Data Processing Agreement (DPA)
Important notice: The legally binding version of this Data Processing Agreement is the German version ("Auftragsverarbeitungsvertrag / AVV") pursuant to Art. 28 GDPR. This English page is provided for your convenience only. In case of any discrepancy, the German version shall prevail.
Overview
When you use PDF UA Kit to process documents that contain personal data of third parties (e.g. customer names and addresses in invoices), PDF UA Kit acts as a data processor on your behalf under Art. 28 GDPR.
The DPA covers the following key areas:
- Scope of processing — PDF generation, validation, and storage of documents within your account
- Types of personal data — Contact details, company data, invoice data, and document contents entered by you
- Technical and organizational measures — Server hosting in Germany/EU, TLS encryption, role-based access control, automated backups, and strict tenant separation
- Sub-processors — Hetzner Online GmbH (hosting, Germany), Paddle.com Market Limited (payments, UK/EU), and Resend, Inc. (transactional email, USA/EU)
- Data deletion — Validation uploads are deleted immediately after processing; all other data is deleted 30 days after contract termination
- Your rights — Audit and inspection rights, 24-hour breach notification, and the right to object to new sub-processors
Full agreement
The complete, legally binding Auftragsverarbeitungsvertrag (AVV) is available in German at:
Auftragsverarbeitungsvertrag (AVV) lesen →
Contact
If you have any questions about this Data Processing Agreement, please contact us at [email protected].