Data Processing Agreement
Defines how we process customer data on your behalf, the commitments we make and the sub-processors we use.
Roles of the parties
You decide the document content and the data you send through the API; for that data you are the controller.
Ramazan Uzunkavak processes it solely to provide the service and on your instructions, and is therefore the processor.
This agreement applies for as long as you use the service and is read together with the Terms of Service.
Subject matter and duration
Subject matter: generating documents from templates, storing them, serving them through shared links and metering usage.
Categories of data: whatever you place in document content, plus generation records and view and download events.
Categories of data subjects: your users who author documents and the recipients who open them.
Duration: the term of the service agreement and the retention periods set out in the Privacy Notice.
Processing on instructions
We process the data only to run the service, to keep it secure and where the law obliges us to.
We do not use your document content to improve our own product, to train models or to pass to third parties.
If we consider an instruction unlawful, we tell you before acting on it.
Confidentiality and access
Staff with access are bound by confidentiality, and access is limited to what the work requires.
Administrative access is written to the audit log; signing in on behalf of an organisation is recorded.
Data is isolated per tenant: another customer's document is never reachable through your account or your domain.
Technical and organisational measures
TLS in transit, separate signing keys for authentication, and scoped keys for API access.
IP addresses and browser details are stored in audit records only as an irreversible hash.
Shared document links carry unguessable identifiers, expire, and can be revoked on demand.
Document files are deleted automatically once their retention period ends; backup and restore drills are carried out.
Sub-processors
Hosting and infrastructure provider: Our own servers — Denizli, Türkiye.
Merchant of record: Paddle — name, e-mail address and invoice details. Paddle takes the payment in its own name and issues the invoice; card data never reaches us at any point.
E-mail delivery provider: Google (Google Workspace) — delivery of account and billing e-mails.
Before a new sub-processor is added this list is updated and you are notified at least 30 days in advance; you may object.
International transfers
Data is processed in Türkiye (Denizli) and customer data is kept in the country. Only two items are transferred abroad, and the basis for both is that the transfer is necessary for the performance of the contract. (1) Paddle — name, e-mail and billing details, so that the payment can be taken. (2) Google Workspace — e-mail address and message content, so that e-mail can be delivered. There is no other transfer abroad.
Where a transfer is required, it is not made unless the conditions of KVKK article 9 are satisfied.
Breach notification
We notify you of a personal data breach without undue delay and within 24 hours of becoming aware of it.
The notification covers the nature of the breach, the categories of data affected, the likely consequences and the measures taken.
We support you, as controller, in any notification you must make to the authority or to data subjects.
Data subject requests
We do not answer data subject requests directly; we forward them to you.
We provide the technical support you need to answer them within a reasonable time: access, correction, deletion and export.
Audit
On written request we provide the information needed to demonstrate compliance with this agreement.
We allow an audit once a year, of reasonable scope and with prior written notice.
End of the agreement
When the service ends you have 30 days to export your data.
After that period document files are deleted; invoice and audit records that the law requires us to keep are retained for their own periods.
On request, deletion is confirmed in writing.
Contact
Requests concerning this agreement go to support@pdfgine.com.
You are notified in your account whenever the version of this document changes.