How we handle your list’s data.

1. Parties and subject matter

This agreement is between the business that uses Waitlisted (“the Customer”, controller) and Grido AB, c/- Dockplatsen 16, 211 19 Malmö, Sweden, org. no. 559480-1945, support@waitlisted.me (“we”, processor).

We provide Waitlisted (waitlisted.me): hosted waitlist, sign-up and response pages, the dashboard to manage them, and the emails sent to people on them. When people join or respond on the Customer’s pages, we process their personal data on the Customer’s behalf. This agreement governs that processing and forms part of the Customer’s subscription. Where it conflicts with other terms, this agreement prevails on data protection.

2. Nature, purpose and duration

We store, display, organise and email personal data so the Customer can run waitlists, offer spots, collect responses and contact the people concerned. Processing lasts for the term of the Customer’s subscription and ends as described in section 3.

Data subjects: people who join a Customer’s waitlist or submit a Customer’s response page; people the Customer imports from its own lists; admins the Customer invites to help run a waitlist.

Personal data: email address; name (optional); answers to the questions the Customer asks; place in line and status (waiting, offered, accepted, out); response texts; a record of emails sent (type, subject, date); delivery status of emails (delivered, bounced, complaint); technical data needed to deliver pages (IP address, browser, time).

Special categories: none intended. The Customer must not ask for data under Art. 9 GDPR (for example health data) unless it has a legal basis and has told us in writing.

Retention: until the Customer deletes the entry, the waitlist or its account. Email history and delivery records are deleted after 90 days; an address that bounced or complained is kept on a block list so it is not emailed again.

3. Our obligations

Instructions: we process the personal data only on the Customer’s documented instructions. The Customer’s settings and actions in Waitlisted, and this agreement, are those instructions. We tell the Customer if we believe an instruction breaks data protection law.

Confidentiality: everyone at our company who can access the data is bound to confidentiality.

Security: we take the technical and organisational measures in Annex 1 (Art. 32 GDPR) and may improve them, as long as the level of protection does not drop.

Data subject requests: we help the Customer answer requests from data subjects (access, correction, deletion, objection). Most can be handled directly in the dashboard (export, edit, remove). If a request reaches us, we forward it to the Customer without delay.

Other assistance: we help the Customer, as far as we reasonably can, with security, breach notifications, data protection impact assessments and consultations with authorities (Art. 32–36 GDPR).

Records and contact: we keep a record of processing activities. Our contact for data protection is support@waitlisted.me.

End of the service: when the subscription ends, the Customer can export its lists as CSV. We delete the personal data within 30 days after the account is deleted, unless law requires us to keep them. Backups are overwritten in their normal cycle.

Audits: we give the Customer the information needed to show compliance with this agreement. The Customer may audit, or have an auditor bound to confidentiality audit, with reasonable notice, at most once a year unless there has been a breach. Each party bears its own costs.

4. Sub-processors and transfers

The Customer gives general authorisation for the sub-processors in Annex 2. We give notice of new or replaced sub-processors at least 30 days in advance by email to the account address. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may end the subscription before the change takes effect. We put the same data protection obligations on each sub-processor as this agreement puts on us, and remain responsible for them.

Personal data of data subjects is stored in the EU. Where a sub-processor may access data from outside the EU or EEA, the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework) or the EU standard contractual clauses.

5. Personal data breaches

We inform the Customer without undue delay, and within 48 hours of becoming aware, of a breach affecting the Customer’s data. The notice says what happened, which data and how many people are likely affected, the likely consequences and what we have done or propose. We send further details as they become known.

6. Liability, term and law

Liability towards data subjects follows Art. 82 GDPR. Between the parties, the liability terms of the Waitlisted subscription apply.

This agreement runs as long as we process personal data for the Customer. Changes must be in writing (email is enough). If a clause is invalid, the rest stays in force.

This agreement is governed by the laws of Sweden; the courts of Malmö have jurisdiction, without prejudice to the data subjects’ rights under the GDPR.

7. Acceptance

This agreement takes effect when the Customer subscribes to Waitlisted or accepts its terms, and applies without a separate signature (Art. 28(9) GDPR allows electronic form). The current version is published on this page. Customers who need a signed copy for their records can ask at support@waitlisted.me.

Annex 1: Technical and organisational measures

Encryption: all traffic over HTTPS (TLS); data encrypted at rest by the database and email providers.

Access to customer data: database row-level security, so each account sees only its own waitlists. Invited admins see only the one waitlist they were invited to, and the Customer can remove them at any time.

Public pages: join, status and response pages never read tables directly; they go through fixed database functions that return only what that page needs. Status pages use long random links.

Abuse protection: rate limits on public forms (for example 300 responses a minute per response page).

Sign-in: passwordless email links and codes, or Google or Apple sign-in. We store no passwords.

Staff access: production access limited to the people who run the service, with individual accounts.

Availability: hosting on managed EU infrastructure with regular database backups.

Data minimisation: the name is optional on join pages; no analytics or tracking on join, status or response pages or in emails; email history kept 90 days.

Deletion: Customers can remove people and close, archive and delete waitlists in the dashboard; data is deleted on account deletion (section 3).

Email: every message from a Customer to its list carries an unsubscribe link; addresses that bounce or complain are blocked.

Annex 2: Sub-processors

Supabase Inc.: database and sign-in. Data stored in the EU (Ireland); standard contractual clauses for any access from the USA.

Vercel Inc.: hosting and delivering pages, on an EU and global edge network. EU-US Data Privacy Framework and standard contractual clauses.

Amazon Web Services EMEA SARL (Amazon Simple Email Service): sending emails, from servers in the EU.

Cloudflare, Inc. (Turnstile): checking that a form on a public page is sent by a person, using the visitor’s IP address and browser signals (never the answers). EU-US Data Privacy Framework and standard contractual clauses.

Resend Inc. (USA): sending emails, only during our switch to Amazon Simple Email Service. EU-US Data Privacy Framework and standard contractual clauses.

Stripe (payments) and PostHog (analytics) are not sub-processors under this agreement: they never receive data about people on the Customer’s lists.