Data Processing Agreement (DPA)

1. Definitions

• "Controller" — the business customer or API user who determines the purposes and means of processing personal data.
• "Processor" — PDFXINET Ltd, who processes personal data on behalf of the Controller.
• "Data Subject" — the identified or identifiable natural person whose personal data is being processed.
• "Personal Data", "Processing", "Supervisory Authority" — as defined in UK GDPR and EU GDPR.
• "Services" — the PDFXINET API and tools as described in the Terms of Service.

2. Scope and Role of the Parties

The Controller instructs PDFXINET as a data Processor to process personal data on the Controller's behalf solely to provide the Services. PDFXINET does not process personal data for its own purposes beyond what is necessary to operate the Services and comply with applicable law.

Subject matter of processing

3. Processor Obligations (GDPR Article 28)

PDFXINET agrees to:

1. Process personal data only on documented instructions from the Controller (i.e., the API requests made), except where required by applicable law
2. Ensure that persons authorised to process personal data are bound by appropriate confidentiality obligations
3. Implement appropriate technical and organisational security measures as required by GDPR Article 32 (see Section 5 below)
4. Respect the conditions for engaging sub-processors as set out in Section 6 of this DPA
5. Assist the Controller in responding to data subject rights requests to the extent technically feasible
6. Assist the Controller in meeting obligations under Articles 32–36 (security, breach notification, DPIAs, prior consultation)
7. Delete or return all personal data after the end of the Services, and delete existing copies, unless applicable law requires continued storage
8. Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits
9. Notify the Controller without undue delay upon becoming aware of a personal data breach affecting Controller data

4. Controller Obligations

The Controller agrees to:

• Have a valid lawful basis for any personal data it submits for processing via the Services
• Provide accurate and complete information in the API request that enables PDFXINET to provide the Services
• Not submit special category personal data (health, biometric, genetic, racial/ethnic origin, religious, political, sexual orientation, criminal) unless the Controller has obtained explicit consent or another lawful basis and has notified PDFXINET in advance
• Not submit personal data of children without appropriate parental consent
• Comply with all applicable data protection laws in respect of the personal data it processes

5. Security Measures (Article 32)

PDFXINET implements and maintains the following technical and organisational security measures:

• Encryption in transit: All API communications are protected by TLS 1.2+
• Encryption at rest: Temporary storage on encrypted AWS infrastructure
• Access control: Strict least-privilege access; API key authentication; no inter-customer data access
• Data isolation: Each API request is processed in isolation; output files are not accessible to other users
• Data minimisation: Input files deleted immediately after processing; guest/API output files permanently deleted within 24 hours of creation; registered-user output files retained under user control until explicitly deleted
• Availability: AWS-hosted infrastructure with availability monitoring and alerting
• Incident response: Defined procedure for breach detection, containment, and notification
• Testing: Regular security assessments and code reviews

6. Sub-processors

The Controller provides general written authorisation for PDFXINET to engage the following sub-processors in connection with the Services:

PDFXINET will inform the Controller of any intended changes to this list (addition or replacement of sub-processors) with at least 14 days' prior notice. The Controller may object to changes with reasonable grounds. PDFXINET enters into sub-processing agreements imposing data protection obligations at least equivalent to this DPA on each sub-processor.

7. International Transfers

Where personal data is transferred outside the UK or EEA (for example, to sub-processors in the United States), PDFXINET ensures such transfers are covered by appropriate safeguards including UK IDTA, EU Standard Contractual Clauses (2021/914/EU), or adequacy decisions. Copies of applicable transfer mechanisms are available on request.

8. Data Subject Rights

PDFXINET will promptly notify the Controller if it receives a request from a data subject exercising their rights under GDPR in relation to data submitted by the Controller. PDFXINET will not respond to such requests on behalf of the Controller without the Controller's instruction, unless required by applicable law. PDFXINET will provide reasonable assistance to the Controller in fulfilling such requests.

9. Data Breach Notification

PDFXINET will notify the Controller without undue delay (and where feasible, within 48 hours) after becoming aware of a personal data breach affecting Controller data. Notification will include: nature of the breach; categories and approximate number of data subjects affected; categories and approximate number of records; likely consequences; and measures taken or proposed.

10. Audit Rights

Upon at least 30 days' prior written notice, the Controller may audit PDFXINET's compliance with this DPA once per 12-month period, either by requesting an audit report from PDFXINET or by conducting an audit (at the Controller's cost). PDFXINET may require the Controller to sign a confidentiality agreement before disclosing audit information.

11. Liability

Each party is liable to data subjects and supervisory authorities for its own processing in accordance with applicable law. Between the parties, liability under this DPA is subject to the limitations set out in the Terms of Service.

12. Termination

This DPA terminates automatically upon termination of the Services agreement. Upon termination, PDFXINET will delete all Controller personal data within 30 days unless continued storage is required by law.

13. Governing Law

This DPA is governed by the laws of England and Wales and, where EU GDPR applies to the processing, by the law of the relevant EU member state.

14. Executing the DPA

To execute a signed version of this DPA for your organisation's records, or to request a DPA addendum tailored to your specific processing activities, contact: