Data Processing Agreement (DPA)

Version 1.0 Effective Date: June 22, 2026

Service Provider: UXPEDITION SOFTWARE S.R.L. (trading as docpenny) (“we”, “us”, “our”)

This DPA applies when we process personal data on your behalf as a Data Processor (as defined in our Privacy Policy). It forms part of our Terms of Service and is legally binding when you use the Service.

1. Subject Matter and Duration

The subject matter of this DPA is the processing of personal data by us on your behalf through the Service. The duration is the term of your contract with us under the Terms of Service.

2. Nature and Purpose

We process personal data solely to provide the PDF generation Service as described in the Terms of Service, including but not limited to: receiving and storing your Templates, Data Chunks, and content; generating PDFs based on your instructions; and delivering output via download or webhook.

3. Categories of Data and Data Subjects

Data Subjects: Your end users, employees, contractors, or any individuals whose personal data you include in content submitted to the Service.
Categories of Data: Any personal data contained in the Templates, Data Chunks, and content you submit for PDF generation — the categories are determined and controlled by you.

4. Obligations of the Processor

We shall:

Process personal data only on your documented instructions (as set out in the Terms of Service and Privacy Policy), unless required to do so by EU or Member State law.
Ensure that personnel authorized to process the personal data have committed themselves to confidentiality.
Implement appropriate technical and organizational security measures as described in §7 of our Privacy Policy.
Not engage another processor without your prior general authorization (see §5 below).
Assist you by appropriate technical and organizational measures, insofar as possible, for the fulfillment of your obligation to respond to requests for exercising data subject rights.
Assist you in ensuring compliance with obligations regarding security of processing, data breach notification, data protection impact assessments, and prior consultation (Articles 32-36 GDPR).
At your choice, delete or return all personal data to you after the end of the provision of services, and delete existing copies unless EU or Member State law requires storage.
Make available to you all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you.

5. Sub-processors

You provide general authorization for us to engage sub-processors in connection with the Service. The current list of sub-processors is available in §9.2 of our Privacy Policy. We will notify you of any intended changes concerning the addition or replacement of sub-processors via email to the registered account email address. If you object to a new sub-processor, you may terminate your account within 14 days of such notice.

6. Data Subject Rights

We will notify you promptly upon receiving a request from a data subject under Articles 15-22 GDPR relating to personal data processed on your behalf. We will not respond to the request without your prior written authorization, except to confirm that the request relates to your data.

7. Personal Data Breaches

We will notify you without undue delay after becoming aware of a personal data breach involving personal data processed on your behalf. Such notification shall include the information required under Article 33(3) GDPR to the extent it is available and can be disclosed without compromising the security of the investigation.