Legal & trust
Data Processing Addendum
A proposed processing framework for future hosted business services. Local-only use does not upload your workspace.
Last updated 3 November 2026
Availability and scope
Hosted customer-workspace processing is not active in this development build. This page describes the proposed framework and is not an executed processing agreement or permission to upload personal data. Before using a hosted business service for customer personal data, contact support@sansavision.com for an applicable completed agreement and processing schedule.
1. Roles and documented instructions
For an agreed hosted service, the business customer determines the purposes and means of customer-content processing and Sansa Group AB acts as processor on documented instructions. We remain controller for our own website, support, security and commercial records. Instructions must identify the service, processing duration, purposes, categories of people and personal data. A local database that is never sent to us is outside hosted processing.
2. Confidentiality and security
An executed agreement must bind authorised personnel to confidentiality and define risk-appropriate technical and organisational measures, including access controls, transport protection, incident handling, backups and deletion. Planned end-to-end sync encryption is not a certification that it is implemented. Our Security page describes current controls and limitations.
3. Subprocessors and international transfers
The agreement must identify authorised subprocessors and provide advance notice of changes, a reasonable opportunity to object, equivalent contractual protections and a resolution route for unresolved objections. Transfers must use an applicable lawful mechanism; where standard contractual clauses are needed, the correct modules, parties, annexes and measures must be completed. This preview does not purport to execute incomplete clauses.
4. Assistance, incidents and audits
The agreement must address help with data-subject requests, risk assessments and regulatory enquiries; notification without undue delay after becoming aware of a personal data breach; information to demonstrate compliance; and reasonable audit rights. We must inform the customer if an instruction appears to breach applicable data protection law.
5. Return, deletion and schedule
Before processing starts, the parties must agree on export and return formats, termination and deletion periods, backup expiry, legal-retention exceptions, points of contact, service locations and security measures. Paywall end-user event data, if introduced, requires its own specific processing schedule. Do not send an end-user dataset to support to request this agreement.