Data Processing Agreement

1. Roles

For data you submit through the Service, you act as the Controller and Evixpdf acts as the Processor. We process personal data only on your documented instructions, which include your use of the Service and these terms.

2. Scope & purpose of processing

• Subject matter: provision of the Evixpdf PDF tools and API.
• Duration: for the term of your use of the Service.
• Nature & purpose: performing document operations you request and operating the account.
• Data subjects & categories: as determined by the content you choose to process.

3. Security measures

We implement appropriate technical and organisational measures, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, logging, and transient file handling with automatic deletion after processing.

4. Sub-processors

You authorise us to engage the sub-processors listed on our Sub-processors page. We impose data-protection obligations on each and remain responsible for their performance. We will give notice of new sub-processors so you can object on reasonable grounds.

5. International transfers

Where personal data is transferred across borders, we rely on an appropriate transfer mechanism, such as the EU Standard Contractual Clauses, together with supplementary measures where required.

6. Assistance & breach notification

We assist the Controller, taking into account the nature of processing, with data-subject requests, security, impact assessments, and consultations. We notify the Controller without undue delay after becoming aware of a personal-data breach affecting their data.

7. Return & deletion

On termination, we delete or return personal data processed on your behalf, except where retention is required by law.

8. Requesting the DPA

To execute a countersigned DPA or ask questions, contact legal@evixpdf.com.