THE SMALL PRINT

Data processing agreement

Last updated: 26 October 2026

Draft for legal review — not yet in force.

This agreement is part of our terms. It covers the personal data UnveilPage AB (under formation), a company being registered in Sweden (“UnveilPage”, “we”), processes for you (the customer, “you”) when you share pages and documents, as required by Article 28 of the EU General Data Protection Regulation (GDPR). You are the controller of that data, and we are your processor.

What we process, and why

• Purpose: to provide UnveilPage to you: serving the pages and documents you share, showing you how they’re opened and answered, collecting signatures, and the emails you ask us to send.
• People: the people you share pages and documents with, people they forward links to, signers, and people named in what you upload.
• Data: names, email addresses and anything else you add for them; visit records (time, approximate location, device, network provider, salted hashes of IP addresses); with the visitor’s consent, reading activity and a per-link cookie; comments and approvals; signatures and signing records, including IP addresses at the signing steps; and anything in the files you upload.
• How long: for as long as you use UnveilPage, and as described under “How long we keep it” in our privacy policy.

What we promise

• Your instructions. We process this data only to provide the service as you set it up, and on your other documented instructions, unless the law requires otherwise (we’ll tell you first, if the law allows). These terms and your settings are your instructions.
• Confidentiality. Everyone at UnveilPage who can access it is bound to keep it confidential. Our admin tools show staff accounts, counts and sizes, never your content, and every look is logged for you to see.
• Security. We protect it with appropriate technical and organisational measures (GDPR Article 32), including: encryption in transit; documents for signature encrypted with a key per document; no raw IP addresses for visits (salted hashes instead); shared pages run in a browser sandbox; sign-in by Google or one-time codes, with no passwords stored; and access to the systems limited to the people who run UnveilPage.
• Sub-processors. You allow us to use the sub-processors listed below. We give at least 30 days’ notice on this page and by email to workspace owners before adding or replacing one, and you can object; if we can’t resolve it, you can end the agreement. Each sub-processor is bound by data protection terms at least as protective as these, and we remain responsible for them.
• Transfers. Your data is stored in the EU. Where a sub-processor handles it outside the EU or EEA, the transfer relies on the EU–US Data Privacy Framework or the EU’s Standard Contractual Clauses.
• Helping you. We help you answer people’s requests to use their rights (access, correction, deletion, objection) and, where needed, with security, data protection impact assessments and consultations with authorities, taking into account what we know about the processing.
• Breaches. We tell you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting your data, with what we know and what we’re doing about it.
• At the end. When you delete your workspace in Settings, its data is deleted at once and drops out of our backups within 30 days, except what the law requires us to keep. You can download everything in Settings first.
• Proof. We give you the information you need to show we meet these obligations, and allow and help with reasonable audits, on reasonable notice and at most once a year unless a breach or an authority calls for more.

What you promise

You have a lawful basis for sharing the data with us and for what you ask us to do with it, you tell the people concerned where the law requires it, and your instructions follow the law. We’ll tell you if we think an instruction breaks the GDPR.

Sub-processors

• Cloudflare, Inc. (United States): hosting, network and security; the database and file storage, kept in the EU; turning documents into PDFs and page images (Browser Run); the sign-in check (Turnstile). EU–US Data Privacy Framework and Standard Contractual Clauses.
• Resend, Inc. (United States): delivering emails (links you send, signing requests and codes, alerts). EU–US Data Privacy Framework and Standard Contractual Clauses.
• Google LLC (United States): Sign in with Google, for customers who choose it. Customer account data only.

General

Liability under this agreement follows the terms. Swedish law applies, and disputes go to the Stockholm District Court (Stockholms tingsrätt). If this agreement and the terms disagree about personal data, this agreement wins. Questions: privacy@unveilpage.com.