Data Processing Agreement

Businesses and organisations whose documents contain personal data of third parties conclude this data processing agreement under Art. 28 GDPR with us. To do so, send an email with the company name, address, contact person and the email address of your PDFUABox account to kai-uwe.schmidt@gmx.de. You will receive the agreement with this content countersigned as a PDF.

1. Parties, subject and duration

The controller is the customer; the processor is Kai-Uwe Schmidt, trading as BEL-IT, Aufhamer Straße 5a, 83229 Aschau, Germany. The subject is the conversion of DOCX documents to PDF/UA-1 including validation, encryption, watermarking and signing through PDFUABox. The agreement applies for as long as the customer uses PDFUABox.

2. Types of data and data subjects

All data contained in the uploaded documents and the files created from them is processed. Data subjects are the persons whose data the customer processes in its documents (for example employees, customers, business partners). We only process special categories under Art. 9 GDPR if the customer uploads such documents; the customer informs us beforehand.

3. Instructions

  • We process the data only on documented instructions from the customer. The instruction is the conversion of the uploaded documents with the chosen settings.
  • If a conversion fails, we may open the document within the retention period solely to find and fix the error in that job.
  • Use as test material or for other purposes is only permitted with the customer's separate, explicit consent.
  • If we consider an instruction unlawful, we inform the customer without delay.

4. Obligations of the processor

  • All persons with access to the data are bound to confidentiality.
  • We implement the technical and organisational measures under Art. 32 GDPR described in the annex.
  • We assist the customer with requests from data subjects, the notification of personal data breaches and data protection impact assessments.
  • We notify the customer of personal data breaches without delay, at the latest within 24 hours of becoming aware of them.
  • We provide the customer with the information needed to demonstrate compliance with these obligations and allow audits by arrangement.

5. Sub-processors

The customer agrees to the use of Microsoft Ireland Operations Limited (Microsoft Azure: hosting, database, file storage, operational metrics, sending emails; data centres in France, email data in Germany). We inform the customer in advance of new or changed sub-processors; the customer may object for good cause.

6. Deletion

Uploaded documents, results and reports are deleted automatically no later than 24 hours after the upload; there are no backup copies of them. When the agreement ends, the customer deletes its account or has us delete it; this also deletes the remaining account data unless there is a statutory retention obligation.

Annex: technical and organisational measures

  • Encrypted transmission (TLS) for all connections
  • Separate services for the web interface, the API and the conversion, each with its own identity and restricted rights; the conversion service only has the database rights it needs
  • Secrets (certificates, job passwords) stored encrypted, keys in a key vault; job passwords are deleted when the job is finished
  • Account passwords only as hashes, lockout after repeated failed attempts, rate limiting
  • Services in a private network without direct access from outside, containers without root privileges
  • Automatic deletion of documents and operational logs after no more than 24 hours; operational logs from before version 1.1.7 no more than 30 days; failure data saved by administrators to analyse errors (without document or document text) no more than 30 days
  • Access to documents only by the processor itself and only to fix errors

Last updated: November 7, 2026