Data Processing Addendum

This Data Processing Addendum ("DPA") is between Zeel Shekhaliya, an individual based in Surat, Gujarat, India ("we", "us"), and the customer that accepted our Terms of Service ("Customer", "you"). It forms part of the Terms and takes effect when you accept them. You do not need to sign it. If your procurement process needs a countersigned copy, write to legal@pdfconversionapi.com.

1. Definitions

Words defined in the Terms have the same meaning here. In addition:

• "Customer Personal Data" means personal data contained in the files, file names and request parameters that Customer sends to the API, and in the results we produce from them, that we process on Customer's behalf.
• "Data Protection Laws" means, to the extent they apply to the processing of Customer Personal Data: Regulation (EU) 2016/679 (the "GDPR"); the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (the "UK GDPR"); the Swiss Federal Act on Data Protection (the "FADP"); the California Consumer Privacy Act as amended by the California Privacy Rights Act, Cal. Civ. Code § 1798.100 and following, and its regulations, Cal. Code Regs. tit. 11, § 7000 and following (together, the "CCPA"); and the other comprehensive privacy laws of US states, such as the Texas Data Privacy and Security Act.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Subprocessor" means a third party we engage that processes Customer Personal Data.
• "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, in force 21 March 2022).

"Controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "consumer", "sell" and "share" have the meanings given in the Data Protection Laws.

2. Roles and scope

2.1. Customer is the controller of Customer Personal Data, or a processor acting for another controller. We are Customer's processor, or subprocessor. Under the CCPA, Customer is the business and we are its service provider.

2.2. This DPA covers only Customer Personal Data. We are an independent controller of the data we keep about Customer's account and its use of the service: the account's email address and sign-in identities, API key hashes, usage records and request logs. Our Privacy Policy covers that data.

2.3. Annex I describes the processing: its subject matter, duration, nature and purpose, the types of personal data and the categories of data subjects.

3. Customer's instructions

3.1. We process Customer Personal Data only on Customer's documented instructions. Customer's instructions are the Terms, this DPA, and each API request Customer sends, including its parameters (for example, StoreFile=true) and any request to delete a stored result. Other instructions need our written agreement.

3.2. If a law we are subject to requires other processing, we tell Customer before we carry it out, unless that law forbids telling Customer.

3.3. We tell Customer promptly if we believe an instruction infringes the Data Protection Laws. We may decline to follow that instruction until Customer confirms or changes it.

3.4. Customer is responsible for having a lawful basis, and for giving any notices and obtaining any consents, for the personal data in the files it sends. Customer will not send special categories of personal data (GDPR Art. 9), data about criminal convictions (Art. 10), or protected health information under HIPAA, unless we have agreed to it in writing. We cannot sign a HIPAA business associate agreement.

4. CCPA and other US state privacy laws

4.1. When Customer Personal Data is personal information under the CCPA, we act as Customer's service provider. This section contains the contract terms that Cal. Code Regs. tit. 11, § 7051(a) requires. Under § 7050(e), a person that does not have a contract with these terms is not a service provider, so the parties intend each term to apply exactly as written.

4.2. Business purpose. Customer discloses Customer Personal Data to us only for this limited and specified business purpose: converting the files Customer sends to the API into the formats Customer requests and returning the results to Customer, and, when Customer sets StoreFile=true, holding each result for download until its link expires 3 hours after the conversion.

4.3. We will:

1. not sell or share Customer Personal Data;
2. process Customer Personal Data only for the business purpose in section 4.2;
3. not retain, use or disclose Customer Personal Data for any purpose other than the business purpose in section 4.2, except as the CCPA permits;
4. not retain, use or disclose Customer Personal Data for any commercial purpose other than the business purpose in section 4.2, except as the CCPA permits;
5. not retain, use or disclose Customer Personal Data outside the direct business relationship between Customer and us, and not combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with consumers, except as the CCPA permits;
6. comply with the CCPA as it applies to us and give Customer Personal Data the same level of privacy protection the CCPA requires of businesses, including the security measures in section 7 and Annex II;
7. allow Customer to take reasonable and appropriate steps to ensure that we use Customer Personal Data in a manner consistent with Customer's obligations under the CCPA, including asking for the information in section 11.1 at any time, and the audits in section 11.2, which Customer may carry out once in every 12 months;
8. notify Customer no later than five business days after we determine that we can no longer meet our obligations under the CCPA;
9. allow Customer, on notice to us, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, including suspending its use of the API and requiring us to delete Customer Personal Data;
10. comply with the consumer requests that Customer tells us about, as described in section 8. Customer will inform us of any consumer request under the CCPA that we must comply with, and give us the information we need to comply.

