Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between 3C SEBIRE, a sole proprietorship based in Switzerland, operating pdfstork (“pdfstork”, “we”), and the customer that uses pdfstork (“Customer”, “you”).

It applies automatically, without signature, whenever pdfstork processes personal data on your behalf. By accepting the Terms of Service, you accept this DPA. If your organisation needs a copy signed by both parties, write to support@pdfstork.com with your company name and the name of your signatory: we send you this version, signed, within 5 business days.

This DPA is designed to meet the requirements of Article 28 of the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Article 9 of the Swiss Federal Act on Data Protection (“FADP”), together the “Data Protection Laws”.

1. Roles and scope

For the personal data contained in what you submit to pdfstork to generate documents (“Customer Personal Data”), you are the controller (or a processor acting for your own client) and pdfstork is your processor (or sub-processor). Customer Personal Data includes the data sent through the API or the editors, the content of templates, uploaded files, and the payloads of webhooks we send to you.

For the data needed to run your account (account holders, team members, billing, support, security logs), pdfstork acts as a controller. That processing is described in our Privacy Policy, not in this DPA.

The details of the processing (subject matter, duration, nature, purpose, categories of data and data subjects) are set out in Annex 1.

2. Your instructions

We process Customer Personal Data only on your documented instructions, which are this DPA, the Terms of Service and the way you configure and use pdfstork (templates, API calls, output options, webhooks, account deletion). We do not use Customer Personal Data for our own purposes, do not sell it, and do not use it to train any model.

If the law requires us to process Customer Personal Data otherwise, we will tell you before doing so, unless that law forbids it. We will inform you if, in our opinion, an instruction infringes the Data Protection Laws.

You are responsible for the lawfulness of the data you submit, for having a legal basis to process it, and for informing the data subjects. pdfstork is not designed to process special categories of personal data, and the Terms of Service restrict their use.

3. Confidentiality

Access to Customer Personal Data is limited to the people who operate pdfstork and need it to run, support or secure the service. They are bound by an obligation of confidentiality.

4. Security

We implement the technical and organisational measures described in Annex 2, taking into account the state of the art, the cost of implementation and the risks for the data subjects. We may update these measures as long as the overall level of protection is not reduced.

5. Sub-processors

You give us a general authorisation to engage sub-processors. The current sub-processors are listed in Annex 3. Each of them is bound by written data protection obligations that are at least as protective as this DPA, and we remain responsible for their performance.

We will publish any new sub-processor on this page at least 30 days before it starts processing Customer Personal Data, and notify by email the customers who asked to be notified (write to support@pdfstork.com). You may object on reasonable data protection grounds within that period. If we cannot reasonably accommodate your objection, you may terminate the affected service and we will refund any prepaid amount for the remaining period.

6. International transfers

Customer Personal Data is processed and stored in Switzerland and the European Union. Switzerland is recognised as providing an adequate level of protection by the European Commission and the United Kingdom.

Files served through our content delivery network (uploaded template images and temporary PDF links) may be cached briefly at the network edge location closest to the person who opens them, which may be outside the European Union. Where a transfer to a country without an adequacy decision takes place, it is covered by the European Commission’s standard contractual clauses (with the adaptations required by the FADP and the UK GDPR) or an equivalent mechanism.

7. Assistance

Taking into account the nature of the processing, we assist you, by appropriate technical and organisational measures, in responding to requests from data subjects. Most requests can be handled directly in pdfstork: you can export the templates of a team (Settings → Team), delete templates, files and webhooks, and delete the account. If a data subject contacts us directly about Customer Personal Data, we forward the request to you without answering it ourselves.

We also provide reasonable assistance with your data protection impact assessments and prior consultations, to the extent they concern pdfstork.

8. Personal data breaches

We will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification is sent to the email address of the team owner and describes, as far as known at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. We supplement it as further information becomes available.

9. Deletion and return

Customer Personal Data is kept only for the periods listed in Annex 1. You can export your templates at any time before the end of the service. When you delete your account, its teams, templates, files, webhooks, API keys and logs are deleted at once. Copies in our database backups disappear as the backups expire, at most 12 months after deletion; backups are only used to restore the service after an incident. Data that the law requires us to keep is retained only for that purpose.

