Terms and Conditions

Last updated: 2 October 2026

These Terms and Conditions ("Terms") govern your access to and use of Renvelock, a secure file exchange service operated by Pen Paper Technology Ltd ("Renvelock", "we", "us", or "our"), a company registered in England and Wales under company number 13806469. By creating an account or using our website and services, you agree to these Terms.

If you do not agree, please do not use Renvelock.

1. About the service

Renvelock enables businesses to receive files from clients through encrypted upload links ("Locks"). Files are encrypted in the client's browser before they reach our servers. You are responsible for managing your company, Locks, passwords, and team access within your account.

2. Eligibility and accounts

You must be at least 18 years old and able to enter a binding contract. You agree to provide accurate registration information, keep your login credentials secure, and notify us promptly if you suspect unauthorised access to your account.

You are responsible for all activity that occurs under your account, including actions taken by users you invite to your company.

3. Your responsibilities

You agree to:

• Use Renvelock only for lawful purposes and in compliance with applicable regulations, including data protection laws applicable to your organisation and your clients.
• Obtain any consent or legal basis required before collecting or processing personal data through Renvelock.
• Maintain your own backups of important files and records. Renvelock is a transfer and intake tool, not a long-term archive or backup service.
• Safeguard your Lock passwords and decryption credentials. If you lose a Lock password, encrypted content cannot be recovered — including by Renvelock.

You must not use Renvelock to distribute malware, infringe intellectual property, harass others, or attempt to compromise the security or availability of the service.

4. Encryption and content

Renvelock is designed so that file contents and certain metadata are encrypted client-side. Operational data such as account details, Lock identifiers, timestamps, comments, and activity logs may be stored in plain form as described in our Privacy Policy.

You retain ownership of content you and your clients upload. You grant Renvelock a limited licence to host, transmit, and process that content solely to provide the service.

5. Data processing on your behalf

When your clients send files through your Locks, you (the business) are the controller of that personal data and Renvelock is your processor. This section is the data processing agreement required by Article 28 of the UK GDPR, and it forms part of these Terms.

Scope.

• Subject matter and duration: providing Renvelock to you, for as long as your company account exists, and afterwards until the data is deleted as set out below.
• Nature and purpose: receiving, storing, delivering and deleting what your clients send, and keeping your company's activity log.
• Personal data: files, file names, upload details and form answers, all of which are encrypted in the sender's browser so that we cannot read them; the sender's IP address and browser, recorded in your activity log; and the upload's time, size and number of files. Files may contain special category data (for example health information) if you collect it.
• Data subjects: your clients and anyone else who sends you files through a Lock.

What we do. We:

1. process this data only on your documented instructions, which are these Terms and your use of the service's settings, unless the law requires otherwise (in that case we tell you first, unless the law forbids it);
2. make sure everyone at Renvelock who can access the data is bound by confidentiality;
3. take the security measures described in our Privacy Policy (Article 32 UK GDPR), including encryption in the sender's browser that we cannot undo without your Lock password;
4. use sub-processors only under a written contract with data protection obligations equivalent to these. You give general authorisation for our current sub-processors, which are listed in our Privacy Policy: Amazon Web Services (hosting, storage and email, in London) and Amazon CloudFront (delivery of encrypted downloads). We will tell you of any intended change through the website or by email, and you may object; if we cannot resolve the objection, you may close your account. We remain responsible for our sub-processors;
5. help you, taking into account what we can access, to respond to requests from your clients exercising their rights, and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation;
6. tell you without undue delay after becoming aware of a personal data breach affecting this data;
7. delete the data when its retention period ends, when you delete it, or when your company is deleted. You can download anything you need beforehand. Deleted data leaves our backups within 35 days;
8. make available the information needed to show we meet these obligations, and allow and contribute to reasonable audits by you or an auditor you appoint, at your cost and on reasonable notice.

What you do. You:

• make sure you have a lawful basis for collecting the data through Renvelock (and a condition for any special category data);
• give your clients the privacy information they need;
• keep your Lock passwords safe.

Outside this processor role (for example your own account and billing data), we are a controller, as described in our Privacy Policy.

6. Subscriptions and payments

Paid plans, where offered, are billed through Stripe. Payment card details and billing addresses are collected and stored by Stripe, not on Renvelock servers. Subscription status and plan information may be stored in your account to enable service features.

Fees are charged as displayed at the time of purchase. Unless otherwise stated, subscriptions renew automatically until cancelled through your billing settings or the Stripe customer portal.

7. Support

Support is provided by email only. We do not offer telephone support or guaranteed response times unless expressly agreed in writing for an enterprise arrangement.

For general enquiries: contact@renvelock.com

For privacy-related requests: privacy@renvelock.com

8. Service availability

We aim to keep Renvelock available and reliable, but we do not guarantee uninterrupted or error-free operation. We may modify, suspend, or discontinue features with reasonable notice where practicable.

Scheduled maintenance, third-party outages, and events outside our reasonable control may affect availability.

9. Loss of content and limitation of liability

To the fullest extent permitted by law, Renvelock is not responsible for loss of content, including loss arising from:

• Forgotten, lost, or compromised Lock passwords or decryption keys
• Accidental deletion by you, your team, or your clients
• Client upload errors or incomplete transfers
• Expiry, retention limits, or account closure
• Hardware failure, network interruption, or force majeure events

You are solely responsible for maintaining backups and for the consequences of losing access credentials.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence, or for fraud.

Subject to the above, Renvelock's total aggregate liability to you for any claims arising out of or relating to the service shall not exceed the greater of (a) the fees paid by you to Renvelock in the twelve months before the claim, or (b) £100.

Renvelock is not liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, data, or goodwill.

10. Indemnity

You agree to indemnify and hold harmless Pen Paper Technology Ltd from claims, damages, and expenses (including reasonable legal fees) arising from your misuse of the service, your content, or your breach of these Terms or applicable law.

11. Suspension and termination

We may suspend or terminate access if you breach these Terms, create security or legal risk, or fail to pay applicable fees.

You may stop using Renvelock at any time, and you can delete your account yourself under Account → Security. A company whose only member deletes their account is deleted with it, together with its uploads and files, and any paid subscription is cancelled immediately without a refund for the rest of the billing period. Upon termination, your right to access the service ends. Some data may be deleted or retained as described in our Privacy Policy and as required by law.

12. Changes to these Terms

We may update these Terms from time to time. The "Last updated" date at the top will change when we do. Material changes will be communicated through the website or by email where appropriate. Continued use after changes take effect constitutes acceptance of the revised Terms.

13. Governing law

These Terms are governed by the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction, except where mandatory consumer protection laws in your country of residence require otherwise.

14. Contact

Pen Paper Technology Ltd (trading as Renvelock)
95 Ashby Road, Loughborough, Leicestershire, LE11 3AB, England
Company number 13806469

Email: contact@renvelock.com