Data Processing Agreement

This agreement applies to every PDFxlsx account under Article 28 of the GDPR and the UK GDPR. It forms part of our Terms and binds both parties from the moment you accept them, so no signature is needed. To keep a copy for your records, print this page or save it as PDF from your browser.

1. Roles of the parties

You, the customer who holds the account (for a team account, the organisation that owns the team), are the controller of the personal data contained in the documents you upload. The operator of PDFxlsx is the processor and processes that data only on your behalf.

Account data that we need to run the service for you (your login email, billing records) is processed by us as a controller under our Privacy Policy.

2. Subject matter, nature and duration

We process the documents you submit through the website, the batch screen or the API in order to detect tables, recognise the text of scanned pages, and produce XLSX and CSV files. Processing lasts for as long as you use the service, and ends as described in section 8.

3. Types of data and data subjects

Whatever personal data appears in your documents, typically names, business contact details, invoice, payment and payroll data relating to your employees, suppliers and customers. You decide what you upload. Please do not upload special categories of data unless your use of the service requires it.

4. Our obligations

  • We process your documents only to perform the conversions you request. Using the service as offered is your documented instruction.
  • Everyone who has access to the systems is bound by confidentiality.
  • We assist you, as far as we reasonably can, with requests from data subjects, with security, and with data protection impact assessments relating to the service.
  • We notify you without undue delay after becoming aware of a personal data breach that affects your data.
  • We make available the information needed to demonstrate compliance with Article 28 and answer reasonable audit questions in writing.

5. Security measures

  • Uploads travel over TLS. Source files are stored only in encrypted form (AES-256), and the extracted table data in your conversion history is encrypted at rest as well.
  • Each conversion runs in its own private working directory that holds the only readable copy of the file and is wiped when the conversion ends, also when it fails.
  • Source PDFs are deleted automatically within 24 hours of conversion.
  • Access to a conversion is limited to the account that ran it and the members of its team. API tokens are scoped to the account and can be revoked at any time.

6. Sub-processors

You give general authorisation for the following categories of sub-processors, each bound by written terms that offer at least the protection of this agreement:

  • Cloud infrastructure provider for hosting, processing and storage.
  • Document recognition provider that reads scanned pages without a text layer and returns the recognised text, under terms that exclude using your documents to train models.
  • Email service provider for account and batch notifications.

Our payment processor handles card data as an independent controller and does not receive your documents. The current list of named sub-processors is available on request at support@pdfxlsx.com, and you may object to a new sub-processor on reasonable data protection grounds by writing to the same address.

7. International transfers

Our infrastructure is in the United States. Where your data leaves the EEA, the United Kingdom or Switzerland, the transfer is governed by the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor, and Module Three for onward transfers to sub-processors), which are incorporated into this agreement by reference, together with the UK Addendum where applicable.

8. Deletion and return of data

Source files are deleted within 24 hours of conversion. Extracted data remains in your conversion history so that you can download it again, and you can export it at any time. When you delete your account or your team, or ask us at support@pdfxlsx.com, we delete the related data unless the law requires us to keep it.

9. Precedence

If this agreement and the Terms conflict on the protection of personal data, this agreement prevails. Enterprise customers can have this agreement countersigned; individual terms agreed in writing then apply in addition to it.

10. Contact

Questions about this agreement go to support@pdfxlsx.com.