Legal

Data Processing Addendum

Get Safe Now LLC, doing business as KeepSealed · Last updated October 8, 2026

This Addendum sets out how we process the personal data a firm puts into KeepSealed. It applies to every firm. Section 5 applies where UK data protection law applies to the firm’s processing.

This Addendum is part of our Terms. Words defined in the Terms have the same meaning here. Where this Addendum and the Terms differ, this Addendum applies. It continues for as long as we hold client personal data. In it:

• “UK data protection law” means the UK GDPR and the Data Protection Act 2018.
• “Client personal data” means the personal data we process for the firm in providing KeepSealed: the details of the firm’s clients, the documents and case information the firm and its clients put into KeepSealed, and the parts of the activity record about clients.
• “Controller”, “processor”, “personal data”, “personal data breach”, “data subject” and “supervisory authority” have the meanings given in UK data protection law.

1. Roles

For client personal data, the firm is the controller and Get Safe Now LLC is the processor. Each of us complies with the data protection law that applies to it in that role. The firm is responsible for having a lawful basis for the client personal data it puts into KeepSealed and for telling its clients about it. Information about the firm itself and its staff, which we use to run and bill for the service, is covered by our Privacy Policy.

2. What we process

• Subject matter and purpose: providing KeepSealed to the firm: storing and delivering documents, signing in the firm’s clients, sending them invitations and sign-in codes, and keeping the activity record.
• Nature of the processing: collection, recording, storage, organization, transmission, retrieval, use and deletion. Documents, file names, file types, folder names, case names and request titles are encrypted on the devices of the people who use KeepSealed before they are uploaded, and we have no way to open them.
• Data subjects: the firm’s clients, and anyone named in documents the firm or its clients upload.
• Types of personal data: clients’ names, email addresses and mobile numbers; their devices, sign-ins, IP addresses and activity in KeepSealed; records of the emails and texts we send them; information about documents that is not encrypted (who uploaded what and when, approximate sizes and due dates); and the encrypted contents of documents, which may include any kind of personal data, including special category data and criminal offence data.
• Duration: while the firm uses KeepSealed, and then until deletion under section 7 of the Terms.

3. Our commitments

We:

• Follow the firm’s instructions. We process client personal data only on the firm’s documented instructions, including about transfers outside the UK, which the firm authorizes as described in sections 4 and 5. The Terms, this Addendum and the firm’s use of KeepSealed’s settings are those instructions. If the law requires other processing, we tell the firm first, unless the law prohibits it. We tell the firm immediately if we believe an instruction breaks data protection law.
• Keep it confidential. Everyone we authorize to process client personal data is bound by a duty of confidentiality.
• Keep it secure. We maintain the security measures in section 8, and keep them under review.
• Use sub-processors only as set out in section 4.
• Help with data subjects’ requests. The firm can view, correct and export client details and documents in KeepSealed itself. If a data subject contacts us directly, we pass the request to the firm, and we help the firm respond where it needs more.
• Help with the firm’s other duties under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to us.
• Notify breaches. We tell the firm without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting client personal data. We include what we know of the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed, and keep the firm updated as we learn more.
• Delete at the end. Because documents are encrypted on the firm’s devices, the firm takes its data back by exporting it, which it can do at any time while it has access, including the 30 days after its subscription ends. The firm instructs us to keep its account for the periods in section 7 of the Terms, so it can export or restart, and then to delete client personal data; it can instead instruct earlier deletion. On request, we confirm in writing when deletion is complete. Where the law requires us to keep any of it, we keep protecting it under this Addendum and use it for nothing else. The firm’s name and billing history, which we keep under section 7 of the Terms, contain no client personal data.
• Show our compliance. We make available all the information necessary to show that we meet these commitments, and answer the firm’s reasonable written questions. Where that is not enough, after a personal data breach affecting the firm, or where a regulator requires it, the firm or an independent auditor it appoints (bound by confidentiality, and not our competitor) may audit our compliance, including by inspection, on 30 days’ notice (shorter after a breach or where a regulator requires), normally no more than once a year, at the firm’s cost. Hosting facilities are audited through our providers’ own published reports.
• Work with the firm’s regulators. We allow the firm’s regulators, such as the Information Commissioner’s Office or the Solicitors Regulation Authority, or their agents, to obtain information from us and inspect our records relating to the firm, at the firm’s request or with notice to the firm. Documents are encrypted, so we can provide only their encrypted form and the information about them listed in section 2.

4. Sub-processors

The firm authorizes us to use the sub-processors listed below. We give each of them data protection obligations that give client personal data substantially the same protection as this Addendum, and we remain fully liable to the firm for their performance of those obligations.

• Contabo Inc., United States: hosting of our servers, including our database and mail server.
• Cloudflare, Inc., United States: carrying traffic to and from KeepSealed, and storing encrypted documents and our encrypted database backups. Cloudflare may process data in the countries where its network operates.
• Twilio Inc., United States: delivering sign-in codes to clients’ mobile numbers by text.