4.4. We certify that we understand the restrictions in this section 4 and will comply with them. We bind each Subprocessor to the same restrictions by written contract and notify Customer of each Subprocessor as described in section 6.

4.5. Where another US state privacy law applies to Customer Personal Data, we act as Customer's processor, and sections 3 and 5 to 11 of this DPA are the processing contract that law requires: they set out the instructions, the nature and purpose of processing, the types of data, the duration, the duty of confidentiality, the rules for subcontracting, deletion or return of data, the information we make available, and Customer's right to assess our compliance.

5. Confidentiality

We give access to Customer Personal Data only to the people who need it to run the service, and each of them is bound by a duty of confidentiality, by contract or by law.

6. Subprocessors

6.1. Customer gives us general authorization to engage Subprocessors. Our current Subprocessors are listed at /legal/subprocessors. Today, the only Subprocessor that processes Customer Personal Data is Cloudflare, Inc., which provides the network, the API gateway, the conversion containers and the storage for results kept with StoreFile=true (Annex III).

6.2. At least 14 days before a new or replacement Subprocessor starts processing Customer Personal Data, we update the subprocessors page and email the address on Customer's account.

6.3. Customer may object to the change on reasonable data protection grounds by emailing legal@pdfconversionapi.com before the notice period ends. We will discuss the objection in good faith. If we cannot resolve it, Customer may terminate the part of the service affected by the change by written notice, and we will refund any fees Customer prepaid for the period after termination.

6.4. We impose on each Subprocessor, by written contract, data protection obligations that are no less protective than those in this DPA, to the extent they apply to the services the Subprocessor provides. We remain liable to Customer for each Subprocessor's performance of those obligations.

7. Security

7.1. We implement and maintain the technical and organizational measures in Annex II. We may change them over time, but not in a way that lowers the overall protection of Customer Personal Data. Our security page describes them in more detail.

7.2. We do not have a SOC 2 report or an ISO 27001 certification. We answer reasonable security questionnaires on request; write to security@pdfconversionapi.com.

8. Helping Customer

8.1. Data subject requests. If we receive a request from a data subject or consumer about Customer Personal Data, we pass it to Customer without undue delay and do not answer it ourselves, unless the law requires us to. Taking into account the nature of the processing, we help Customer answer such requests. Input files are deleted when each conversion ends and stored results within hours (section 10), so we usually hold no Customer Personal Data to access, correct or delete. Customer can delete a stored result at any time through the API.

8.2. Impact assessments and consultations. We give Customer the information we reasonably have to help it carry out data protection impact assessments and consult supervisory authorities (GDPR Arts. 35 and 36).

8.3. Security and breach duties. We help Customer meet its obligations under GDPR Arts. 32 to 34, through the measures in Annex II and the notices in section 9.

9. Security incidents

9.1. We notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. We send the notice to the email address on Customer's account.

9.2. The notice describes, as far as we know at the time: the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures we have taken or propose to take, and a contact for more information. Where we cannot give all of this at once, we give it in stages without further undue delay.

9.3. We take reasonable steps to contain and investigate the Security Incident and to reduce its effects, and we cooperate with Customer's own response.

9.4. Unsuccessful attempts that do not compromise Customer Personal Data, such as pings, port scans or failed login attempts, are not Security Incidents. Our notice of a Security Incident is not an admission of fault or liability.

10. Deletion and return

10.1. During the term of the Terms:

• each input file is held in the conversion container's memory (and, for engines that run as separate programs, in a temporary directory) only until its conversion ends;
• results are returned in the API response and not stored, unless Customer sets StoreFile=true;
• a result stored with StoreFile=true can be downloaded for 3 hours after the conversion. A job that runs every 15 minutes deletes stored results whose links have expired, and a storage rule removes any stored result more than 1 day old as a backstop;
• request logs, which can contain the name of a stored result and an engine's error message about a file, are deleted within 7 days.

10.2. Customer can delete a stored result before its link expires. Each stored file has its own FileId, and only the account that created a file can delete it:

# Convert with StoreFile=true and keep the file's id
FILE_ID=$(curl -s -X POST "https://api.pdfconversionapi.com/v2/convert/docx/to/pdf" \
  -H "Authorization: Bearer $PDFCONVERSIONAPI_KEY" \
  -F "File=@report.docx" \
  -F "StoreFile=true" | jq -r '.Files[0].FileId')

# Delete it before the link expires (prints 204)
curl -s -o /dev/null -w "%{http_code}\n" -X DELETE \
  "https://api.pdfconversionapi.com/v2/d/$FILE_ID" \
  -H "Authorization: Bearer $PDFCONVERSIONAPI_KEY"

After deletion, the download link returns 404.

10.3. Return. Every result is returned to Customer in the API response or through its download link. We keep no other copy, so after a link expires there is nothing further to return.

10.4. On termination of the Terms, we delete any Customer Personal Data we still hold within 30 days, unless a law we are subject to requires us to keep it. On request, we confirm the deletion in writing.

11. Information and audits

11.1. We make available to Customer the information necessary to demonstrate our compliance with GDPR Art. 28 and this DPA: this DPA, our security page, and written answers to Customer's reasonable questions.

11.2. If that information is not enough to demonstrate compliance, or a supervisory authority requires it, or after a Security Incident, Customer may audit our compliance with this DPA, either itself or through an independent auditor bound by confidentiality who is not our competitor. Unless a supervisory authority requires otherwise:

• Customer gives us at least 30 days' written notice and we agree the scope in advance;
• audits take place no more than once in any 12 months, during normal business hours, and without access to other customers' data;
• Customer bears its own costs and the auditor's.

11.3. Our service runs on Cloudflare's infrastructure, and we cannot give access to Cloudflare's facilities. For Cloudflare, we pass on the compliance information Cloudflare makes available to us, to the extent Cloudflare allows us to share it.

12. International transfers

12.1. Location. Cloudflare runs our service on its global network. A conversion runs in a Cloudflare location that has free capacity, which can be in a different country from Customer. Results stored with StoreFile=true are kept in Cloudflare R2's United States jurisdiction. We do not offer EU-only processing yet. We operate the service from India, so where we access Customer Personal Data, as section 3 and the Terms allow, we do so from India.

12.2. EU transfers. To the extent our processing involves a transfer of Customer Personal Data from the European Economic Area to a country without an adequacy decision, the SCCs are incorporated into this DPA as follows: Module Two applies where Customer is a controller, and Module Three where Customer is a processor. Customer is the data exporter and we are the data importer. For both modules:

• Clause 7 (docking clause) applies;
• under Clause 9(a), Option 2 (general written authorization) applies, with the notice period in section 6.2;
• the optional language in Clause 11(a) does not apply;
• Clause 13: the competent supervisory authority is set out in Annex I, part C;
• under Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland;
• under Clause 18(b), disputes are resolved by the courts of Ireland;
• Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

12.3. UK transfers. For transfers subject to the UK GDPR, the UK Addendum is incorporated into this DPA. Table 1 is completed with the parties in Annex I, Table 2 with the modules and options in section 12.2, and Table 3 with Annexes I to III of this DPA. For Table 4, neither party may end the UK Addendum under its Section 19.

12.4. Swiss transfers. For transfers subject to the FADP, the SCCs apply as set out in section 12.2, with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and the term "Member State" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence under Clause 18(c).

12.5. If the SCCs or the UK Addendum stop being a valid transfer mechanism, or the European Commission adopts new clauses for importers that are themselves subject to the GDPR, we will work with Customer to put an appropriate replacement in place.

12.6. We are not certified under the EU-US Data Privacy Framework. Cloudflare's data processing addendum with us relies on the Data Privacy Framework and on the SCCs (with the UK and Swiss additions) for Cloudflare's own transfers.

13. Requests from public authorities

If a public authority asks us for Customer Personal Data, we notify Customer promptly, unless the law forbids it. We review the request's legality, challenge it where we have reasonable grounds to think it is unlawful, and disclose only the minimum the request lawfully requires.

14. Liability

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Terms, except where the Data Protection Laws or the SCCs do not allow liability to be limited, including liability to data subjects under Clause 12 of the SCCs.

15. Term, order of precedence and changes

15.1. This DPA applies for as long as we process Customer Personal Data.

15.2. If there is a conflict, the SCCs and the UK Addendum take precedence over this DPA, and this DPA takes precedence over the Terms.

