Data Processing Agreement

1 Roles and scope

This agreement is part of the Terms of Service between you (the controller) and Up Strategy Lab AB (the processor). It covers personal data contained in documents you upload to Paradraw, and nothing else.

Definitions follow the General Data Protection Regulation (GDPR).

2 Instructions

We process the data only on your documented instructions. Using Paradraw — uploading, reading, revising, exporting and deleting documents — is your instruction. If we believe an instruction breaks data protection law, we tell you.

3 What is processed

• Subject matter and purpose: storing and analysing your legal documents, and producing drawings, suggested changes, revisions and exports of them.
• Duration: until you delete the documents or close your account, and then as in section 10 of the Terms.
• Personal data: whatever your documents contain — typically names, job titles and contact details of people named in contracts and policies.
• Data subjects: people named in your documents.
• Special categories: none are expected. Do not upload documents whose purpose is to hold them.

4 Confidentiality

Everyone at Up Strategy Lab who can access your documents is bound to keep them confidential.

5 Security measures

• Data is stored and processed in Stockholm, Sweden, encrypted in transit and at rest.
• Uploaded documents are private to your account; every request that reads them checks it is yours.
• Passwords are stored as salted hashes; password-reset links are single-use, stored only as a hash, and expire after 30 minutes.
• Access to production systems is limited to the people who run Paradraw.

6 Sub-processors

You authorise the sub-processors listed on the sub-processors page as handling uploaded documents. We give each of them data protection obligations no weaker than these, and remain responsible for them.

We tell you of a new sub-processor at least 30 days before it starts, as in section 15 of the Terms. You can object; if we cannot address the objection, you can close your account and we refund fees paid for the time after the change.

7 Transfers outside the EU/EEA

Some sub-processors are in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the Standard Contractual Clauses (Commission Decision 2021/914, module 3), which are incorporated here for that purpose. Uploaded documents are never sent to a provider in China.

8 Helping you

We help you answer requests from data subjects, and with impact assessments and consultations with authorities, as far as the service allows. Most of it you can do yourself: every uploaded document can be viewed, exported and deleted from your workspace.

9 Personal data breaches

We tell you of a personal data breach affecting your documents without undue delay, and within 72 hours at the latest — the same period as in section 11 of the Terms — with what we know and what we are doing about it.

10 Deletion and return

When the agreement ends, you can export your documents; we then delete them as in section 10 of the Terms, unless the law requires us to keep them.

11 Audits

We give you the information you need to show compliance with Article 28 GDPR. You may audit us, or have an independent auditor do so, once a year with 30 days’ notice, at your cost, without access to other customers’ data.

12 Everything else

Liability, governing law, disputes and changes are as in the Terms of Service (sections 12, 14 and 15). This agreement adds nothing to them and does not replace them.