Data Processing Agreement
Last updated: October 30, 2026
This Data Processing Agreement ("DPA") forms part of the Terms between the customer acting as controller ("Customer") and Ludovick Guitton acting as processor ("Processor") when the Customer processes personal data contained in documents through PDFtoWorld.
1. Subject matter and duration
Processing of documents uploaded by the Customer to provide the Service, for the duration of the subscription. Documents are deleted after 24 hours.
2. Nature and purpose
Storage, conversion, editing, text processing and transmission of documents, exclusively on the Customer's documented instructions (use of the tools).
3. Categories
Data subjects: any person whose data appears in the Customer's documents. Data: any data contained in documents, possibly including special categories if the Customer uploads them.
4. Processor obligations (art. 28(3) GDPR)
The Processor: processes data only on documented instructions; ensures confidentiality of authorised personnel; implements the measures of Annex 1; respects the conditions for sub-processors; assists the Customer with data subject requests, security, breach notification and DPIAs; deletes data at the end of the service; makes available information necessary to demonstrate compliance and allows audits.
5. Sub-processors
The Customer gives general authorisation to the sub-processors listed below. The Processor informs the Customer of changes at least 30 days in advance; the Customer may object.
| Processor | Purpose | Location / safeguard |
|---|---|---|
| Supabase Inc. | Database, authentication | EU (Paris) region |
| Cloudflare Inc. | CDN, security, file storage (R2) | EU jurisdiction bucket; EU SCCs + EU-US DPF |
| Contabo GmbH | Application hosting and document conversion workers | Self-hosted VPS; provider details: https://contabo.com/en-us/legal/impressum/ |
| Stripe Payments Europe Ltd. | Payments, invoicing | EU (Ireland); independent controller for fraud prevention |
| Resend Inc. | Transactional emails | EU SCCs + EU-US DPF |
| Microsoft Clarity | Public-page behavioural analytics/session recordings, only with consent; ads storage denied | Microsoft processing locations and applicable transfer safeguards: see https://privacy.microsoft.com/privacystatement |
| Google Tag Manager | Consent-gated tag delivery; only consent flags are pushed by this integration | Google privacy/transfer terms: https://policies.google.com/privacy |
| PostHog Inc. | Product analytics (with consent) | EU Cloud (Frankfurt) |
| Plausible Insights OÜ | Cookieless audience measurement | EU (Germany) |
6. International transfers
Transfers outside the EEA are covered by the Standard Contractual Clauses (Module 3 where applicable) or an adequacy decision.
7. Breach notification
The Processor notifies the Customer without undue delay and at the latest within 48 hours of becoming aware of a personal data breach.
Annex 1 — Technical and organisational measures
TLS 1.2+; AES-256 encryption at rest; row-level security; least-privilege access with MFA; malware scanning of uploads; per-IP rate limiting and bot protection; automatic deletion after 24 hours; audit logging; daily encrypted database backups (7-day retention); incident response procedure.