15.3. We may update this DPA to reflect changes in the law or in the service. We will not make a change that lowers the protection of Customer Personal Data without emailing the address on Customer's account at least 30 days before the change takes effect. If Customer objects, Customer may terminate the Terms before the change takes effect.

15.4. Except for the SCCs and the UK Addendum, which are governed as set out in section 12, this DPA is governed by the laws of India.

Annex I: details of processing

A. Parties

B. Description of the processing

C. Competent supervisory authority

• If Customer is established in an EU Member State: the supervisory authority of that Member State.
• If Customer is not established in the EU but has appointed a representative under GDPR Art. 27: the supervisory authority of the Member State where the representative is established.
• If Customer is not established in the EU and has no representative: the supervisory authority of the Member State where the data subjects whose personal data is transferred are located.
• For the UK: the Information Commissioner's Office. For Switzerland: the Federal Data Protection and Information Commissioner.

Annex II: technical and organizational measures

These measures were in place on the effective date of this DPA. Our security page explains them.

Access to the API

• The API is served over HTTPS at https://api.pdfconversionapi.com.
• Every conversion request needs an API key in an Authorization: Bearer header. Keys sent in URLs are not accepted.
• We store API keys only as SHA-256 hashes, with the last four characters of each key so that keys can be told apart. A disabled key is refused.
• Each account is limited to 600 conversion requests per minute.

Isolation of each conversion

• Conversions run in Cloudflare Containers with internet access turned off. The containers accept requests only from our API gateway, which authenticates to them with its own key.
• Containers run as a non-root user.
• Engines that run as separate programs get a new temporary directory for each run, which is deleted when the run ends. They start with a cleared environment, so no server variables or secrets reach them, get no standard input and have their output capped, and are stopped after 120 seconds together with every process they started.
• When HTML, email and e-book files are laid out in process, the layout engine reads no files and makes no network requests. When Chromium renders a page, it is served only the uploaded page; every other request is refused, and it runs behind an unreachable proxy with no DNS.
• LibreOffice runs with a new profile for each conversion and document macros turned off, and refuses linked files and the WEBSERVICE function.
• SVG files can load only images embedded in the file itself.
• CSV to XLSX conversion writes cell text as text and never as formulas.
• Automated end-to-end tests convert HTML pages and a CSV file that point at a file on the server, and check that nothing from that file appears in the result.

Limits against hostile files

• Requests larger than the Customer's plan allows (100 MB at most), all files and fields together, are refused.
• Image dimensions are checked before decoding, with a limit of 100 million pixels.
• PDF streams are limited to 256 MB after decompression; ZIP archives to 10,000 entries and 1 GB unpacked, with entries reduced to their base names; documents to 2,000 pages; each output file to 512 MB.
• A crash inside a file parser becomes an error response, not a server failure.

Storage and deletion

• Results are not stored unless Customer sets StoreFile=true.
• Stored results are kept in Cloudflare R2 in the United States jurisdiction, which encrypts stored objects with AES-256.
• Each stored result has a random 128-bit id. Its download link expires 3 hours after the conversion, a job that runs every 15 minutes deletes expired results, and a storage rule removes anything more than 1 day old.
• Downloads are sent as attachments with Content-Security-Policy: sandbox, X-Content-Type-Options: nosniff and Cache-Control: private, no-store.
• Only the account that created a stored result can delete it early.

Logging

• Request logs are kept for up to 7 days and usage records for 3 months.
• Logs do not record file contents.

Software supply chain

• When the container image is built, each conversion engine archive is checked against the SHA-256 checksums its project publishes, and the OCR models against checksums pinned in our build file. A mismatch stops the build.

Organization

• Access to the Cloudflare account that runs the service is limited to the people who operate it.
• Everyone with access to Customer Personal Data is bound by a duty of confidentiality (section 5).
• Security Incidents are handled and notified as described in section 9.

Not in place yet

• An independent audit or certification, such as a SOC 2 report or ISO 27001.
• A penetration test by an independent firm.
• A read-only root filesystem, dropped Linux capabilities and no-new-privileges on the hosted containers.
• A kernel-level sandbox, such as gVisor or seccomp profiles, around each engine run, in addition to the container.

Annex III: subprocessors

Customer authorizes the Subprocessors listed at /legal/subprocessors, as updated under section 6. On the effective date of this DPA, the only Subprocessor that processes Customer Personal Data is: