Auftragsverarbeitungsvertrag

This Data Processing Agreement ("DPA") forms part of the Terms between the customer acting as controller ("Customer") and Ludovick Guitton acting as processor ("Processor") when the Customer processes personal data contained in documents through PDFtoWorld.

1. Subject matter and duration

Processing of documents uploaded by the Customer to provide the Service, for the duration of the subscription. Documents are deleted after 24 hours.

2. Nature and purpose

Storage, conversion, editing, text processing and transmission of documents, exclusively on the Customer's documented instructions (use of the tools).

3. Categories

Data subjects: any person whose data appears in the Customer's documents. Data: any data contained in documents, possibly including special categories if the Customer uploads them.

4. Processor obligations (art. 28(3) GDPR)

The Processor: processes data only on documented instructions; ensures confidentiality of authorised personnel; implements the measures of Annex 1; respects the conditions for sub-processors; assists the Customer with data subject requests, security, breach notification and DPIAs; deletes data at the end of the service; makes available information necessary to demonstrate compliance and allows audits.

5. Sub-processors

The Customer gives general authorisation to the sub-processors listed below. The Processor informs the Customer of changes at least 30 days in advance; the Customer may object.

Processor	Purpose	Location / safeguard
Supabase Inc.	Database, authentication	EU (Paris) region
Cloudflare Inc.	CDN, security, file storage (R2)	EU jurisdiction bucket; EU SCCs + EU-US DPF
Contabo GmbH	Application hosting and document conversion workers	Self-hosted VPS; provider details: https://contabo.com/en-us/legal/impressum/
Stripe Payments Europe Ltd.	Payments, invoicing	EU (Ireland); independent controller for fraud prevention
Resend Inc.	Transactional emails	EU SCCs + EU-US DPF
Microsoft Clarity	Public-page behavioural analytics/session recordings, only with consent; ads storage denied	Microsoft processing locations and applicable transfer safeguards: see https://privacy.microsoft.com/privacystatement
Google Tag Manager	Consent-gated tag delivery; only consent flags are pushed by this integration	Google privacy/transfer terms: https://policies.google.com/privacy
PostHog Inc.	Product analytics (with consent)	EU Cloud (Frankfurt)
Plausible Insights OÜ	Cookieless audience measurement	EU (Germany)

6. International transfers

Transfers outside the EEA are covered by the Standard Contractual Clauses (Module 3 where applicable) or an adequacy decision.

7. Breach notification

The Processor notifies the Customer without undue delay and at the latest within 48 hours of becoming aware of a personal data breach.

Annex 1 — Technical and organisational measures

TLS 1.2+; AES-256 encryption at rest; row-level security; least-privilege access with MFA; malware scanning of uploads; per-IP rate limiting and bot protection; automatic deletion after 24 hours; audit logging; daily encrypted database backups (7-day retention); incident response procedure.