Widgets Pricing Tutorials Blog Log In

Data Processing Agreement

The Legal Stuff

Effective date: October 28, 2026

This Data Processing Agreement ("DPA") is part of the agreement between Espresso Dev (Pty) Ltd, which operates SnapWidget ("SnapWidget", "Processor", "we", "us"), and the customer that uses SnapWidget ("Customer", "Controller", "you") under our Terms of Service (the "Agreement"). It governs how we process personal data for you when you use SnapWidget.

This DPA takes effect when you accept the Agreement or start to use the services, and applies for as long as we process personal data for you. You do not have to sign it. A counter-signed copy is available on request from support@snapwidget.com. If this DPA and the rest of the Agreement conflict on data protection, this DPA prevails.

1. Definitions

  • "Data Protection Laws" means all laws that apply to the processing of personal data under the Agreement, including the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018 ("UK GDPR"), and South Africa's Protection of Personal Information Act ("POPIA").
  • "Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Supervisory Authority" have the meanings given in the GDPR.
  • "Customer Personal Data" means the personal data that we process for you under the Agreement, as described in Annex I.
  • "Subprocessor" means a third party that we engage to process Customer Personal Data.
  • "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries in European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
  • "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

2. Roles and scope

For Customer Personal Data, you are the Controller and we are the Processor. If you act as a processor for another controller, we are your subprocessor, and this DPA applies in the same way.

This DPA does not cover the personal data of your account users (for example your name, email address and billing details) or of visitors to snapwidget.com. We are the controller of that data, and our Privacy Policy describes how we handle it.

We process Customer Personal Data only to provide the services, and only on your documented instructions. Your instructions include the accounts you connect, the review sources you add and the settings you choose for your widgets. Your use of the services and this DPA are your complete instructions. If the law requires us to process Customer Personal Data in another way, we tell you first, unless the law prohibits it.

Annex I sets out the subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects.

3. Our obligations as Processor

We will:

  1. Process Customer Personal Data only on your documented instructions, including for transfers, unless the law requires otherwise.
  2. Make sure that everyone we authorise to process Customer Personal Data is bound by confidentiality.
  3. Use appropriate technical and organisational measures to protect Customer Personal Data, as described in Annex II and as required by Article 32 of the GDPR.
  4. Follow the conditions in Section 5 for engaging Subprocessors.
  5. Help you respond to requests from data subjects (Section 6), as far as the nature of the processing allows.
  6. Help you meet your obligations under Articles 32 to 36 of the GDPR, using the information available to us.
  7. At your choice, delete or return Customer Personal Data at the end of the services, as described in Section 9.
  8. Make available the information needed to show compliance with this DPA, and allow for and contribute to audits as described in Section 8.

We tell you if, in our opinion, an instruction infringes Data Protection Laws.

We do not sell Customer Personal Data, and we do not use it to train AI models.

4. Your obligations as Controller

You will:

  1. Meet your obligations as a Controller under Data Protection Laws, including having a lawful basis to process Customer Personal Data and to give it to us.
  2. Give instructions that are lawful and consistent with Data Protection Laws.
  3. Be responsible for the accuracy, quality and legality of Customer Personal Data and how you got it, including the posts, hashtags and reviews that you choose to show in your widgets.
  4. Give any required notices to, and get any required consents from, your data subjects, including the visitors of the websites where you put your widgets.

5. Subprocessors

You give us general authorisation to engage Subprocessors to process Customer Personal Data. Our current Subprocessors, their purpose and location, and the safeguard for any international transfer, are listed in our Trust Center.

We will:

  • Put data protection obligations on each Subprocessor that protect the data at least as well as this DPA, including appropriate security measures.
  • Stay responsible to you for each Subprocessor's performance of its obligations.
  • Give you notice of a new or replacement Subprocessor by updating the list in our Trust Center before the change. You can object on reasonable data protection grounds within 30 days by emailing support@snapwidget.com. If we cannot resolve your objection in a reasonable way, you can end the affected services.

When you connect an account or add a review source, SnapWidget gets content from that platform (for example Instagram, Facebook, TikTok, YouTube, X, Google or G2) on your instruction. The platform handles that data under its own terms. It is not our Subprocessor for that content.

6. Data subject rights

As far as the nature of the processing allows, we help you with appropriate technical and organisational measures to respond to data subjects who use their rights under Data Protection Laws (including access, rectification, erasure, restriction, portability and objection). You can handle many requests yourself in the app. For example, you can hide a post or review in a widget, delete a widget, or remove a connected account. If a data subject sends a request to us directly about Customer Personal Data, we send them to you and do not respond, except on your instructions or where the law requires it.

