Data Processing Agreement (DPA)
Effective date:
This Data Processing Addendum (DPA) is concluded under Article 28 of Regulation (EU) 2016/679 (GDPR) as the data-protection addendum to your agreement with PDFLean: you, as the data controller, determine the purposes and means of processing; PDFLean, as the data processor, executes cloud processing only on your documented instructions and never uses customer data for its own marketing, profiling, or model training. When using browser-local WASM tools, files never leave your device and no processing delegation under this DPA arises.
1. Scope & Precedence of Agreement
This DPA applies to the processing of personal data submitted by or generated on behalf of the customer through PDFLean cloud computing services. Browser-local tools that operate client-side in WebAssembly without transmitting files to PDFLean infrastructure create no processor relationship, and this DPA does not apply to them. If any conflict arises between this DPA and the general Terms of Service, this DPA shall prevail regarding privacy and data protection.
2. Controller & Processor Roles
For the purposes of applicable data protection law, the customer acts as the Data Controller, and PDFLean acts as the Data Processor. PDFLean processes customer documents solely on documented controller instructions (initiated via interactive web commands such as merge, split, OCR, or conversion) and never processes personal data for its own marketing, profiling, or machine-learning training purposes.
3. Statutory Processor Obligations
PDFLean undertakes to uphold the following legal obligations under GDPR Art. 28:
- Documented Instructions & Data Minimisation: Process data exclusively according to customer directions, retain temporary documents only for the technical lifecycle needed to complete processing (auto-cleared upon completion or expiry), and notify the customer if an instruction appears to violate applicable data protection regulations.
- Personnel Confidentiality: Ensure all personnel authorized to handle infrastructure or customer support tickets are subject to strict contractual confidentiality.
- Incident Notification: In the event of a confirmed personal data security incident, notify affected controllers within 72 hours with comprehensive technical risk assessments.
- Assistance & Data Subject Rights: Assist controllers in fulfilling their obligations to respond to data subjects exercising statutory rights (access, erasure, rectification).
4. Authorized Infrastructure Subprocessors
Subprocessor certifications are those publicly disclosed by each provider (e.g. Cloudflare, Stripe). PDFLean itself makes no SOC 2 / ISO 27001 certification claim:
| Subprocessor | Service Function | Location | Compliance Standard |
|---|---|---|---|
| Cloudflare, Inc. | Edge computing, DDoS defense & R2 encrypted storage | EU & US Edge Nodes | SOC 2 Type II, ISO 27001 |
| Stripe, Inc. | Payment gateway & compliant VAT invoicing | Global Tier 1 Hubs | PCI-DSS Level 1 |
| Resend, Inc. | Transactional system email delivery | US / EU Channels | SOC 2 Type II |
| DeepSeek | Optional AI summarisation / translation (server-side proxy only) | China (mainland) — cross-border transfer | Model weights MIT; invoked only when AI features are requested; transfer under SCCs / your instructions |
5. Technical & Organizational Measures (TOMs)
We deploy defense-in-depth measures: TLS 1.3 encryption in transit; AES-256 encryption at rest; no permanent storage of customer documents (automatically cleared upon expiry); and least-privilege access control.
6. DPA Execution & Legal Contact
Enterprise and legal teams requiring a formally countersigned DPA with Standard Contractual Clauses (SCCs) may request the execution package via our legal compliance desk: support@pdflean.com; our legal team will provide the execution package within one business day.