Data processing agreement
How Morgan Jonasson Consulting AB processes the personal data in your team's content for you, under Article 28 of the GDPR.
Last updated 21 October 2026.
1. Parties and how this binds
This agreement is between the customer that accepts the Terms of service for Spool Cloud (the controller, "you") and Morgan Jonasson Consulting AB, organisation number 556991-2321, c/o Morgan Jonasson, Kopernikus Väg 6, 147 46 Tumba, Sweden (the processor, "we"). It is part of the Terms and binds both of us when you accept them, with no signature needed. If you want a countersigned copy, ask at privacy@spool.page.
It follows the standard contractual clauses between controllers and processors that the European Commission adopted in Implementing Decision (EU) 2021/915. Where this agreement and the Terms differ on personal data, this agreement wins.
2. Who is controller of what
- Team content. For personal data in what your team puts into Spool Cloud (files, frames, comments on them and shares of them), you are the controller and we are your processor. This agreement covers that data.
- Accounts, billing and usage. For the data we need to run accounts, sign-in, teams' membership, billing, security and the website, we are an independent controller, not a joint controller, and our Privacy notice applies instead.
3. The processing
| Subject matter and purpose | Hosting, syncing, compiling, displaying, sharing, keeping the history of and backing up your team's content, so that Spool Cloud works for your team and the people it shares with. |
|---|---|
| Nature | Storage, transmission, copying, display and deletion, by automated means. |
| Data subjects | Anyone whose personal data you put into team content: your staff, your clients and their customers, people shown in mockups or test data, and people who comment on shares. |
| Types of personal data | Whatever your content contains: typically names, email addresses, images and text. Spool Cloud is not made for special categories of data (Article 9 GDPR); don't put them in team content. |
| Duration | For as long as the Terms run, and then until the data is deleted under section 10. Saves are kept for 90 days and backups for 30 days. |
4. Your instructions
We process the data only on your documented instructions. The Terms, your team's settings and what your members do in Spool Cloud are those instructions. We tell you at once if we think an instruction breaks data protection law. If EU or Swedish law requires us to process the data otherwise, we tell you first, unless that law forbids it.
5. Confidentiality
Only people who need access to run Spool Cloud get it, and each is bound to confidentiality. We don't look at your content except to provide the service, to keep it secure, to act on a notice of illegal content, or when you ask us to.
6. Security
We take the technical and organisational measures Article 32 GDPR requires (Annex III), including:
- encryption of data in transit (TLS) and at rest by our hosting provider;
- frame code from your content runs only on a separate domain (onspool.page), never on spool.page, where accounts live;
- access to a team's content only for its members and the people it shares with, checked on every request;
- sign-in by emailed one-time codes, Google or passkeys, with no passwords stored;
- access to production systems limited to the people who run Spool Cloud;
- daily backups, kept 30 days, so data can be restored after a failure.
7. Subprocessors
You give us general authorisation to use subprocessors. The ones we use, what each does, which data and where, are listed on Subprocessors. Before we add or replace one, we tell your team's admins by email at least 30 days ahead and update that page. You may object on reasonable data-protection grounds within that time; if we can't meet the objection, you may end the Terms and we refund the unused part of any payment.
We bind every subprocessor by contract to the same data protection obligations as this agreement, and we remain responsible to you for its work.
8. Transfers outside the EU
Some subprocessors are established in the United States. We transfer personal data there only with a safeguard under Chapter V GDPR: the EU-US Data Privacy Framework where the subprocessor is certified, and otherwise the Commission's standard contractual clauses (Decision (EU) 2021/914). If the Data Privacy Framework stops applying, the standard contractual clauses apply in its place.
9. Helping you
- People's requests. We help you answer requests from data subjects to access, correct, delete or move their data. If one reaches us, we pass it to you and don't answer it ourselves.
- Breaches. We tell you without undue delay after becoming aware of a personal data breach affecting your data, with what we know and what we are doing, and keep you informed.
- Assessments. We give you the information you need for a data protection impact assessment or a consultation with a supervisory authority.
- Audits. We give you the information needed to show we meet this agreement, and allow an audit by you or an auditor you appoint, bound to confidentiality, once a year or after a breach, on reasonable notice and at your cost.
10. At the end
When the Terms end, your admins can export your content for 30 days after a team is deleted and 6 months after it lapses, as the Terms describe. Then we delete it, and backups roll off within 30 days, unless EU or Swedish law requires us to keep it.
11. Liability and contact
Liability under this agreement follows Article 82 GDPR and the Terms. Write about this agreement to privacy@spool.page.