7. International transfers

Where our processing of Customer Personal Data involves a transfer out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the transfer uses an appropriate safeguard:

  • For transfers to us, the Standard Contractual Clauses are incorporated into this DPA by reference. Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor. For transfers from the UK, the UK Addendum applies. For transfers subject to Swiss law, the SCCs apply with the changes that the Swiss Federal Data Protection and Information Commissioner requires. Annex I (parties and processing), Annex II (security measures) and Annex III (Subprocessors) of this DPA complete the annexes of the SCCs. Where Clause 9 of the SCCs gives options, Option 2 (general written authorisation) applies, with the notice period in Section 5.
  • For onward transfers to our Subprocessors, we rely on the safeguard shown for each Subprocessor in our Trust Center: the EU-US Data Privacy Framework, the Standard Contractual Clauses (with the UK Addendum where relevant), or an adequacy decision.

If the Standard Contractual Clauses or another transfer mechanism becomes invalid or changes, we work with you in good faith to put another safeguard in place.

8. Audits

We make available to you the information that is reasonably necessary to show compliance with this DPA. If you reasonably need more information to meet your audit obligations under Data Protection Laws, you can ask for an audit no more than once a year, with reasonable written notice, during business hours, without disrupting our operations, and subject to confidentiality.

9. Deletion or return of data

When you delete a widget, a connected account or your SnapWidget account, we delete the related Customer Personal Data as described in Annex I. When the services end, at your choice, we delete or return Customer Personal Data and delete existing copies, except where the law requires us to keep it. Copies in our database backups are deleted when those backups expire. On request, we confirm in writing that we have deleted the data.

10. Personal data breach

We notify you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach that affects Customer Personal Data. The notice describes, as far as we know them, the nature of the breach, its likely consequences, and the measures we have taken or propose. We take reasonable steps to limit the breach, and we help you meet your own obligations to notify supervisory authorities and data subjects, at no extra cost.

11. Liability and governing law

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. This DPA is governed by the law, and subject to the jurisdiction, stated in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses require otherwise. In that case, those clauses and their governing law and forum apply to the relevant transfer.

12. Contact

For questions about this DPA, or to use a right or make a request under it, email support@snapwidget.com.

Annex I: Description of the processing

A. Parties

  • Data exporter (Controller): the Customer identified in the Agreement, who uses SnapWidget.
  • Data importer (Processor): Espresso Dev (Pty) Ltd, which operates SnapWidget, a company registered in South Africa (registration number 2015/437542/07). Contact: support@snapwidget.com.

B. Description of the processing

  • Subject matter: the provision of SnapWidget, a service for showing social media posts and reviews in widgets that the Customer puts on its websites.
  • Duration: for the term of the Agreement, until the data is deleted as described in Section 9.
  • Nature and purpose: getting content from the platforms and review sources that the Customer connects or chooses; storing that content; writing image descriptions with AI when that setting is on; delivering the widgets to the visitors of the Customer's websites; and support.
  • Categories of data subjects: people whose content appears in the Customer's widgets, including the people behind the Customer's own social media accounts, other people whose posts appear (for example in hashtag widgets) and the authors of reviews and testimonials; and the visitors of websites that show the Customer's widgets.
  • Categories of personal data: for content: usernames, display names, profile pictures, profile links, posts, photos, videos, captions and dates; reviewer names, job titles, companies, photos, ratings, review text and dates; and the content of testimonials that the Customer adds. For visitors: IP address and browser details, which we use to deliver the widget and do not store.
  • Special category data: not requested by the services. Content that the Customer chooses to show can reveal such data. Any such processing is on the Customer's instruction and responsibility.
  • Frequency: continuous, for the term of the Agreement.
  • Retention: content is kept while the widget, connected account or review source exists. Cached posts are refreshed from the platforms and replaced or expire. Data is deleted as described in Section 9.

C. Competent supervisory authority

The supervisory authority of the data exporter (or of its EU or UK representative), as determined under Data Protection Laws.

Annex II: Technical and organisational measures

We keep measures that are appropriate to the risk, including:

  • Encryption: HTTPS (TLS) for all traffic to the website, the app and the widgets. The database and its backups are encrypted at rest. Passwords are stored as one-way hashes, and two-factor authentication secrets are encrypted.
  • Access control: access to production systems only for the people who run the Service, with the least access they need. Two-factor authentication is available on every customer account, and an account can only be deleted with its password.
  • Confidentiality: everyone with access to Customer Personal Data is bound by confidentiality.
  • Resilience and backups: automated daily backups and redundant servers.
  • Network and application security: a firewall, DDoS protection and regular security updates.
  • Segregation: each customer's data is linked to its account, and the app shows it only to that account.
  • Data minimisation: we do not store the IP addresses of widget visitors.
  • Monitoring and incident response: error and uptime monitoring with alerts, and the breach notice in Section 10.

Annex III: Subprocessors

The current list of Subprocessors, with each Subprocessor's purpose and location and the safeguard for any international transfer, is published and kept up to date in our Trust Center. That list is part of this DPA.