Data Processing Agreement (DPA)

This DPA is entered into between:

Data Controller: [Client Name]
Data Processor: Job Done Marketing LLC, operator of euPDF.com

1. Subject Matter and Duration

The Processor will process personal data on behalf of the Controller for the purpose of providing PDF processing services via euPDF.com. The duration corresponds to the Controller's use of the service.

2. Nature and Purpose

• Uploading, converting, merging, splitting, compressing, OCR, and other document operations.
• Temporary storage during active session.
• Automatic deletion after session end or inactivity.

3. Types of Personal Data

• Uploaded documents (content may include personal data)
• Session identifiers. No client IP addresses are retained by the Processor beyond the free‑tier daily counter, which is used transiently and reset at midnight UTC.
• Session identifiers

4. Categories of Data Subjects

Employees, customers, or other individuals whose data is contained in uploaded documents.

5. Payment Processing Clarification

euPDF is not a payment processor. Payments are handled by third‑party providers (Stripe, Airwallex) using location‑adapted solutions compliant with local regulations. The Processor does not receive or store full card numbers or CVV data.

6. Obligations of the Processor

• Process personal data only on documented instructions from the Controller.
• Ensure confidentiality of authorised personnel.
• Implement appropriate technical and organisational measures.
• Assist the Controller in responding to data subject requests.
• Notify the Controller without undue delay after becoming aware of a personal data breach.
• Delete or return all personal data upon termination of the service.
• Make available all information necessary to demonstrate GDPR compliance.

7. Sub‑Processors

• Stripe, Inc. – payment processing
• Airwallex – payment processing
• Webdock – hosting infrastructure

8. Security Measures

• Isolation – each task in a separate Docker container
• Encryption – TLS 1.3 in transit
• Auto‑deletion – files removed after session end or inactivity
• Access control – no public access to uploaded files
• Logging – minimal logs retained for 7 days

9. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject requests.

10. Audit Rights

The Controller may audit the Processor’s compliance upon reasonable notice.

11. Governing Law

This DPA is governed by the laws of the Controller’s jurisdiction / EU member state.