Data Processing Agreement

Version 1.0. Effective date: 27 October 2026

This Data Processing Agreement ("DPA") is between you, the customer who uses PDFDispatch ("you", the Client), and Šori rešitve, Daniel Arthur Hawton, s.p., Slovenska cesta 56, 1000 Ljubljana, Slovenia, registration number 7543727000, tax number 28722795 ("we", the Processor).

It sets out the terms that Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") requires when we process personal data for you. It is part of the Terms of Service (the "main contract"). You agree to it when you accept the Terms of Service; you do not have to sign anything. If you need a copy for your records, download one with your company's details in the web app, under "DPA". Questions: support@pdfdispatch.com.

1. Subject matter and duration

1. This DPA covers the personal data in the content that you send to the API and in what the API makes from it ("Customer Data"). Appendix 1 describes it.
2. It does not cover the data about your account, your API keys, your usage and your payments. For that data we are the controller, and the Privacy Policy applies.
3. You are the controller of Customer Data, or a processor acting for your own customers. You are responsible for making sure that you may send Customer Data to us and that we may process it as this DPA describes. If you are a processor, we are your sub-processor, and you confirm that your controller allows you to use us.
4. This DPA lasts as long as the main contract, and after that for as long as we hold Customer Data. It ends when the main contract ends.
5. Where US state privacy laws apply to Customer Data (for example the California Consumer Privacy Act), we act as your "service provider" or "contractor": we do not sell or share Customer Data, and we do not keep, use or disclose it outside our business with you.

2. Nature and purpose of the processing

We process Customer Data only to make the PDFs and other files that you ask for, to send them back to you, and to answer your support requests. Appendix 1 describes the processing, the types of data and the data subjects.

We do not:

• sell, rent or give Customer Data to anyone,
• use Customer Data for our own purposes, for analytics, advertising, profiling or product development,
• use Customer Data to train, test or evaluate any artificial-intelligence model, or send it to any AI tool,
• combine Customer Data with other data, except as the service needs.

3. Where Customer Data is processed

1. We process Customer Data only on servers in Germany, in the European Union. Our support mailbox is also in Germany.
2. We transfer Customer Data to a country outside the European Economic Area ("EEA") only on your instruction or with your prior written consent, and only if the conditions of Articles 44 to 49 GDPR are met. Before such a transfer, we tell you which country and which safeguard (for example an adequacy decision or the European Commission's standard contractual clauses) applies.
3. Our administrator may connect to our servers for urgent maintenance while travelling outside the EEA. This is only through an encrypted connection, and Customer Data is not copied to any device outside the EEA.
4. If you are outside the EEA, the files that the API sends back go to you there. This transfer is on your instruction. Where the GDPR requires a safeguard for it, the standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module 4 (from a processor to its client), are part of this DPA, with their annexes taken from the appendices of this DPA.

4. Technical and organisational measures

1. We take the technical and organisational measures in Appendix 2, as Article 32 GDPR requires. They protect the confidentiality, integrity, availability and resilience of the systems that process Customer Data.
2. We may change the measures as technology moves on. A change must never lower the level of protection. We record important changes and update Appendix 2.

5. Our other duties

1. Contact for data protection. We are a one-person business and have not appointed a data protection officer, because the law does not require one. Contact for data protection: support@pdfdispatch.com.
2. Confidentiality. Only Daniel Arthur Hawton, the owner, has access to Customer Data. Before anyone else gets access, they must sign a confidentiality agreement that lasts after their work ends, and learn the data protection rules for their work.
3. Supervisory authorities. We cooperate with supervisory authorities when they ask. We tell you at once about any inspection or measure by an authority that concerns Customer Data, unless the law or a court order does not allow it.
4. Claims and procedures. If a supervisory authority, a data subject or another person makes a claim against you about our processing, we help you as well as we can.
5. Reviews. We regularly check our processes and the measures in Appendix 2, at least every six months.
6. Requests from data subjects. We help you answer requests under Chapter III GDPR (access, deletion and the other rights). If a data subject contacts us directly about Customer Data, we tell them to contact you and forward the request to you within three working days. We do not answer it ourselves unless you tell us to.
7. Data breaches. If we learn of a personal data breach that affects Customer Data, we tell you without undue delay, and at the latest within 48 hours, by e-mail to your account's address. The notice includes, as far as we know at the time:
   • what happened, the types of data and the approximate number of data subjects and records concerned,
   • a contact for more information,
   • the likely consequences,
   • what we have done or plan to do about it, and how to limit its effects.
   What we do not know yet, we send as soon as we know it. We take reasonable steps to contain the breach and keep the evidence. We do not tell authorities or data subjects about a breach of Customer Data unless you ask us to or the law requires it.

6. Your duties

1. Tell us at once if you find errors or irregularities in how we process Customer Data.
2. The service treats all content the same way, with the measures in Appendix 2. You decide whether to send special categories of personal data (for example health data) and are responsible for having a legal basis for it.

