Data Processing Agreement (DPA)

1. Definitions

Terms such as “personal data”, “processing”, “controller”, and “processor” shall have the meanings given to them under the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

2. Scope & Purpose of Processing

The Processor processes personal data solely for the purpose of providing the file conversion service as instructed by the Controller.

Processing activities are limited to temporary handling of uploaded files for format conversion and delivery of output files.

3. Categories of Data & Data Subjects

• Data subjects: End users uploading documents
• Types of data: Files uploaded by users, file metadata, technical metadata (IP address, timestamps).
• Special categories: Not intentionally processed.

4. Processor Obligations

The Processor agrees to:

• Process personal data only on documented instructions from the Controller.
• Ensure personnel are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Not use personal data for any purpose other than providing the Service.

5. Security Measures

The Processor implements appropriate safeguards to protect personal data, including:

• Encryption in transit (HTTPS / TLS).
• Isolated and ephemeral processing environments.
• Restricted access controls.
• Automated deletion of data after processing.

6. Sub-processors

The Processor may engage trusted sub-processors (e.g., cloud infrastructure providers) solely for operating the Service.

All sub-processors are contractually required to provide data protection guarantees consistent with this DPA.

7. Data Retention & Deletion

Personal data is retained only for the duration necessary to complete file conversion. Files are automatically deleted within approximately 1 hour after processing.

8. Data Subject Rights

The Processor shall reasonably assist the Controller in fulfilling requests related to data subject rights, including access, erasure, or restriction, where technically feasible.

9. International Data Transfers

Where applicable, personal data may be processed in jurisdictions outside the user’s country. Appropriate safeguards are applied to ensure lawful transfers in accordance with applicable data protection laws.

10. Termination

Upon termination of the Service, all personal data will be deleted in accordance with retention policies unless retention is required by law.

11. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the State of Wyoming, United States.