Data Processing Agreement

PowerLedger · SparkWise B.V. · Last updated: 3 August 2026

1. Parties

This Data Processing Agreement ("DPA") is entered into between SparkWise B.V. ("Data Processor") and the PowerLedger account holder ("Data Controller" / "Customer").

2. Roles

• Customer is the data controller for personal data processed through their PowerLedger account.
• SparkWise B.V. is the data processor, processing personal data on behalf of the Customer in accordance with the Terms of Service and this DPA.

3. Data Categories

Personal data processed may include:

• Account information (name, email, role)
• Usage data (watchlists, portfolios, decision logs)
• Application and subscription information
• Technical and log data

4. Processing Purposes

SparkWise B.V. processes personal data only for:

• Providing and maintaining the platform
• Processing subscription payments
• Providing customer support
• Maintaining security and preventing abuse
• Complying with legal obligations

We do not process personal data for our own commercial purposes unrelated to providing the service.

5. Sub-Processors

SparkWise B.V. engages the following sub-processors:

• Mollie — payment processing (Netherlands)
• Cloud infrastructure provider — data hosting (EU)

We ensure all sub-processors are bound by written agreements providing equivalent data protection.

6. Security Measures

We implement appropriate technical and organisational measures including:

• TLS encryption for data in transit
• Encrypted storage for API credentials
• Role-based access control
• Immutable audit logging
• Regular security reviews

7. Data Subject Rights

We assist the Customer in responding to data subject requests where technically feasible. Data subject requests should be directed to the Customer, who may contact us at office@sparkwise.nl for assistance.

8. Breach Notification

In the event of a personal data breach, we will:

• Notify the Customer without undue delay
• Provide details of the breach, measures taken, and recommendations
• Cooperate with the Customer and relevant authorities

9. Data Return and Deletion

Upon termination of the service:

• Customer data will be made available for export for 30 days
• After 30 days, personal data will be deleted
• Records required for legal compliance will be retained as per our retention policy

10. Audit Rights

The Customer has the right to audit our data processing practices, subject to reasonable notice and confidentiality agreements. Alternatively, we will provide an independent audit report upon request.

11. Governing Law

This DPA is governed by the laws of the Netherlands.

12. Contact

SparkWise B.V. Email: office@sparkwise.nl