Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") supplements the Terms of Service between PDF Converter Lab Inc. ("Processor") and the Customer ("Controller"). It applies to all processing of Personal Data carried out by the Processor on behalf of the Controller during the provision of the Service pursuant to Regulation (EU) 2016/679 (GDPR).

The Processor undertakes to: - Process Personal Data solely upon documented instructions from the Controller; - Ensure that all personnel authorized to process Personal Data have committed themselves to confidentiality; - Implement appropriate technical and organizational measures (TOMs) as required under Article 32 GDPR; - Assist the Controller in fulfilling its obligations to respond to data subject requests under Chapter III GDPR; - Notify the Controller without undue delay (and within 48 hours) upon becoming aware of a personal data breach.

The Controller grants general authorization to the Processor to engage sub-processors. Current approved sub-processors include: Google Cloud EMEA Limited (Cloud infrastructure & hosting) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Payment infrastructure). The Processor remains fully liable for the acts and omissions of its sub-processors.

Where transfers of Personal Data to third countries take place, the parties agree to execute the European Commission Standard Contractual Clauses (Module 2: Controller to Processor) with supplementary technical safeguards including end-to-end encryption.