Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between [Company legal name] (“eflowpdf”) and the customer that operates an eflowpdf workspace (“customer”). It applies whenever eflowpdf processes personal data on the customer’s behalf, and prevails over the Terms if they conflict on data protection.

For the data described below the customer is the controller and eflowpdf is the processor. Account and billing data about the customer’s own team is handled by eflowpdf as a controller, as described in the Privacy Policy.

• Subject matter and purpose: hosting and delivering the customer’s catalogs to readers, and measuring how they are read, only to provide the service.
• Duration: for as long as the customer uses eflowpdf, plus the deletion period in section 9.
• Data subjects: people who read the customer’s catalogs, and people whose personal data appears in content the customer uploads.
• Reader analytics: a pseudonymous visitor hash that rotates daily, approximate country and region, device class, the hostname of the referring page, pages viewed and time spent (capped at 10 minutes per page), hotspot clicks, search terms entered in the reader, and a random per-tab session ID. IP addresses and user-agent strings are used transiently to derive these values and are never stored.
• Content: any personal data inside the PDFs, images and videos the customer uploads, and in the text extracted from them for search.
• Special categories: none are intended. [Confirm, and state whether customers may upload them.]

eflowpdf processes personal data only on the customer’s documented instructions: the Terms, this DPA and the settings the customer chooses in the dashboard. eflowpdf will tell the customer if it believes an instruction breaks data protection law.

Everyone at eflowpdf who can access customer personal data is bound by confidentiality obligations and accesses it only as needed to run and support the service.

eflowpdf maintains technical and organizational measures appropriate to the risk, including:

• encryption of all traffic in transit with TLS;
• strict separation of workspaces, with every data access scoped to the customer’s workspace;
• reader analytics designed not to store IP addresses or user-agent strings, and without tracking cookies;
• hashed passwords, role-based access for workspace members, and an audit log of sensitive actions;
• [encryption at rest, backups, access control for staff, logging and monitoring, and incident response. Consider moving these to an annex.]

The customer authorizes eflowpdf to use the sub-processors listed in the Privacy Policy. eflowpdf will give at least [30] days’ notice before adding or replacing one, during which the customer may object on reasonable data protection grounds. eflowpdf imposes data protection terms on each sub-processor that are no less protective than this DPA and remains responsible for their performance.

eflowpdf will help the customer respond to requests from data subjects and meet its obligations on security, breach notification, impact assessments and consultations with authorities, taking into account the nature of the processing. Because reader analytics cannot be linked to a named person, and the visitor hash changes every day, eflowpdf generally cannot single out one reader’s events.

eflowpdf will notify the customer without undue delay, and within [48] hours, after becoming aware of a personal data breach affecting customer personal data, with the information it has at the time and updates as they become available.

Individual reader events are deleted on a rolling basis 13 months after they are recorded. The customer can delete catalogs at any time and download what it needs before closing its workspace. When the workspace is closed, eflowpdf deletes customer personal data within [30] days, unless the law requires it to be kept. [Backup retention.]

eflowpdf will make available the information reasonably needed to demonstrate compliance with this DPA, and allow audits by the customer or an independent auditor it appoints. [Frequency, notice period, cost and confidentiality conditions for audits, and any third-party reports offered instead.]

[Where customer personal data is stored, and the transfer mechanism used for transfers outside the EEA, UK or Switzerland (for example, the EU Standard Contractual Clauses and the UK Addendum).]

Each party’s liability under this DPA is subject to the limitations in the Terms. This DPA applies automatically to every workspace. To request a countersigned copy, write to [legal contact email] or support@eflowpdf.com.