International transfers
Where personal data is transferred internationally, CREA SPACE LTD will use appropriate safeguards where required by applicable data protection law, such as contractual transfer mechanisms or other recognized safeguards.
10. Assistance
Taking into account the nature of processing and the information available to us, CREA SPACE LTD will provide reasonable assistance to customers with data-subject requests, security obligations, data protection impact assessments, and regulator consultations where required by applicable law.
11. Personal data breach
CREA SPACE LTD will notify affected customers without undue delay after becoming aware of a personal data breach involving customer personal data, where notification is required by applicable law. The notification will include available information reasonably necessary for the customer to meet its own obligations.
12. Deletion and return
At the end of the service, CREA SPACE LTD will delete or return customer personal data upon request where required and technically feasible, unless retention is required by law, security, backup, audit, or legitimate business purposes.
13. Audits and information
CREA SPACE LTD will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, and protection of other customers' data. Any audit must be reasonable, proportionate, and not disrupt the service.
14. Contact
Data processing questions can be sent through the contact page or to hello@sitewrap.io.