1. Parties to the Agreement
Data Controller: The PDFBlack user who uploads, processes, or manipulates PDF files containing personal data.
Data Processor: PDFBlack, provider of the online PDF processing tools service.
2. Subject Matter and Nature of Processing
The purpose of this DPA is to regulate the processing of personal data that the Controller introduces into the PDFBlack platform. The nature of the processing is exclusively technical and automated: editing, organization, conversion, compression, digital signing, OCR, and encryption of PDF files. All processing operations are executed locally in the user browser (client-side), without transmission to external servers, with the sole exception of the PKCS#12 digital signature service which requires ephemeral server-side processing.
3. Duration of Processing
The processing of personal data lasts for the duration of the user active browser session. Upon closing or reloading the tab, all data is automatically purged from RAM. PDFBlack does not retain, archive, or back up processed PDF files. The digital signature exception involves ephemeral processing of less than 60 seconds without subsequent storage.
4. Technical and Organizational Security Measures
PDFBlack implements the following technical and organizational measures to ensure the security of processed personal data, in accordance with Article 32 of the GDPR:
- 100% local processing in browser RAM (no disk persistence or server transmission).
- AES-256 encryption per ISO 32000-2:2020 for PDF file protection.
- Process isolation via Web Workers (no access to main DOM or other tabs).
- HTTPS/TLS 1.3 communications with HSTS and Content Security Policy.
- True binary redaction that physically removes data from document code.
- No external sub-processors are used.
5. Obligations of the Data Processor
PDFBlack, as Data Processor, undertakes to:
- Process personal data only according to the documented instructions of the Controller (the user).
- Not disclose personal data to third parties, except by legal obligation.
- Ensure that persons authorized to process data have committed to confidentiality.
- Assist the Controller in fulfilling security, breach notification, and impact assessment obligations.
- Delete all personal data upon completion of the processing session (tab closure).
- Notify the Controller of any security breach without undue delay (within 72 hours).
6. Sub-processors
PDFBlack does not use sub-processors for PDF file processing. All processing occurs on the user device. The digital signature exception exclusively uses the node-forge cryptographic library on ephemeral instances without storage. The Controller authorizes the use of these sub-processors by accepting this DPA.
7. International Transfers
Since processing occurs 100% in the user browser, no international transfer of personal data takes place. Data remains on the user device at all times. For the digital signature service, data is processed exclusively on servers located within the European Economic Area (EEA).
8. Acceptance and Validity
This DPA enters into force at the moment the user uploads a PDF file to PDFBlack and remains in effect for the duration of the processing session. Acceptance of this DPA occurs by the mere use of the platform, without the need for additional signature. To obtain a signed copy, contact contacto@pdf-black.com.