Data Processing Agreement for Snap9

Last updated: 2 November 2026

This is an English translation of the Swedish data processing agreement (Personuppgiftsbiträdesavtal). If they differ, the Swedish version prevails.

1. Parties and scope

This data processing agreement is entered into between:

This agreement forms part of the terms of use (section 14) and applies automatically when the Customer creates an event, orders a plan or otherwise accepts the terms. It is available here before purchase and use. It applies when Snap9 stores and processes event material on the Customer’s behalf. It does not apply to purely private use.

If this agreement and the other terms differ regarding the processing of personal data, this agreement applies.

2. Subject matter and duration

The subject matter of the processing is event material and related data uploaded to and stored in the Customer’s event in Snap9.

Processing lasts as long as the event exists in the service, that is, during the plan’s storage period (Free 14 days, Standard 180 days, Plus 365 days) or until the Customer deletes the material or the event, and thereafter until the data has been deleted under section 13.

3. Nature and purpose of the processing

Snap9 processes the personal data only to provide the service under the terms:

Snap9 does not use the material for its own purposes, for advertising or to train AI models.

4. Categories of personal data

The service is not intended for special categories of personal data under Article 9 or data relating to criminal offences under Article 10 GDPR. The Customer shall not instruct Snap9 to process such data beyond what may appear in ordinary photos from an event. The Customer is responsible for having a legal basis if such material is nevertheless uploaded.

5. Categories of data subjects

6. Instructions

Snap9 processes the personal data only on the Customer’s documented instructions. The instructions consist of this agreement, the terms and the choices the Customer makes in the service, for example creating the event, choosing a plan, sharing the link, downloading and deleting files or deleting the event.

Further instructions are given in writing to support@snap9.app. If Snap9 considers that an instruction infringes the GDPR or other data protection law, Snap9 will inform the Customer.

Snap9 may process the data without instructions where required by Union or Swedish law. Snap9 will then inform the Customer of that requirement before processing, unless the law prohibits it.

7. Confidentiality

Snap9 ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Access is only given to those who need it to run the service.

8. Security measures

Snap9 takes the technical and organisational measures required by Article 32 GDPR. The measures currently include:

Snap9 may update the measures provided that the level of protection is not reduced.

9. Sub-processors

The Customer gives Snap9 general prior authorisation to engage sub-processors. Currently engaged:

Stripe is not a sub-processor. Stripe handles payments as an independent controller and does not process event material.

Google (Gmail) is not a sub-processor and is not used to process the Customer’s event material. Support email to support@snap9.app and hello@snap9.app is forwarded via Cloudflare Email Routing to a Gmail mailbox and is not covered by this agreement; it is processed under Snap9’s privacy policy. The service never sends event material to support by email: a report forwarded to support contains only a direct link to the reported material in the service, not the file, the event’s name or the reporter’s text. The Customer should not send event material or personal data about guests in support email but refer to the material with a link.

Snap9 gives notice of planned changes of sub-processors by updating this page at least 14 days before the change takes effect. The Customer can object to the change by contacting support@snap9.app; if the parties cannot agree, the Customer can delete the event. Snap9 imposes equivalent data protection obligations on sub-processors and remains liable to the Customer for their performance.

10. Transfers to third countries

Cloudflare, Inc. is a US company and data may be processed in the USA and other countries. Transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework (Cloudflare is certified) and the European Commission’s Standard Contractual Clauses in Cloudflare’s Data Processing Addendum.

11. Assistance to the Customer

Taking into account the nature of the processing and the information available to Snap9, Snap9 assists the Customer in:

12. Personal data breaches

Snap9 notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data. The notification contains, to the extent known, the information set out in Article 33(3) GDPR and may be provided in phases.

13. Deletion and return

During the storage period the Customer can download all material, including as a ZIP file. This is how the material is returned.

When the Customer deletes a file or an event, the material is removed from active storage immediately. When the storage period ends, access ends and the material is deleted in the next nightly cleanup, normally within one day. The database’s automatic restore points are overwritten within 30 days; uploaded files have no backups. Data that Snap9 needs to keep as a controller, for example accounting records of the purchase, is covered by the privacy policy.

14. Audits

Snap9 makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, including this agreement and the privacy policy.

The Customer, or an independent auditor appointed by the Customer and bound by confidentiality, may carry out audits. An audit must be requested in writing at least 30 days in advance, be carried out without undue disruption to the service and at the Customer’s expense, and take place at most once a year unless an incident or a supervisory authority justifies otherwise. For Cloudflare’s infrastructure, Snap9 may refer to Cloudflare’s own audit reports and certifications.

15. Liability

Liability is governed by Article 82 GDPR and section 11 of the terms. Limitations of liability do not apply to the extent they cannot be limited by law.

16. Term and changes

This agreement applies as long as Snap9 processes personal data on the Customer’s behalf. Changes are made in the same way as changes to the terms (section 12) and do not affect the Customer’s rights under the GDPR.