DATA PROCESSING AGREEMENT (DPA)
Last Updated: March 18, 2026
This Data Processing Agreement (“DPA”) forms part of the PDF Pro Terms of Service. It applies when PDF Pro processes Personal Data on behalf of a Business Customer (the “Controller”) to the extent such data is subject to GDPR, CCPA, or the BC Personal Information Protection Act (PIPA).
1. PROCESSING ROLES
- Controller: The entity using PDF Pro for business document management.
- Processor: PDF Pro Software Inc.
- Sub-processor: Third-party entities engaged by PDF Pro to perform specific processing functions.
2. SUB-PROCESSOR LIST
The Controller provides general authorization for the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| AWS | Cloud Hosting & Storage | USA / Global |
| Stripe | Subscription Billing & Invoicing | USA |
| LicenseSpring | Entitlement & License Management | USA / Global |
| LostHex | Software Development & Maintenance | Croatia (EU) |
| Sentry | Error Logging & Stability Monitoring | USA |
| Teamwork | Project Management & Task Tracking | USA / Ireland |
| Google Drive | Internal Document Storage & Coordination | USA / Global |
| Zendesk / HelpScout | Support Ticketing Infrastructure | USA |
| Support Agent | Human Support Operations | Philippines |
| Archbee | Technical Documentation Hosting | USA |
3. SECURITY MEASURES (TOMs)
PDF Pro implements Technical and Organizational Measures (TOMs) to protect data, including:
- Encryption: Data at rest is encrypted using AES-256. Data in transit is encrypted via TLS 1.2+.
- Access Control: Access to customer data within project management tools (Teamwork/Google Drive) is restricted to authorized engineers and support staff via Multi-Factor Authentication (MFA).
- Data Minimization: We instruct our team to only move the minimum necessary data from support tickets into project management tasks.
4. DATA BREACH & ASSISTANCE
- Notification: We will notify the Controller without undue delay (within 72 hours) upon discovering a data breach affecting their users.
- DSARs: We will assist the Controller in fulfilling Data Subject Access Requests (e.g., requests for deletion or export).
5. INTERNATIONAL TRANSFERS
For transfers from the EEA/UK to Canada, we rely on Canada's Adequacy Decision. For transfers to the USA or Philippines, PDF Pro utilizes Standard Contractual Clauses (SCCs) to ensure a level of protection equivalent to the GDPR.
6. GOVERNING LAW
This DPA is governed by the laws of British Columbia, Canada.