7. Sub-processors

1. A sub-processor is another company that processes Customer Data for us to provide the service. Companies that only give us other services (for example payment, domain names, or tools that never receive Customer Data) are not sub-processors.
2. You allow us to use the sub-processors listed in Appendix 3 and on our sub-processors page.
3. Before we add or replace a sub-processor, or change where Customer Data is processed, we tell you by e-mail to your account's address at least 30 days before, and update the sub-processors page. The notice says who the company is, where it processes data, what it does and which safeguards apply.
4. You may object within those 30 days, for a reason based on data protection, by e-mail to support@pdfdispatch.com. We then try to find a solution with you. If we cannot, you may end the main contract before the change takes effect, and we refund the plan payment for the time after it ends and your unused credits. If you do not object, you agree to the change.
5. We give each sub-processor, by written contract, data protection duties that protect Customer Data at least as well as this DPA. We remain fully responsible to you for our sub-processors.

8. Your right to check

1. We give you all the information that you need to show that we keep this DPA and Article 28 GDPR. You can ask for it at any time.
2. We show this first by documents: this DPA and its appendices, our records, and the certificates and audit reports of our sub-processors (for Hetzner: ISO/IEC 27001, BSI C5 and its yearly audit of technical and organisational measures).
3. If these documents are not enough, you, or an auditor you choose who is bound to confidentiality, may inspect us, in person or remotely. Give us at least 30 days' notice. An inspection must take place during normal working hours, must not disturb the service, and must respect the security of other customers' data. We may refuse an auditor who works for a competitor.
4. You may inspect at most once in 12 months, except after a personal data breach or when a supervisory authority asks for it.
5. Each party pays its own costs of an inspection. If an inspection shows that we broke this DPA in an important way, we fix it at our own cost.

9. Other help

1. We help you meet your duties under Articles 32 to 36 GDPR: the security of processing, notices of personal data breaches to authorities and data subjects, data protection impact assessments and prior consultation with a supervisory authority.
2. We give this help, and the help under sections 5 and 8, free of charge to a reasonable extent. For work beyond that, we may charge our hourly rate, only after we tell you the expected cost in writing and you agree. We never charge for help with a breach that we or our sub-processors caused.

10. Your instructions

1. We process Customer Data only on your documented instructions, unless EU or Member State law requires us to process it. If the law requires it, we tell you before we process it, unless the law does not allow us to tell you.
2. Your instructions are this DPA, the main contract, and the requests you send to the API (including the URLs and webhook addresses in them). You can give further instructions in writing, and e-mail is enough. An instruction that changes the service is a request to change the main contract.
3. If we think an instruction breaks the GDPR or other data protection law, we tell you at once. We may stop following that instruction until you confirm or change it.

11. Deletion and return

1. We do not make copies of Customer Data except as the processing needs. The files you send and the files we make are deleted when the request ends. They are not stored in a database or in backups (Appendix 1).
2. Support e-mails that contain Customer Data are deleted when we no longer need them for your request, and at the latest after two years. When the main contract ends, we delete them at your request, or send them to you first if you ask.
3. When you ask, we confirm the deletion in writing within 10 working days.
4. We keep records that show that we processed Customer Data properly for as long as the law requires.

12. Other terms

1. Law and courts. This DPA is governed by the law of the Republic of Slovenia. The courts of Ljubljana have jurisdiction. Where the standard contractual clauses apply (section 3), their own rules on law and courts apply to them.
2. Liability. The liability terms of the main contract (section 14 of the Terms of Service) also apply to this DPA. They do not limit the rights of data subjects under Article 82 GDPR.
3. Protecting your data from third parties. If Customer Data held by us is put at risk by seizure, insolvency or other actions of third parties, we tell you at once, unless the law or a court order does not allow it. We tell everyone involved that the data belongs to you as the controller.
4. Changes to this DPA. We may change this DPA, for example when the law or our sub-processors change. A change must not lower the protection of Customer Data. We update the version and the effective date at the top, and tell you by e-mail at least 30 days before an important change takes effect. If you do not agree, you can end the main contract before that.
5. Contract accounts. If you have a written contract with us that includes its own data processing agreement, that agreement applies instead of this DPA.
6. Order of precedence. If this DPA and the main contract say different things about data protection, this DPA applies. If the standard contractual clauses and this DPA say different things, the clauses apply.
7. Severability. If a part of this DPA is not valid, the rest still applies.

Appendix 1: The processing, the data and the data subjects

Appendix 2: Technical and organisational measures

PDFDispatch runs on our own cluster of servers in Hetzner's data centers in Germany. The servers are built from code and run by one administrator. Hetzner is responsible for the physical security of its data centers (access control, power, cooling and fire protection) under its own certified measures (ISO/IEC 27001).

Appendix 3: Sub-processors

You allow us to use these sub-processors. The current list, and the other companies we work with, are on the sub-processors page.