Legal

Data Processing Agreement

Draft v1, version 2026-11-05. Effective 9 November 2026. Pursuant to Art. 28 GDPR. For review by a qualified lawyer.

This DPA forms part of the Pretty PDF Terms of Service ("Terms") between the Customer (controller) and DATS Digital LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA (processor, "Pretty PDF").

1. Scope

1.1 This DPA applies where Pretty PDF processes personal data contained in Customer Content on behalf of the Customer in providing the Service.

1.2 Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in Regulation (EU) 2016/679 ("GDPR").

1.3 Details of the processing are in Annex I.

2. Instructions

2.1 Pretty PDF processes personal data only on the Customer's documented instructions. The Terms, this DPA, the Customer's configuration of the Service, and use of the dashboard, API and MCP constitute those instructions.

2.2 Pretty PDF informs the Customer if, in its opinion, an instruction infringes data-protection law.

2.3 Pretty PDF does not use Customer Content to train AI models and does not sell personal data.

3. Confidentiality

Pretty PDF ensures that persons authorised to process personal data are bound by confidentiality.

4. Security

4.1 Pretty PDF implements the technical and organisational measures in Annex II, appropriate to the risk (Art. 32 GDPR).

4.2 Pretty PDF may update measures provided the overall level of security is not reduced.

5. Subprocessors

5.1 The Customer gives general authorisation for Pretty PDF to use subprocessors. The current list is Annex III (also published at /subprocessors; https://prettypdfprinter.com/subprocessors to be confirmed).

5.2 Pretty PDF notifies the Customer of intended additions or replacements at least 30 days in advance by email or in the dashboard. The Customer may object on reasonable data-protection grounds within that period; if no solution is found, the Customer may terminate the affected Service without penalty.

5.3 Pretty PDF imposes data-protection obligations on each subprocessor equivalent to this DPA and remains responsible for their performance.

6. International transfers

6.1 Customer Content is processed on infrastructure in the European Union (Germany) unless stated otherwise in Annex III.

6.2 Where processing involves a transfer of personal data to a country outside the EEA without an adequacy decision, including access by Pretty PDF itself if Pretty PDF is established outside the EEA, the parties agree to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor) and Module 3 for onward transfers to subprocessors, incorporated by reference, with: Clause 7 (docking) applies; Clause 9 option 2 (general authorisation, 30 days); Clause 11 optional language not used; Clause 17 law of Slovenia; Clause 18 courts of Slovenia; Annexes as in this DPA.

7. Assistance

7.1 Data subject requests: Pretty PDF forwards requests it receives and, taking into account the nature of processing, assists the Customer through appropriate measures (e.g. deletion and export functions).

7.2 DPIA and consultation: Pretty PDF provides reasonable information to help the Customer with data-protection impact assessments and prior consultations.

8. Personal data breaches

8.1 Pretty PDF notifies the Customer without undue delay and at the latest within 48 hours after becoming aware of a personal data breach affecting Customer Content.

8.2 The notice includes, as far as known: nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point.

8.3 Pretty PDF takes reasonable steps to contain and remedy the breach.

9. Deletion and return

9.1 By default, Customer Content is deleted after rendering. If the Customer enables document history, rendered Output and source files are kept until deleted by the Customer or until termination.

9.2 On termination, the Customer may export data for 30 days; Pretty PDF then deletes remaining Customer Content within a further 30 days, unless retention is required by law. Backups are overwritten within 35 days.

10. Audits

10.1 Pretty PDF makes available information necessary to demonstrate compliance with Art. 28 GDPR, including this DPA, Annex II and subprocessor information.

10.2 The Customer may audit once per year (or after a breach) with 30 days' notice, during business hours, at its own cost, by itself or an independent auditor bound by confidentiality. Pretty PDF may first offer written answers or third-party reports.

11. Liability and term

11.1 Liability under this DPA is subject to the limitations in the Terms, except where law does not allow limitation.

11.2 This DPA lasts as long as Pretty PDF processes personal data for the Customer.

11.3 In a conflict regarding data protection, this DPA prevails over the Terms; the SCCs (where applicable) prevail over this DPA.

Annex I: Details of processing

Annex II: Technical and organisational measures (summary)

Annex III: Subprocessors

See the Subprocessor List (incorporated by reference).