These providers also help us run KeepSealed, but handle information about the firm and its staff only, never client personal data:

• Stripe, Inc., United States: taking the firm’s payments.
• Google, Apple, Mozilla and Microsoft: delivering browser notifications to staff who turn them on.

We email firm administrators at least 30 days before we add or replace a sub-processor. If the firm objects on reasonable data protection grounds and we cannot resolve the objection, the firm may end its subscription, and we refund any fees paid for time after it ends.

Our own personnel who run the service, some of whom are in Canada, may also access client personal data, only to do that work and under the same duty of confidentiality.

5. Transfers outside the United Kingdom

We are based in the United States, so client personal data is transferred there. For that transfer, the firm and Get Safe Now LLC agree to the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner’s Office under section 119A of the Data Protection Act 2018 (version B1.0, as amended from time to time), which is incorporated into this Addendum, together with Module Two (controller to processor) of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914. They are completed as follows:

• Start date: the date the firm accepts the Terms or, if later, the date this Addendum was first published.
• Parties: the firm, as data exporter and controller; Get Safe Now LLC, doing business as KeepSealed, a Wyoming limited liability company, 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801, United States, as data importer and processor. The contact details are those in the firm’s account and in section 9.
• Clause 7 (docking clause): does not apply.
• Clause 9 (sub-processors): Option 2, general written authorization, with 30 days’ notice of changes, as in section 4.
• Clause 11 (redress): the optional language does not apply.
• Annex I: the parties are as above; the description of the transfer is section 2; transfers are continuous; the competent supervisory authority is the Information Commissioner’s Office.
• Annex II: the security measures in section 8.
• Annex III: the sub-processors in section 4.
• Ending the Addendum when the ICO changes it: neither party.

Section 15 of the Terms does not apply to disputes under these transfer terms, which are governed and resolved as Clauses 17 and 18, as amended by the ICO’s Addendum, provide. We give the firm the information it reasonably needs for its transfer risk assessment, including about the US laws on government access to data. If Get Safe Now LLC becomes certified under the UK Extension to the EU-US Data Privacy Framework, we may rely on that certification instead, and will tell firms if we do.

6. Firms in the United States

Where a US state privacy law applies to client personal data, we act as the firm’s service provider or processor. We do not sell or share it, and we do not keep, use or disclose it for any purpose other than providing KeepSealed to the firm, or outside our direct business relationship with the firm, or combine it with personal data from other sources, except as those laws allow. We comply with those laws and give the data the protection they require; we tell the firm if we can no longer meet these obligations; the firm may take reasonable steps to make sure we use the data as these terms require, and to stop and remedy any unauthorized use; we bind our sub-processors to terms that give substantially the same protection; and we help the firm respond to consumers’ requests.

7. Liability

Our liability to the firm under this Addendum is subject to section 13 of the Terms. Nothing in the Terms limits any liability we have to data subjects, including under Article 82 of the UK GDPR or Clause 12 of the Standard Contractual Clauses, or any liability that data protection law does not allow to be limited. Sections 12 and 16 of the Terms do not limit our responsibility for our sub-processors under section 4.

8. Security measures

• Documents, file names, file types, folder names, case names and request titles are encrypted on the devices of the people who use KeepSealed before they are uploaded. We store them only in encrypted form. Opening a document needs information held on the person’s own device.
• Files are stored at standard sizes, so their real size stays hidden.
• Connections to KeepSealed, and between our servers and our providers, are encrypted (TLS). Emails are encrypted in transit where the recipient’s mail server supports it. Text messages contain only a sign-in code.
• Staff sign in with a strong password; clients sign in with a one-time code sent to their mobile. Sign-in attempts are rate limited, and repeated wrong codes pause sign-in.
• Each firm’s documents are kept in storage set aside for that firm.
• Administrative access to the servers that run KeepSealed is limited to the personnel who run the service. Password sign-in over the network is turned off, and sign-ins are logged. A firewall lets web traffic reach them only through Cloudflare.
• Sign-ins, and document uploads, opens and downloads through KeepSealed, are recorded in the firm’s activity record. While the firm’s account exists, nothing in KeepSealed lets anyone edit or delete an entry.
• Our database is backed up nightly. Backups are encrypted and kept for up to 30 days. Logs on the servers that run KeepSealed are kept for up to 14 days, with sign-in links and secrets removed.
• Operating-system security updates install automatically.
• Our providers’ own security measures, including the physical security of their data centers, are described in their published reports.

9. Changes and contact

We will not change this Addendum in a way that reduces the protection it gives client personal data, and we keep dated earlier versions available on request.

Get Safe Now LLC, doing business as KeepSealed
1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801
support@keepsealed.com