10. Audits

We make available the information necessary to demonstrate compliance with this DPA, in the first place by answering your written security and privacy questionnaires, reasonably and once a year. If that information is not sufficient, or if a supervisory authority requires it, you may conduct an audit, by yourself or through an independent auditor bound by confidentiality, with at least 30 days’ notice, during business hours, without access to other customers’ data, and at your own cost.

11. Liability, term and precedence

Each party’s liability under this DPA is subject to the limitations of the Terms of Service, unless the Data Protection Laws provide otherwise. This DPA remains in force as long as pdfstork processes Customer Personal Data. In case of conflict between this DPA and the Terms of Service, this DPA prevails for the processing of Customer Personal Data. This DPA is governed by the law and jurisdiction set out in the Terms of Service.

12. Changes to this DPA

We may update this DPA to reflect changes in the law or in the service. Any change that reduces the protection of Customer Personal Data will be announced at least 30 days in advance. Each version is numbered; a copy signed by both parties remains governed by the version it refers to, unless both parties agree otherwise.

Annex 1 – Details of the processing

• Subject matter and purpose: generating PDF documents from the templates and data submitted by the Customer, delivering them, and keeping the short history needed to debug failed requests.
• Nature: receiving, storing, rendering, transmitting (temporary links, webhooks) and deleting.
• Duration: for as long as the Customer uses pdfstork, then as described in section 9.
• Data subjects: determined by the Customer; typically the Customer’s own customers, employees, suppliers or other contacts named in the generated documents.
• Categories of data: determined by the Customer; typically identification and contact data, and commercial data such as invoices, orders, contracts or certificates.
• Special categories: none intended.
• Retention:
  • generated PDFs are not kept; a PDF delivered as a temporary link is deleted when the link expires, at most 24 hours after generation;
  • API request logs: only the last 10 per account, and the request payload of each log is deleted after 7 days;
  • webhook delivery history: 30 days;
  • templates and uploaded files: until the Customer deletes them or the account;
  • database backups: daily, kept up to 12 months (the last 14 days, then one per month).

Annex 2 – Technical and organisational measures

Hosting and isolation

• Application, database, PDF rendering and file storage run on bunny.net infrastructure in the European Union (France, Germany, with backup replication in Sweden).
• The database is not reachable from the internet. Administrative access goes through a private encrypted network, is limited to named administrators and is read-only by default.
• HTML rendering runs in a separate container; editor previews do not execute JavaScript.

Encryption

• All traffic to pdfstork and between pdfstork and its sub-processors is encrypted in transit (HTTPS / TLS).
• Passwords are stored hashed with bcrypt, never in clear text.

Access control

• Email address verification at sign-up; optional two-factor authentication (TOTP) with recovery codes; disabling it requires the password and triggers an email.
• Security emails on sensitive account changes; sessions can be listed and closed; email changes must be confirmed.
• API keys belong to a team and can be revoked at any time by its owner or admins; team members can be given read-only access.
• Rate limiting per team.

Data minimisation

• Generated PDFs are not stored beyond the delivery of a temporary link.
• Request payloads are kept 7 days at most, for the last 10 requests only.
• Error monitoring is configured not to collect personal data by default.
• API payloads, templates and generated documents are never sent to analytics or advertising platforms.

Availability and resilience

• Daily database backups to a separate storage zone, replicated in a second EU country; restoration is tested into a separate database.
• Error monitoring and alerting on server errors, failed backups and unclean restarts.

Organisation

• Production access limited to the people who operate the service, under confidentiality.
• Secrets kept outside the source code; production changes deployed through a reviewed, traceable process.

Annex 3 – Sub-processors

Sub-processors that may process Customer Personal Data:

Stripe, Resend, Infomaniak and GitHub process the data of account holders, for which pdfstork is the controller; they are listed in the Privacy Policy.

Contact

pdfstork / 3C SEBIRE
Switzerland
Email: support@pdfstork.com