Data Processing Addendum
Last updated 17 October 2026
For business customers who share personal data through Slingdrop: how we process it on your behalf, as required by Article 28 of the GDPR and the UK GDPR.
1. Roles
When you (the customer) upload content that contains personal data and share it through Slingdrop, you are the controller and Sansa Group AB is your processor. For account data, billing and security logs, Sansa Group AB is a controller under our Privacy Policy.
2. Instructions
We process customer personal data only to provide Slingdrop as described in the Terms and your settings (storing, converting, previewing, delivering, analysing views and, when you or your recipients use them, AI features), or as required by law. We'll tell you if we believe an instruction breaks data protection law.
3. Confidentiality and security
Everyone with access is bound by confidentiality. We apply the measures described on our Security page, including encryption in transit and at rest, isolation of user content on a separate domain, access control with single sign-on for staff tools, malware scanning, audit logging and, for Vault drops, end-to-end encryption that we can't read.
4. Subprocessors
You authorise the subprocessors listed on our Subprocessors page. We'll give at least 30 days' notice of new subprocessors that handle customer content, and you may object on reasonable grounds; if we can't resolve it, you may end the affected service. We impose equivalent data protection obligations on each subprocessor and remain responsible for them.
5. Data subject requests
Our tools let you access, export, correct and delete content. If we receive a request about your content, we'll pass it to you and help you respond.
6. Personal data breaches
We'll notify you without undue delay, and where feasible within 48 hours, after becoming aware of a breach affecting customer personal data, with the information you need for your own notifications.
7. Deletion and return
Content is deleted when drops expire or are deleted (Trash keeps it for up to 30 days), and within 30 days after account deletion, except where the law requires us to keep it, for example evidence of child sexual abuse material. You can export your data at any time in Settings.
8. Audits
We'll make available the information needed to demonstrate compliance with this addendum, including summaries of third-party security assessments, and allow reasonable audits once a year with 30 days' notice.
9. International transfers
Where customer personal data leaves the EU/EEA, Switzerland or the UK, the EU standard contractual clauses (module two or three, as applicable) and the UK addendum are incorporated by reference.
10. Governing law
This addendum is governed by Swedish law, and disputes are decided by the Swedish courts, with Gothenburg District Court (Göteborgs tingsrätt) as the first instance. The standard contractual clauses incorporated in section 9 are governed by the law of Sweden as well, where the clauses allow it. Our lead supervisory authority is the Swedish Authority for Privacy Protection (IMY).
11. Accepting this addendum
This addendum forms part of the Terms for business customers and is entered into with Sansavision, a division of Sansa Group AB, a limited company registered in Sweden (organisation number 559111-9507). If you need a countersigned copy, email support@slingdrop.my.